{"report_id":"1c229822-d822-4bf0-9d72-dfcbe482800e","version":6,"status":"done","tags":[],"date":"2026-03-24T01:45:57Z","url":{"schema":"https","addr":"xprmarket.com/","fqdn":"xprmarket.com","domain":"xprmarket.com","tld":"com"},"ip":{"addr":"172.67.179.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"treasury-buttcoin.com/","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"title":"BUTTCOIN - The Original Memecoin Since 2011","dom":{"size":27694,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (535)","md5":"2f38f035cbc4ef688bd2b19d9aeb1a60","sha1":"f9cc4af0577fd432245b74a462ee7507edc8a244","sha256":"11e6b48b47b15f9d85a3ffccfe9d46d262b6644d232bc8583638e3a59625bc54","sha512":"9e48aadb2ff2899ecd9d50ee98a2229dc45f7dab769ada637c84f956279d850325e1be2821bf51c5a314ead37f24cc8cda3f106dff69e2f5fee044b29411c12a","ssdeep":"384:0Lc5mJ++c8HYRDjVD0YjG4B+/2za82dfY+5I8153zAtnTAjKauq:cc5mJ++c8HYRXVD0YjG4u2+8B8uVA","tlshash":"cac251a055f0622702428180abb36b5f2f65e257de0b04b673fd0bd56fa7f8add67108","dom_hash":"domhashac72f991df9f58cf822a205f25ccbb9c","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"xprmarket.com/","fqdn":"xprmarket.com","domain":"xprmarket.com","tld":"com"},"ip":{"addr":"172.67.179.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-28T01:45:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"xprmarket.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"xprmarket.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"xprmarket.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-03-22T22:31:48.48691Z","alert_count":0,"request_count":2,"received_data":117572,"sent_data":905,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"xprmarket.com","ip":{"addr":"104.21.18.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":1,"received_data":28551,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"treasury-buttcoin.com","ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-14","domain_rank":0,"first_seen":"2026-03-22T12:28:48.815145Z","last_seen":"2026-03-22T12:28:48.815145Z","alert_count":38,"request_count":19,"received_data":1659217,"sent_data":8768,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]},{"fqdn":"cryptologos.cc","ip":{"addr":"172.67.188.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-04-13","domain_rank":572515,"first_seen":"2019-08-22T11:22:00Z","last_seen":"2026-03-20T19:03:35.243964Z","alert_count":0,"request_count":4,"received_data":2906,"sent_data":1828,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"treasury-buttcoin.com/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fconvnetjs.cjs.js%3Ft%3D29571945%26u%3DIv3vtYOUoptGAkSpGDY5MjU2NDQ2MjhjZmYzYzM0MDI3YzFlNcoLfPsM8k--lInn-g","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","size":656642,"data":"","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-06-08T13:18:27.600009Z","times_seen":2556,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/isomorphic-fetch.dark.min.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8c474ecb85bba2a2d2585b0f62e9c62","sha1":"9d21cee8f25300fa20e648995b4a3af55b5206c0","sha256":"e6cb2680ffbef771df7d52fe0460c974442b72696a101b3e7ae79b5d965850fe","sha512":"10e906f0e89a7c855fd5357eafd50516cf60af5c7692785e21ebdddf5a89a37d4ea86bba0172789fb85b055e7449e1af59bfe547ac86204afc8a802468ac135c","ssdeep":"6144:YTJTNK83usKoY04YAtHLXDB3JGT8udonKByxXmS6HSSt/NnIOxcI7YM1SfRGtLe7:ya0avlKBW6Hi4gMG","tlshash":"86b430466db3847d9ff0a13586b121989bd3f4cacbd7a916b5d2af4bd012800fcd6362","size":493747,"data":"","first_seen":"2026-03-13T16:27:24.111989Z","last_seen":"2026-03-24T01:46:04.941299Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"7c21470151f9ae1f7b070e1481a019b8","sha1":"6436bbc318587d70bce89363983ee8b8bcf5743a","sha256":"99b11e2f7929c87738becacffe561e3c6c967bd7f6c2e1f6830ea17fc23d6fc8","sha512":"b9a61469b69e0619ad5213aad5de6c7ddc57d41d92009986f8be224a2ba0aae7a96a972af8b4d51a96c08b82be4dc51862ec20a2a01869d6861b959044de8470","ssdeep":"6144:x19XN4c3u8KoCRi+vhqCXDBH78ZAUsrkJ4x1my6HYW//Nt6Qzc4zsI1AhxEtRO0Y:vqc+DboJS6HOkmwa","tlshash":"aea421126db384799ff0b13586b112988be3f4dadbd7a925b5d2af4bd011800fcd6362","size":486383,"data":"","first_seen":"2026-03-13T16:27:24.140712Z","last_seen":"2026-03-24T01:46:04.943049Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-06-08T15:29:30.901899Z","times_seen":364010,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/ScrollTrigger.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ba1fa78eb4bb49f8a0eeaf8e61708840","sha1":"489bcf6d9c69f0f29f871e0323510c5197859bf5","sha256":"ad33c2df9ada8a663c2147357828f980d0b7ca731ef33eb3c6e4f327c3b2cda5","sha512":"a2731344a2412b3f0cd539eaa83b86065a30947d28845ccc5d844d79bcfec8e71ce5342bff300ab2d87386ebf4862c942848901105c4ca79d70af3533a4e7476","ssdeep":"768:L+5LHpwfVyb83wG/B/nE306RAHdAIsxmAK31horUp45:apqgo3wKB/nKRAHOIKS3TjK","tlshash":"741309ca3244b03267df627aa52f030a733654d9291e4464f266e4e83c7d5bc873be6d","size":43380,"data":"","first_seen":"2024-01-19T15:55:20Z","last_seen":"2026-06-08T13:55:17.938489Z","times_seen":5937,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/gsap.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"47da594cbece0e34a656e6bf2490b7c3","sha1":"2d26f4c060491ac980d09ca687388d3610256eb7","sha256":"28033e449a31ebcc396e5be8b13b63152bf03094288fb5867034321927bce087","sha512":"ede1d1c1c6d890ae1df60ffab43fe68647fef9ea131f0a4d33dc28071b4f5015a6ebbcde01f142f87adda04d866a729ea1c972fd5c5e2ef22ac2f09d93ba9272","ssdeep":"1536:auJ29KBROpgAEQ9a1tgwA6NSZW3ytdKTdIwEp28Ywz7CDE:f29CakgwdNSQ3yt8eNp28YqCA","tlshash":"d063e8d93292f423039a51a1447f094bf337a958640f0918f269e4ce7d3c9ad52bbe7a","size":72214,"data":"","first_seen":"2024-01-19T15:55:20Z","last_seen":"2026-06-08T13:55:17.989038Z","times_seen":7277,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/buttcoin-logo-text.png","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/buttcoin-logo-text.png HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 12517\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-30e5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ddWBMxEh4VZ9kq5QSYCYjUKbXUqcQEERNAIytlr6zZwWjMzWA2tc%2F1Gj%2BKIk8eVUyG2kT1TzXV0CB8zIeYzDb9f9PRC1%2FWH8KdKxvPddJ8B1n8e2MQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f6cde76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12517,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 441 x 94, 8-bit/color RGBA, non-interlaced","md5":"d97d854c45996355c12ec52885da7327","sha1":"a3d36080a8e70fb07eb296b942535fe9da1228bf","sha256":"01b5b296aca3c1bee5542b51dd6f9c6fe489be0e91e9f4d2c81b196dc3d8cd5b","sha512":"c2cd52e4493c6099987f5eb85b4c5bf155399646a23585794a96d4d1dcb4c063a2f4c03a133dc62a594be33b71d3f3721bf13326567760ea3e0393c740119cb4","ssdeep":"192:CkpTtISoji/DOk1vzTRI86MeUdbF3AMG8VlY/WlsAjrtx5U5eJIQLsj79lEd:BpTVoua6vzTRIRMbdbF3vzzYKxWQcA","tlshash":"8b42af84d9d150a2e328b49376d1f02aa7260d43f9545c49bee2df664f22553cf083eb","first_seen":"2026-02-06T22:25:11.023982Z","last_seen":"2026-03-24T01:46:04.917769Z","times_seen":328,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/pump.png","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/pump.png HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 47713\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-ba61\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NGNGQNc6wpYrZ6qvWLuppJ%2BUKwgpxPxx53i%2BC%2FjbDHQNsg%2FQcXp7NefW31Ig73Avk3sbAp8nBnHGZpsrBZqkNBiTMyLaiHbWtK%2FKJeDM0MzeHeDzPA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f6ce176ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47713,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1271 x 1314, 8-bit/color RGBA, non-interlaced","md5":"c4e83ff71a9d991aa1fa80927bba3040","sha1":"250be6e21cd0c68c77514f9cd4597708768659e3","sha256":"75f4c040dbe64a29f9901b9de7ad4d2cebb07f05c2130f67cb7b6db86a8fd8fa","sha512":"0ce8309e2fe0ff4ee579b74da7e7438652ef82fd75890870edf30c7465ba1c6602aea23f62b5eedc8e08f39bd5c700f08d3d222d66a2997e1c7c480b873f6bc8","ssdeep":"768:ov0RdSEAHgLKJhHxF/HBCwqEsL/MJMXxCN5c7u2UFYFtus3N5JLUtwL/g2dDaCM:ov0RdSEDe5H4fhCN2PUGFldXT/xdDu","tlshash":"d923f11708871aa0c9dc53be7831a37de77ca7a48122c999024eed6730b5dfba7c50e5","first_seen":"2026-02-06T22:25:11.048573Z","last_seen":"2026-04-28T10:02:30.889393Z","times_seen":337,"resource_available":false,"data":null}},"time_used":281,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/moonshot.png","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/moonshot.png HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 163603\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-27f13\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Uw4vsJaTFPV8v%2BtAaQ8pO4rQi9q%2FAx%2Bb0PxHJlOlBkbusGlT75B6nL%2Bv8v2QDSsFODQqPr7vyasEVxHHksUn951E%2FTnZgFv6MyPiGysSgA5UmeB9JA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f7ce576ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":163603,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGB, non-interlaced","md5":"57fd61189d752d573343323364b4a6ff","sha1":"bb034b396d03233fea5a376d40fecc3551fe4e34","sha256":"cfa33eb0a697c1a399d8c037564457117c93e28b744cdf018d813d775c0c97b7","sha512":"d08c46f8e10f6e82cca11bd13f01616d50e95a6bae7a364e8c9f20abe383da5719b8d3304ccd772a2fa2fe5a3027cd87f361e9affa36d8e932cdb38215f383db","ssdeep":"3072:RH/VZgmNBEWL4s1pW4a1JysCKJkDe/FbPptENBjTref2eTyhvnvUA:FN58wW4a13TS0bB2NBj3e23hvvUA","tlshash":"acf312f89f9a5f13aa5cca4e55a72afd38f80d132223520723fdc854934fce52649726","first_seen":"2025-09-30T16:15:35.899295Z","last_seen":"2026-04-28T10:02:30.907105Z","times_seen":345,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":129,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Tue, 24 Mar 2026 02:33:35 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HLN2GUxWTgR2IJm6WiT5D6n6FwvL9bGBygSAODFrTHlVy3F9LHPBVmzMQ1G3Gev7jjyBO3SNhvwr%2B%2BESDHNVwycYfB69GDopqYF9KJJedl2kVm50gg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncf-ray: 9e11ff4f7ce676ef-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-06-08T15:29:30.901899Z","times_seen":364010,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/phantom.jpg","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/phantom.jpg HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 6485\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-1955\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GBSXyvRGFr2c8BT%2F2%2BRLbAwjSodVN2cWkERxbOg9ACEk3EshN%2B%2FNwKUTY4tA7SOAfoOPVznuP%2B%2FzaD0JFg9fqnSPz2DHpNQ7bZ0n5T0rKC96fCnUnw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f7ce476ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6485,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"e395c8ebfb9908b692308c317ffeaa22","sha1":"01dbca7cb99bc388ed0e232dad781b35527f1db0","sha256":"97f7fa29279ff539701360e9bd6641a02bf76ed6af61c6b5b1f087c2d6473290","sha512":"a8057d55904a6d042a97d533a6fe9bffee7aa64bbb3ad0d10ff9bb0b071df9a3d01f97e0f11d63ecd0f9a9c78303ea6c12704e07cb8f6b5100fb9ed6af539fe0","ssdeep":"96:X894vhLgcVcCwCcXSYw1nzXLhjTHMazZ/qFDKNByDjAZBw:sDciCw/CYknzRTsad/qpKao8","tlshash":"a7d17dd757809b2ac81d273c9ca80bd1ff956e23078a277be0160c191b9d1b1d89c6d7","first_seen":"2026-01-28T09:30:13.328316Z","last_seen":"2026-04-28T10:02:30.915509Z","times_seen":334,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/script.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 0\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1jXDjSPciwIoPjmdsHVy1fDyJcg%2BUASiDsv0les96GFJtP22GF7DJDxm%2BWtfsTIjbcWUEhR%2FI7rHkKQ0BuQ1J1DDaLQ%2BWKZK4Qoq%2B1kdZXWN7eiTIw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: 9e11ff52fd2676ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptologos.cc/logos/bitcoin-btc-logo.png","fqdn":"cryptologos.cc","domain":"cryptologos.cc","tld":"cc"},"ip":{"addr":"172.67.188.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptologos.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 12 Feb 2026 11:19:19 GMT","end":"Wed, 13 May 2026 12:17:42 GMT"},"fingerprint":{"sha1":"0A:19:3B:1A:59:5D:70:32:FA:27:97:BE:96:A4:5C:10:C1:AA:2C:D3","sha256":"FC:29:2A:D7:F8:A5:2D:9B:E9:13:EF:94:FC:C0:93:D2:4D:36:C0:E6:B8:C2:01:12:0D:3E:9D:0C:81:4E:5E:35"}}},"request":{"raw":"GET /logos/bitcoin-btc-logo.png HTTP/1.1\r\nHost: cryptologos.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ph%2BJjc4sx98jzgtVuxaOSWZp57h52YDHeBm4jN4QeWQLAHV1j5YiQ0cQw3gGr2x1gIBYOxPg92orefXhCze8R2n2ByONYVuG9jDYMzWc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e11ff4fcaa61a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":50,"dns":39,"connect":1,"send":0,"wait":14,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/fomo.jpg","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/fomo.jpg HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7735\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-1e37\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WDeYoXMrqQH9qpFZMro1B0ymhVemniGTi41q6xeRshIX9vB6EHXMtSYBpuJozdtkGNhWjC%2BesmJDoPUL2Yf6nNEJqMNhaNRtPBQmrzUcApMl3%2FUX0Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f7ce376ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7735,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"8154916bfe70849a70a005c3db53e6a0","sha1":"0bfdf8886e68f2ba23855816bbb5546ccc88aa5f","sha256":"5f92362d6675ceb4e25d8d462a97b5759dedfea9e1a43be9e348c20b1dc8ecd7","sha512":"b33df49f0111f003e9be4872bb21d3f671b0385b3cb748e700942fa59d250af8f5b8a975b9b4de86df28bd77dd4c3a8ea468117fa379a307f1c785b2364be1b3","ssdeep":"192:sMFQaqfX7Cln5nnnnnnxBF9KHLXkeTkvq0R3P4dJR:svDCln5nnnnnnl96XkMky0JP4jR","tlshash":"00f18df293842317f41e4571b09adb68cf06ac6d516ecb4b9a7070b1772b0829c1925b","first_seen":"2026-02-06T22:25:11.033108Z","last_seen":"2026-04-28T10:02:30.90916Z","times_seen":329,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/secureproxy?e=ping_proxy","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://treasury-buttcoin.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 4\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\naccept-ranges: bytes\r\nlast-modified: Tue, 24 Mar 2026 01:45:36 GMT\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B8eICyYbXXjH%2FFsqQV3In2D3oeTWCMsq0MQ7hlxgOO9mhLSVbfpC7almS5mlD9IfCk32HL%2FlNtiW1mfvTX1soQVYduOw5pvjY18E8K4JXJp2JanoQg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff52cd2276ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-06-08T13:09:33.777887Z","times_seen":8784,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/ScrollTrigger.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/gsap/3.12.5/ScrollTrigger.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 15904\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65a9b559-3e20\"\r\nlast-modified: Thu, 18 Jan 2024 23:33:45 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 280\r\nexpires: Sun, 14 Mar 2027 01:45:35 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y6ROuYoKU%2B1vVRwtnEL5dvO%2B6tiNagepfptyCCw3emFysPgb3JxD35jg1g23m864Kb8hSULRbAEeCJ3YSJKL4r4DYOaUH9DG69wuW%2BnuUudwIqY%3D\"}]}\r\ncf-ray: 9e11ff4f8ed3783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43380,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (43088)","md5":"ba1fa78eb4bb49f8a0eeaf8e61708840","sha1":"489bcf6d9c69f0f29f871e0323510c5197859bf5","sha256":"ad33c2df9ada8a663c2147357828f980d0b7ca731ef33eb3c6e4f327c3b2cda5","sha512":"a2731344a2412b3f0cd539eaa83b86065a30947d28845ccc5d844d79bcfec8e71ce5342bff300ab2d87386ebf4862c942848901105c4ca79d70af3533a4e7476","ssdeep":"768:L+5LHpwfVyb83wG/B/nE306RAHdAIsxmAK31horUp45:apqgo3wKB/nKRAHOIKS3TjK","tlshash":"741309ca3244b03267df627aa52f030a733654d9291e4464f266e4e83c7d5bc873be6d","first_seen":"2024-01-19T15:55:20Z","last_seen":"2026-06-08T13:55:17.938489Z","times_seen":5937,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":16,"dns":0,"connect":1,"send":0,"wait":6,"receive":1,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/buttcoin.jpg","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/buttcoin.jpg HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 29752\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-7438\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C5vjVInh6ABp3c%2FqJXj8wADAHdBwPjlQN5%2B0qQb7uSLBURO5ZQVNV3CPuJ5ZmR2qsRxB8wEm2xZoOU5xcJFn85%2FL1qGSXl1PIaxScHKldyruY6zTcg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9e11ff542d3276ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29752,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, baseline, precision 8, 500x500, components 3","md5":"c64251749eb46096256b6f81603cd776","sha1":"c72bee02afe40b20ad86a6d3eba69088284b6698","sha256":"963a4ed00b72f5e8244f1f871f72217576b72e3ab11ed5a7e8ba923af9d4c9af","sha512":"16e795979efa218b7f0124e94116ba6794a5147697ef8c8076a560ad0b72e2dfbe98b5e41bc23bc185db01661f23c28d878ad35e513aa886803213a9834d79cb","ssdeep":"768:EQ9wPEi7kx3x77kZwSh32Yjmn1Soi0vgfnAH5A4Xz:59Qkxx7U/9bm1Zi0iAH5bj","tlshash":"7cd2f2c74b19a263efc58637602f8b5a6e374f42d91e153bdd3581f204b2622b9942b0","first_seen":"2026-02-06T22:25:11.030331Z","last_seen":"2026-04-28T10:02:30.874807Z","times_seen":329,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com//secureproxy?s=%2Fjmpd%2F","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:38.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"POST //secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://treasury-buttcoin.com/\r\ncontent-type: application/json\r\nContent-Length: 2251\r\nOrigin: https://treasury-buttcoin.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2251,"data":"{\"route\":\"8XUwkBv9vhPYfVpD1fxb7EC65sUXJdqr\",\"payload\":\"3ABgKh1fg4CQx4Vin5YHqx5iyZvH723ZHzJqddkEZiwAPsdKkHUimp45ksjZuE9WGkiUB7ZwCfPnQDbJiFaSAznkHNZv9dBEZEp54byWPUrShrJLa1b9SpLPtKsBJbZqu6N3mv5hAv1QK8k2qrRTa2zDnvseZzKd3ThJKBBVLXiFavMREYDm5KWjoJyrr5Pw3dypM1Stns8r3ohFs4RhAZVnJAmFhTS5JWB2H8iuh8CSL6CEiyRjqtEmYbnPWbgDtUzKbsoN9XBCMQB8jXzCGe3JmK2njT1LcYqkwPVyosiTgSf2gfNTMm7zYnR98V4jFhJAT7rpZbSn85ALQibkNxxskPEk8KAHyUYeYpEY54f3KKfoTXcNyZWWvjh4jCvmgGo8v6XWG8Csxq2ysnLx8i2MBEUfa6MXeTTuftqSFhTn1pcThUrGSsfazwxUDhmn8PVTkCrKjzsS47RUYRSbKcqwStop5u6YoZtAeTtUccvuRPwVxGwaBwnUTHhTBuXpjk5QMtCrFAkA4PdtTh1rA2MwpEeqGtyy5yyoudovdjtjFYP2Rj9dpaEFEZcvTXYkMNZsRAoVbnF5rgspG285VAQSYW8f6A1KzDEe8oMj5UESUpoe4WZns8h1cu6ZKox8tPEkdUcjAQof2XSdGxym6JumpDQABt5dvWpd78Vnd2KbkFwEnWbidJNeWjtHiejCLiKBhXQx8k3MwsEV1Vj3dpnCA7kQ6Cg3SAdisPkZC2HUM84PPvZ5CJL1bWwYzrWAVNF27sQcK4S9Fg5qk2Sefaib9H8czwRk66pej6G6JQLtzT8SGj6xiCQzM2umtGmnhNCPLsdVamRKVcZySEyekyUiXnR2HFHoVf7G9wrDwR7e5SFBaDQ6QZkdZQh35Rvrp1ZBHNdvZBWo4zh5rwj8D38BHjSE8qAKMkZ3GU8PRWKKMU6ZLnzqYZsGUrpamNMJzjBM5sY2JAPAeGAtGWbov6pLteWySzEs2popyyJsf9tGn82qrPkRp4nPEMnsaSerNQ8oKCTGtR72DdzCz233rVG1uPapbXdqQvR3oXcutYcnkDKnM4PBUzz8g2nqTsw8yb5uckLKWVRbhguR1MD4TKXGARZuYBvK6dYASZoCCY1g8uYgezEawzcewr4FtThp67KEUtP1dNvVKmEhRpNz2pevCY6oUvyoCRGPH8ffSaR4iyjpYoNYqpJDe24fA1WKJRMrgfmDf7GapbacMHLbQcCWjcWFinsncAA5ZQnb8MajwjZDVYHRtEUJTBY73gbbcRTM1TfbQB7oG4cuT6cKKK8UvMoDUA4CxxFMvKFTRxxdSx4Hb8AWw12NAKrteqnGF1m2mjZugJuXBj1du1hFgHL9cgF3PHrQggRfrNgWVkUcq3A35owW8VBBj2dDRLNUv5rM6Fg33T21cgFPQ77q6BSTSMvHmbHk9LYYxRJeaA3Z8DrXNFhLwEpWg99hUJNmdkSPzxCNebK2GXuktLTLqEujggDn1z2xo4tRA7NS5Rw7dmgFWyEduMD6JA2JwN25xx9t7QinFvdRB39orw7WrNAynRfMkyofJzWBmqnpZCwMt6DYkG7qpCVaFTrK87ZGfbT8vp7khUBLb7tYYP6fTNCCCQta8UXNA29nfzURtZNrYp8wPz5EeHSejQmPCE8qHjvAXjLYhi7VKQXer3ASpceJAAHH4hYpBJCH5A82D7dGKbndukjSPnr8oXhh9A4UhudwWN6HfLpnwfLsHAg1PHG17rhEyjw5qK2UAfRAD3Mnwg2j4WtGpP9NChFJkifEMtcZFrsWSumkwYNbpEcmDH6Rva8bYxWapo3Q7vCjmdMVfRhsegWkh24jsok3vitWwVVYmmbbjEMArFKpzkfQg1EdYJHfTgbUmHarGuLUN783eQ3Sj6R7SqnhNCqH6xnj2XABvj3M1mgbxDuytouu79sKyVcJNdhgT4wWgFrsYFcKocAXbwvmnP8YkRdCufiUQcfEyW6yf5YYyDrbBtsEmUiYyoZWu8CsErWXGugsWNZkvpXzuqyZf6MZ1AoDoUMLbQx2SothEUYqmk49Nq2mpz3UsERKSsHmkVRasvubwYA9cSGiXmroHvc7f7sqqZXRzzkX5RL1Qiy6eLp4VT3wnm3XrhDDFgC1fGXbCY4jXKmKoytBzrT8wFMPVq36nT1CsHokH8n1sqxEzuA5Pj\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:38 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"cb-/UGfLXUVisbdS8d0WGPp6yRXdbY\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1774316798242\r\ncdn-proxyver: 1.49\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 03/24/2026 01:45:38\r\ncdn-edgestorageid: 883\r\ncdn-requestid: 102cb76fb69823f4421ef52e62da2fed\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DRjAuA8hGxJNOpVkAz%2Fb3ZLeMNPy5bw48GBxrRB4iOjfd%2Fz7VCYVSkxelVsvJYbr7g%2BnWYsYhZKJX0LO2I58NxZXCk68MhNp6Pjl1OnSgS6lwKaWfA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e11ff5cde0076ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":203,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3d258b57ce4560aaa083de8423afd918","sha1":"fd419f2d75158ac6dd4bc7745863e9eb245775b6","sha256":"ddc290053c896e2e56b0d4d3ab0d722cb12bce7901da0d82bd9fbeedc6fdd7b4","sha512":"b48cf6e67e5eb2e1eb8b6ceb12916b7a98d33943230f1de09412ef9c75e3c2a8da5669a4a1bd549f9002644f8c8fc781b24250be22c69e0453b9c2ef60819c66","ssdeep":"","tlshash":"ffd0228420a74db01afa412b44826c08143bb883edee879b0e74b8021021a1ead9e9c1","first_seen":"2026-03-24T01:46:04.931747Z","last_seen":"2026-03-24T01:46:04.931747Z","times_seen":1,"resource_available":false,"data":null}},"time_used":534,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xprmarket.com/","fqdn":"xprmarket.com","domain":"xprmarket.com","tld":"com"},"ip":{"addr":"104.21.18.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T01:45:35.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xprmarket.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 13 Mar 2026 20:37:25 GMT","end":"Thu, 11 Jun 2026 20:37:24 GMT"},"fingerprint":{"sha1":"C0:EC:16:8B:6F:05:B5:5D:DB:59:17:F9:66:C6:B6:02:E5:27:C9:85","sha256":"61:C2:76:3F:D5:01:B1:D4:65:69:6D:07:17:27:8F:2A:40:B0:FC:E3:5E:12:01:26:E6:E7:26:EB:C2:A8:C7:FF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xprmarket.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-length: 0\r\nlocation: https://treasury-buttcoin.com\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F38nv4QgtWqET9QhC4o%2FlP8arag5dWwywJ4N4O42JVIG9qIISlUWvjiZ3gCfpdFmtSHN%2F5Q209PKPfiyBOyKSnFCiLw9W0aF1CTEWWw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9e11ff4d0adc76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28029,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":18,"dns":8,"connect":1,"send":0,"wait":3,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"xprmarket.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"xprmarket.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"xprmarket.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/gsap.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/gsap/3.12.5/gsap.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 25515\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65a9b559-63ab\"\r\nlast-modified: Thu, 18 Jan 2024 23:33:45 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 653\r\nexpires: Sun, 14 Mar 2027 01:45:35 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zAP%2FlfWJ96bYEUw1J7eKULQErI5lfWAxVPGyuAAwe5zXtSf4pA6OlqxgPI6HntDHgT41wneFZKL%2FrAfAscsj7vQxfmvRIi5ycoV8%2FwTlH5IWk%2Bs%3D\"}]}\r\ncf-ray: 9e11ff4f8ecb783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":72214,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65255)","md5":"47da594cbece0e34a656e6bf2490b7c3","sha1":"2d26f4c060491ac980d09ca687388d3610256eb7","sha256":"28033e449a31ebcc396e5be8b13b63152bf03094288fb5867034321927bce087","sha512":"ede1d1c1c6d890ae1df60ffab43fe68647fef9ea131f0a4d33dc28071b4f5015a6ebbcde01f142f87adda04d866a729ea1c972fd5c5e2ef22ac2f09d93ba9272","ssdeep":"1536:auJ29KBROpgAEQ9a1tgwA6NSZW3ytdKTdIwEp28Ywz7CDE:f29CakgwdNSQ3yt8eNp28YqCA","tlshash":"d063e8d93292f423039a51a1447f094bf337a958640f0918f269e4ce7d3c9ad52bbe7a","first_seen":"2024-01-19T15:55:20Z","last_seen":"2026-06-08T13:55:17.989038Z","times_seen":7277,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":14,"dns":0,"connect":1,"send":0,"wait":5,"receive":3,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/mx.png","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/mx.png HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 23238\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-5ac6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fcf6%2B8JNg1YG2CY4JxggiYxqwyP7QKYrFo3rF4boZ0zv4yePunx1n%2Fq%2FZCpyv26EQ0dodLJ%2FVUMcbM%2FwuKzeSmd2NH17kG1EZcImpVEZsi7cjX5AFw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f7ce776ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23238,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1245 x 771, 8-bit/color RGBA, non-interlaced","md5":"724efd6d7fb8e53f35ebb35544c21005","sha1":"a79780a2c3ab600764374aefd72ebd909c0320ab","sha256":"756240f6eb46686fe34ad93c678d5f0f7453cd339262d07eb64a5deffe587e0b","sha512":"f8db6f7c610682c8e64de8bdb8c5bdca1c738964ce14b096f7f373bb75e4a0de5ee863acb9c6c924be6a969314e5373290304426641a08b1d37fb07174aab58a","ssdeep":"384:8nySWNmBkFDlKQkIxfVH0QPlB2FsAmU0dkchRQjATkQ9xnCUN3pRgl1yDluFnvri:tSWNqkFxK6vH08EFshNlJpu3yUnvUGw7","tlshash":"a5a2e1c01858bd73552d1e479e1e98027437d2551ebf908266b9d6e3d1cb4efcaac18c","first_seen":"2026-02-06T22:25:11.036218Z","last_seen":"2026-04-28T10:02:30.914001Z","times_seen":329,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptologos.cc/logos/bitcoin-btc-logo.png","fqdn":"cryptologos.cc","domain":"cryptologos.cc","tld":"cc"},"ip":{"addr":"172.67.188.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptologos.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 12 Feb 2026 11:19:19 GMT","end":"Wed, 13 May 2026 12:17:42 GMT"},"fingerprint":{"sha1":"0A:19:3B:1A:59:5D:70:32:FA:27:97:BE:96:A4:5C:10:C1:AA:2C:D3","sha256":"FC:29:2A:D7:F8:A5:2D:9B:E9:13:EF:94:FC:C0:93:D2:4D:36:C0:E6:B8:C2:01:12:0D:3E:9D:0C:81:4E:5E:35"}}},"request":{"raw":"GET /logos/bitcoin-btc-logo.png HTTP/1.1\r\nHost: cryptologos.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sjEnww7ExezfIKN0U4TtDh8%2B7OfiKAR%2FxBAtdaAkjprk2Jf%2F32whHtolxXLEYnQVzW4XZi3UFqJBLjwp%2FBB3WRkBKA5NLjs9XYLJ3cAh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9e11ff52fe53b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/coinbase.png","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/coinbase.png HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 3587\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-e03\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BiqW9wWHbrQCFl6%2BbspGkOwNGLGjI9ipV7eRr9bjUsS9wZl%2FDXwPXYwK3y4cu%2FvexY2zHbFK9Sk0glYVTa8wDzny4gqQfbHzhOmApAVdfM3ZpLuWkA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f7ce276ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3587,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 4-bit colormap, non-interlaced","md5":"f9a4dd82df4c369df7b20da3a8197aa7","sha1":"e7e754550b6c586a8beedd4c8869782a31e9471a","sha256":"2f80d81605c2b4c8c073a6b792378592a2e7ae75e4384ae4880a22a23ed23609","sha512":"195338d446a7d766ad0be7f2c6eff0abf9b2eb9c8926a2097934e657fa9d609e4e20dcce712b79117576fbb833af51945fa5ea11bb0bebb6cc6defe73914fa91","ssdeep":"","tlshash":"c7716c7141b12cafdeae4690c90f560619d316543e4fc116b06f13fc3cbae8a187629b","first_seen":"2026-02-06T22:25:11.043585Z","last_seen":"2026-03-24T01:46:04.936468Z","times_seen":328,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":184,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/script.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=067G2WFA6k1elCy7R7GC0Q0LVmzzPUhNaR%2Bvv01WK6RD5xnV8E5OlYPMhwgtuqkByeiqu4jILdctFChhl%2BgtjHVxUz%2BKS12ChKlr3dSuoY3uLjvmqw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: 9e11ff4f7ce876ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T01:45:35.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W8yPmPnD6eN7Jx80GZU575jHjosyUdtgiy7c1RncQg7KQmuU%2FLX%2FHowUlbIMxWVcRGL%2FFvOPAzKlzh1s6KWLjCu0s0jFkSQkgpWCms%2BdqD0yeUwE2A%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9e11ff4d49a1a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28029,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (535), with CRLF line terminators","md5":"54382fb6a21ce26324069b78937b0bbf","sha1":"8d538b9186d02f79ca6ef6d1b742bd9e4bba0c7a","sha256":"2a43200d2abda4e5271cbe08fb165c5b0e59397f63c2ff3c84183a45fd09a832","sha512":"5cd186ce3e736375922644976b7faaaf5e8c1767c661c51624ea666e0524c6486eafa4735ed0b3dc128a52dc7d613b9ef98b9ce5c3b820d5bdafe5664422dac3","ssdeep":"384:Je+i1BBdoePuOjV8Zsjz4AbA2G28BRScYzyP8kugUHKL4nGgmaY:c+i1BBdLPuOV8Zsjz4t2D8d8Ewe","tlshash":"9ac2516095c0a227027381809ab26b9efe668297df0b45b633ed07d76fb7f08dd67144","first_seen":"2026-03-24T01:46:04.937392Z","last_seen":"2026-03-24T01:46:04.937392Z","times_seen":1,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":26,"dns":8,"connect":1,"send":0,"wait":168,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/style.css","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: W/\"69b52c17-1a5bb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FeL4w3%2ByPHgID1I1a03YsWYmJIMDLT4hl%2FgUZn%2FDd038VL5n3GYQSkJOetZ3YThDcCyuAbpl8BTUe2%2BWSB5XU5Tz%2BbARpwZFCm7DMiUM%2BmCx4fg34A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e11ff4f5cdc76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107963,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"4b426b6d827049ed83eab9a57629c8f2","sha1":"bcf863c5819b560a27f8c784d715116e62c354ec","sha256":"08ebbbdfd477aed5a888f91890854b0b0a2db5131bee9c95de86b91f4e174826","sha512":"389fe7b9f9580605d865859629539aac37c296968145ea552d89d5f39e1866c8327abc80a79337f6ad484889b101124ac8c8000a35a58dc3c13324c8ab16950e","ssdeep":"1536:k0T2a/0Hw+IpljK8+XQG9aLqav3q0PKZBb7dCryUu31us1KQ:b9mRKCbH","tlshash":"86b3655b8ba31159742bd16c5feb470523a89023850ed85e3bdc639cef4d3e8a2a1b4d","first_seen":"2026-02-06T22:25:11.021186Z","last_seen":"2026-03-24T01:46:04.939356Z","times_seen":7,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptologos.cc/logos/dogecoin-doge-logo.png","fqdn":"cryptologos.cc","domain":"cryptologos.cc","tld":"cc"},"ip":{"addr":"172.67.188.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptologos.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 12 Feb 2026 11:19:19 GMT","end":"Wed, 13 May 2026 12:17:42 GMT"},"fingerprint":{"sha1":"0A:19:3B:1A:59:5D:70:32:FA:27:97:BE:96:A4:5C:10:C1:AA:2C:D3","sha256":"FC:29:2A:D7:F8:A5:2D:9B:E9:13:EF:94:FC:C0:93:D2:4D:36:C0:E6:B8:C2:01:12:0D:3E:9D:0C:81:4E:5E:35"}}},"request":{"raw":"GET /logos/dogecoin-doge-logo.png HTTP/1.1\r\nHost: cryptologos.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vXNm2oIM9CO4SC2fkcSTYx5yiXdJN%2FcQKut85yFnOmyx7PsCkWQPvWN3AQt2IYmkLIz8Aa3bZrAJjsPvT9LzqSiichX%2B8Qdz9VueIkzp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9e11ff52fe54b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fconvnetjs.cjs.js%3Ft%3D29571945%26u%3DIv3vtYOUoptGAkSpGDY5MjU2NDQ2MjhjZmYzYzM0MDI3YzFlNcoLfPsM8k--lInn-g","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:36.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fconvnetjs.cjs.js%3Ft%3D29571945%26u%3DIv3vtYOUoptGAkSpGDY5MjU2NDQ2MjhjZmYzYzM0MDI3YzFlNcoLfPsM8k--lInn-g HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:37 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\nvary: Accept-Encoding\r\ncache-control: max-age=2592000, must-revalidate\r\netag: W/\"a0502-14+i6Bt7XM8ofHk8WpmFyqoPYWI\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=convnetjs.cjs.js\r\ncdn-proxyver: 1.49\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 03/24/2026 01:45:37\r\ncdn-edgestorageid: 879\r\ncdn-requestid: cfc314459d63b964837447b52f41608e\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0q%2B4ZZLr%2BeTDThjCfbpZFgb03vseqKVVo%2F5i%2BY7ytb5pZJJgI9nFiP0ru4fbuq9BX6vP0HLgWo7luYtF%2BGzCkkyHhysTekpHeGPAriuCp%2BoQKSZjmg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e11ff549d3a76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":656642,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-06-08T13:18:27.600009Z","times_seen":2556,"resource_available":true,"data":null}},"time_used":958,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":833,"receive":125,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/isomorphic-fetch.dark.min.js","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /isomorphic-fetch.dark.min.js HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: W/\"69b52c17-788b3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0dShLG%2Blga5XMHQ%2Fw9KlBtgKaZ06gX7bT2XGgdejazhMD%2FqwCP%2Fm6tVDHMYGCu3r7ICacqc2b2VDy97pNjZ05eE9K%2F01IHdqDODT%2Fa70lP9vf05ONw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e11ff4f5cdb76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":493747,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65136)","md5":"e8c474ecb85bba2a2d2585b0f62e9c62","sha1":"9d21cee8f25300fa20e648995b4a3af55b5206c0","sha256":"e6cb2680ffbef771df7d52fe0460c974442b72696a101b3e7ae79b5d965850fe","sha512":"10e906f0e89a7c855fd5357eafd50516cf60af5c7692785e21ebdddf5a89a37d4ea86bba0172789fb85b055e7449e1af59bfe547ac86204afc8a802468ac135c","ssdeep":"6144:YTJTNK83usKoY04YAtHLXDB3JGT8udonKByxXmS6HSSt/NnIOxcI7YM1SfRGtLe7:ya0avlKBW6Hi4gMG","tlshash":"86b430466db3847d9ff0a13586b121989bd3f4cacbd7a916b5d2af4bd012800fcd6362","first_seen":"2026-03-13T16:27:24.111989Z","last_seen":"2026-03-24T01:46:04.941299Z","times_seen":5,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/buttcoin.jpg","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.911Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/buttcoin.jpg HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 29752\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-7438\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GCA4uvF5cEdKqulNJ%2Bq1Q%2F2Mf0T09oXbuMneC1QXC1QtwL7gK3x67A6A5yaDosgczxMEKh9eeHWBj21qfLgPN2850saHWgLuzkOn4N1KlGBjQ%2BlNgg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f6cdd76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29752,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, baseline, precision 8, 500x500, components 3","md5":"c64251749eb46096256b6f81603cd776","sha1":"c72bee02afe40b20ad86a6d3eba69088284b6698","sha256":"963a4ed00b72f5e8244f1f871f72217576b72e3ab11ed5a7e8ba923af9d4c9af","sha512":"16e795979efa218b7f0124e94116ba6794a5147697ef8c8076a560ad0b72e2dfbe98b5e41bc23bc185db01661f23c28d878ad35e513aa886803213a9834d79cb","ssdeep":"768:EQ9wPEi7kx3x77kZwSh32Yjmn1Soi0vgfnAH5A4Xz:59Qkxx7U/9bm1Zi0iAH5bj","tlshash":"7cd2f2c74b19a263efc58637602f8b5a6e374f42d91e153bdd3581f204b2622b9942b0","first_seen":"2026-02-06T22:25:11.030331Z","last_seen":"2026-04-28T10:02:30.874807Z","times_seen":329,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptologos.cc/logos/dogecoin-doge-logo.png","fqdn":"cryptologos.cc","domain":"cryptologos.cc","tld":"cc"},"ip":{"addr":"172.67.188.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptologos.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 12 Feb 2026 11:19:19 GMT","end":"Wed, 13 May 2026 12:17:42 GMT"},"fingerprint":{"sha1":"0A:19:3B:1A:59:5D:70:32:FA:27:97:BE:96:A4:5C:10:C1:AA:2C:D3","sha256":"FC:29:2A:D7:F8:A5:2D:9B:E9:13:EF:94:FC:C0:93:D2:4D:36:C0:E6:B8:C2:01:12:0D:3E:9D:0C:81:4E:5E:35"}}},"request":{"raw":"GET /logos/dogecoin-doge-logo.png HTTP/1.1\r\nHost: cryptologos.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Tue, 24 Mar 2026 01:45:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dNe435A73iMZDZRlKk25KKe23YgHxUdBmFLgNuaioPL2dxBQrvu5N%2Fjkcmo%2F44pzvFacXDBRZXipa8RmSfrOnS%2BrIe%2F%2BimaOI7jrKnrL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e11ff4fca9d1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T15:34:22.145557Z","times_seen":16243359,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":47,"dns":39,"connect":1,"send":0,"wait":16,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treasury-buttcoin.com/img/original.jpeg","fqdn":"treasury-buttcoin.com","domain":"treasury-buttcoin.com","tld":"com"},"ip":{"addr":"172.67.194.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treasury-buttcoin.com/","date":"2026-03-24T01:45:35.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treasury-buttcoin.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 14 Mar 2026 08:40:09 GMT","end":"Fri, 12 Jun 2026 08:40:08 GMT"},"fingerprint":{"sha1":"5D:B2:07:63:AD:24:A7:AD:CA:1A:E4:FF:7F:25:0D:8C:BE:6C:5F:10","sha256":"1B:C3:A6:2C:59:0F:E2:D7:47:B2:E8:E8:DE:F1:E0:CA:89:A7:99:D7:96:0F:63:19:66:89:B4:5E:3B:20:D7:7F"}}},"request":{"raw":"GET /img/original.jpeg HTTP/1.1\r\nHost: treasury-buttcoin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://treasury-buttcoin.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 24 Mar 2026 01:45:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 28436\r\ncast-mode: default\r\nlast-modified: Sat, 14 Mar 2026 09:36:23 GMT\r\netag: \"69b52c17-6f14\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XMAPL5rDByjx0%2FlWeFS4sc%2FRV7lRXnxBXi8s51wAUQ%2BfFX0WwaerQ%2F7i0rzddiPh81o4TWKlkpOxUQwo%2BxiSF1%2BdXe%2B%2BseJco2%2F4tlB4RkEFA%2BvM4Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e11ff4f6ce076ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28436,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1086x280, components 3","md5":"a9077b87a9f57842ff352032226fb840","sha1":"bfdf0ff4970384bef17b102c974fc735cb4505fa","sha256":"2454a580517e4a76f2232a510af27b05040986d4dd572b95ad3affe686eea877","sha512":"781ca67bebd40498185433a4244772fbbbd5d06dc015a0323013bd82fbfaf35dd0c7a352f8559a22979466ec9ecf9b80ea91d6cd354ab8a0b83c5e24776cc9f5","ssdeep":"768:c397s+3M9wqiWjrb0YxVNAl+w5EiCBNtnz23:cNw+QwqNb3+paPny","tlshash":"bcd2d0acda956073d9480eb240db1e7766b33d061f1e550a39ac27b29711448a9d13f3","first_seen":"2026-02-06T22:25:11.041237Z","last_seen":"2026-04-28T10:02:30.884804Z","times_seen":329,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"treasury-buttcoin.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}