{"report_id":"1d03057b-1cac-4928-b473-c62d4b0ddfc4","version":6,"status":"done","tags":[],"date":"2026-02-03T21:40:10Z","url":{"schema":"http","addr":"finance-curve.com","fqdn":"finance-curve.com","domain":"finance-curve.com","tld":"com"},"ip":{"addr":"104.21.61.5","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"title":"Swap - Curve","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T14:43:02.497544Z","times_seen":17780803,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"finance-curve.com","fqdn":"finance-curve.com","domain":"finance-curve.com","tld":"com"},"ip":{"addr":"104.21.61.5","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-10T21:40:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"finance-curve.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"curvefi.finance","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-03T21:40:11.167256Z","last_seen":"2026-02-03T21:40:11.167256Z","alert_count":13,"request_count":13,"received_data":4261888,"sent_data":6035,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"finance-curve.com","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":226011,"sent_data":486,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.curvefi.finance","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-03T21:40:11.170467Z","last_seen":"2026-02-03T21:40:11.170467Z","alert_count":1,"request_count":1,"received_data":226314,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.curve.finance","ip":{"addr":"172.66.40.133","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-01-05","domain_rank":2623494,"first_seen":"2025-05-18T14:55:10.131277Z","last_seen":"2026-01-19T23:55:32.409548Z","alert_count":0,"request_count":1,"received_data":17653,"sent_data":447,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"curvefi.finance/bundle-fd0490395620246e.min.js","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"05a5208c049b2597d5096f8e8cb796c5","sha1":"d4da915e891929088a973e4fb53d17c1e31b9f29","sha256":"f82d862bb85bde2d47b165a80065c0375d255d58a868e4b5de1e07af52737fb1","sha512":"005978eaee37f2ef5956c67fef17adc71b0fe8923e287a4e383ef32ebe6c34c801be8c87f9bd02e355fffe157494b332b03740a55bbf610c1c8275db3bc0fe95","ssdeep":"768:zil8sc6N/prKCpAE1E/68MyJEJtfc7Us0Xqrrco/TiL73Kcz9qz/cOT1cQciraQZ:gp+Cg/ttJEDKUsaShX","tlshash":"3e7394da590ad0d69e1210ddd873f80af4680967cdacf053a62cdec6b42ef66c45723b","size":74383,"data":"","first_seen":"2026-02-03T21:40:16.467073Z","last_seen":"2026-02-05T20:53:49.753677Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f7ff7c357900e89f3996440f6d993141","sha1":"009487d13786f6ccac192422512a76a136756038","sha256":"a6359fa762114ac2a13c85832e5e47eab47a85896d116d4e8976c5e9d22c4bed","sha512":"954367cce1dbc5ebfc39ad424582a456f7521d76c6959e4a293aa07f61fcbff0c443222bbb599c323d20770ed732563fafb2883f630901c5d318d81faf0b68dc","ssdeep":"","tlshash":"72e02b286aa755fd36b73591c71fb240e86500735085d801fd1cf58a0fc0e1434b9fc9","size":319,"data":"","first_seen":"2025-03-07T16:16:50.313512Z","last_seen":"2026-06-02T08:58:23.961977Z","times_seen":108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e211f2be37ac3878b407bb936975a12","sha1":"cd008371661172460f658fa981d8d28b4a893027","sha256":"9fb99a05b91ec7de82af37bd0f38be11d26380fee6b782f07f1184d2bbaf6e90","sha512":"6ed6524b2dcbd21828a425a29a94d385e92d57fa140e47dce3fa435d465a14f357da642a3025ca498d3097af7e449bad7ba171bc13f10715b9421d822b4619fc","ssdeep":"768:mW58AcMNbtXBB6/50UkuMnd9VCyyUw3cWnliL7vKcTRYtcOT1cScMraQVIc128cY:RtofWB4lb","tlshash":"ba6382d6591bd4d18e5210ddd833e80af4680a27cdadf163a62cdec1b82df26c46727b","size":71389,"data":"","first_seen":"2026-02-03T21:40:16.474991Z","last_seen":"2026-02-05T20:53:49.777893Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"63afcb80a028dedea1f9b5a70c4f0391","sha1":"1425284a0a9f74b1faa85f1d3524151015c4bb59","sha256":"25bc91c3c40ea75713f438f6780c69e28a8afe1e05edb716f1f6205f627cefaf","sha512":"5ac25311757f73e66a340aa38e6c5f1532122c3c8ddd0d6afafc139a09f276720bc457b83ce4c9069fa80248f69c3d723a4c185259dadb6c1083acb4b12f36f1","ssdeep":"","tlshash":"06e02ea82ee61338237b2120831fd28037e48043a0e4f8023a1ce1cb0fd2e1000bf5db","size":292,"data":"","first_seen":"2025-03-07T16:16:50.323665Z","last_seen":"2026-06-02T08:58:23.963206Z","times_seen":107,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"290f2693531b75e4376c03efb2e445ba","sha1":"b7d99187eb7703bdc3e0d91432b1e6108b57bca5","sha256":"b2464a6e184f8e48f9dd9b02483cf8f9a049eb5ddf47bc900d570fe387613ae6","sha512":"13b68e7b1f8f4e9278ab87f46f2f9d12a9c7a48351d18265afce4d59c501c11bc510195ba10aeaf6c5c17cfd996a9ce4c639c162752cf6ea4b026e5fd6875e4d","ssdeep":"","tlshash":"5fe0863935761574097b986fc74b934b7da2141b5001e8167d4c914b0fa4f1034e6599","size":350,"data":"","first_seen":"2025-03-07T16:16:50.325983Z","last_seen":"2026-06-02T08:58:23.969339Z","times_seen":218,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"curvefi.finance/Mona-Sans-BuEDUD0r.woff2","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:47.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /Mona-Sans-BuEDUD0r.woff2 HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/index-BW62V0Rd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 137140\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"217b4-19c1975c938\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6hlZROuaCzN%2BxnCiXNHSefyAA5Km6sXN3cISlWgcviuLgNaCpjXtAvCpbOgPljB29%2BWv6hBdQICOpPIDn0t%2FyxO9ub3vVmeFq69hQ7M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153f394756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":137140,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 137140, version 1.66","md5":"b96cc834af467cf02885a067356abae7","sha1":"f67ab96fff4863c69507a47f734c970ebf340e2e","sha256":"c8847174a74b389b8484715048111f028ae383e0bc702d0bcf6fbfffa23b742c","sha512":"b0c6f20b0fb05cc9cf0e52f60620253e928bb9dbbe24814678273cbcbaba7043a0256f557be401aefed60a43da4a1bbe1f18456d7f4a0221076791b698e113a0","ssdeep":"3072:gTwZ0QVFS6U31myVGKAEadPxvtjmq+I++9XaOavnLRc:L02cLKFRmvnLy","tlshash":"19d312aa44a68540e931d3c6fb78058563d2e456ce38f3eff1df68738354a269ca3216","first_seen":"2023-09-19T17:39:23Z","last_seen":"2026-08-08T06:12:47.992972Z","times_seen":237,"resource_available":false,"data":null}},"time_used":591,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":440,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"finance-curve.com/","fqdn":"finance-curve.com","domain":"finance-curve.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T21:39:45.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"finance-curve.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 13:22:44 GMT","end":"Sat, 02 May 2026 14:16:25 GMT"},"fingerprint":{"sha1":"A3:4A:BE:F2:0A:FA:76:BC:29:C6:E9:44:24:F8:C3:12:C0:11:53:A7","sha256":"FD:CB:05:25:B6:E6:33:81:D8:84:3C:00:E8:EA:D5:59:3D:F1:AE:BA:5E:92:93:A9:7C:20:83:62:1B:3A:4E:34"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: finance-curve.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Tue, 03 Feb 2026 21:39:45 GMT\r\ncontent-length: 0\r\nlocation: https://www.curvefi.finance\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C62Jo5F7GMXv4CYFM%2BfT7Rd6HdC1kTPCEWRPg%2FewVPifBG8vytOdomlFGcSb4BuMImamZkV1QBu8AO9zqOhDiidY3sMQZMM772X9R0Dv2w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9c851533ea115690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":225485,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T14:43:02.497544Z","times_seen":17780803,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":35,"dns":15,"connect":1,"send":0,"wait":6,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"finance-curve.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/index-BW62V0Rd.css","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /index-BW62V0Rd.css HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"67d1-19c1975c928\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i1zOx3C1YlAMFAmhTFCd3bCYw2TgB7rrTANcGgOaQtyPtOz4MHjx5mY7GZOFdPHR%2BhicpCYnQlalnd6nFz4jrEXFXeNG0evJ0u4L0ko%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c3a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":26577,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (26576)","md5":"b5297ca0b76b7610bf21633d9b100dda","sha1":"f43cbf1461e7e2f97f92a46b42853ea421381802","sha256":"0fbe975c06525d4fb0522dc7b9d2b1c7ca13abfd387c5f5b06f6fb2cc0d84a8f","sha512":"69135cd6e6d83e2fd00d66458fcacc3f4d852beab80b92233496280ea762226e7071732ad014c71a109c0b74c144b0da4075849e6c3d658e4a183957abdaa636","ssdeep":"384:is4ceD95jtv8lZdB63wZpSXbaFp9hkae05HWLkAcxDyqxyVzwR:Z4czB76W5HWLkaVu","tlshash":"afc2bf18dca2f3ba391f6b3d52fc9e3c73a96497ac0d0b26b75e905035c12fc112259a","first_seen":"2026-02-03T21:40:16.45292Z","last_seen":"2026-02-05T20:53:49.763397Z","times_seen":2,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/logo.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 333533\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"516dd-19c1975c92f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HvQ8EgM1LMozaypeqI%2FJX3NFCfdzk3OtiFMwcK9mky2kY7daoYqtazDfKH7wBlUCTpB1xzZyaYCAj3rpdyqLBC9lFcgYv%2F4CqJ7afXM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c3f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":333533,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1160 x 1160, 8-bit/color RGBA, non-interlaced","md5":"8d7c8e36eb88de919bc0d1b104738de5","sha1":"d3c8d8ffb6caf6d4e9e3775e192fb048ed6f654d","sha256":"b4d5d71c8b43336e149bbaf116ec165769a9896a0333563b0c71dca748ef59a2","sha512":"7440edb8a92098ff96a32fffcea4ccbbb66cf88a4d6820e56ddc6a78b1ce64628bdf68a3d681d75e35e917855f04d04ace33a3a80576520136c64df9e947f523","ssdeep":"6144:MnSKcPSbZpbOUFxCjyjaiioKvo7XbeOsqK7DsJTOI7pfXnz:lKtZJxCjMSOiX7IJTPpfXz","tlshash":"b3642345cdc3e9d52e0ce6f314328e23da6a5e0d26db29fe517389cf8852c1a1e1db94","first_seen":"2023-08-14T00:12:40Z","last_seen":"2026-08-04T03:30:22.349978Z","times_seen":89,"resource_available":false,"data":null}},"time_used":675,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":434,"receive":241,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/51043e5ac146f93860bb64076c2abfa975c2bab2.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /51043e5ac146f93860bb64076c2abfa975c2bab2.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 3574\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"df6-19c1975c91b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jvAqSTDix1tztNw1mCcZrmJnsMU5nOFsGo1UwGcx2mAMXvlb7XalfwpUtvKs3huoZsxGBt9SBxZhDkVVMPoVuNN9cpWvsnmuQCqb8CM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c4256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":3574,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 255 x 160, 8-bit/color RGB, non-interlaced","md5":"9e622087ac42911a31b5932035962d46","sha1":"51043e5ac146f93860bb64076c2abfa975c2bab2","sha256":"71ff27b08b39e1d56ac300a392d51c2e5d70a8fa4a2b294c42e7df479b093c30","sha512":"9a241a64704710109d9c11e3cb452f614f65f0d5c8de2903d78ae8977801d9510176d4b230c6b691db544b847e430ee7ac42a79e2676357ba9d0c20b2d9968b5","ssdeep":"","tlshash":"3c712b9386e8ef119d81d53f6ab11216e40c268dfe204bc58de85fd27430e01adf5102","first_seen":"2025-07-20T10:24:55.858243Z","last_seen":"2026-08-04T03:30:22.351314Z","times_seen":17,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/ethereum.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:47.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /ethereum.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 5395\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"1513-19c1975c920\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zp2SufdFik63FBwfiRCSO%2FO%2BAok9Re4NwOce47UP80SNacAtx56FHRlIIWaE2enwSqIMnrBjDs0%2F3onDkD4%2FlNqyJ7aD9f3atoKDghU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153f697a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5395,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"4ffd241bb29a27e8b413a8178d5fa2fb","sha1":"3370a51d7c07a9cc8d518c4a014b613d9ac7440e","sha256":"559972a5a77fb1791b7f9185c030f1240536b7784e5d46fd5d5bac4547eaccc5","sha512":"dcbef517ded6443882848e2a76e9beac8839d34b47ed43cd7475bc81cf4c8b7b8f0c1545c762e7fdc9eb9847f172e06b3c7e81d8b1d43679dd62cf03f3b113c5","ssdeep":"96:HM+pjRIDk9BIEg0nhinZfyENuJmfbp4Nmuy5efXmbi4EiSdQN9X/4/n4BGx:xpjmEgIc7uJmfSNTy5eubEYT+nx","tlshash":"f1b1af250e722224776727a86a3d2046e085d33c4f65673ce624111a7f834fe5bc6d0c","first_seen":"2025-06-18T00:48:43.823374Z","last_seen":"2026-07-13T04:59:52.937821Z","times_seen":22,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.curvefi.finance/","fqdn":"www.curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T21:39:45.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Tue, 03 Feb 2026 21:39:46 GMT\r\ncontent-type: text/html; charset=utf-8\r\nlocation: https://curvefi.finance/\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\nvary: Accept\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zrBxooM29qL6bCTLhHVILxKwFu8xJY0IpieADA12FFygYb4ZCTD0U8gN%2FKIec4qVqV9ORQti52ozbgfcDiidysTeTDIRCkmvEcB%2F6rkOQe18LmM%3D\"}]}\r\ncf-ray: 9c8515345c145a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":225485,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T14:43:02.497544Z","times_seen":17780803,"resource_available":true,"data":null}},"time_used":317,"timings":{"blocked":56,"dns":40,"connect":1,"send":0,"wait":204,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T21:39:46.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=1,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wF1BkzzT97Y2f1J8kyHlx1ahsnKANQPKoGoPldJ1QATKuBPFdWCGXcNZ9ClK7jejUmeqBQu0aGHtwdVcmG06pTmYDUaCv5R4JbOyLZw%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9c851535df1e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":225485,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (1073)","md5":"130437c1113f882c60f13ca1a1292391","sha1":"42a26f5872a2b2dc76e533ea7faba934a5d3a108","sha256":"f32341345db4b668fda5f244a05ab50c38c24dc6194fb361dcd9f44196d5564c","sha512":"f4def3caf02220c8d9c493914c6f68fb11ed8c24510b876386cf052536ed27d3c50ed7e6e33075820e66b7da5ee68a3dd8b569f66c15c163c3a0c5a9acbd8f02","ssdeep":"3072:Fv2/DGKB3YUPzgp++unGQea4bNwNqAsRzFcIk:Fv2/DGKB3YUPzgp++unGQelask","tlshash":"cd240b5b0290213518035ea5b1b7564ab33ab933e205defc79de8586cf8e2e409d37b7","first_seen":"2026-02-03T21:40:16.466164Z","last_seen":"2026-02-05T20:53:49.760955Z","times_seen":2,"resource_available":false,"data":null}},"time_used":667,"timings":{"blocked":29,"dns":0,"connect":0,"send":0,"wait":554,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/bundle-fd0490395620246e.min.js","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /bundle-fd0490395620246e.min.js HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"1228f-19c1975c935\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uL3VtcjXnzmvkmAM%2Fl8%2F2xlv5wi3hfT5Vu%2F1cEmfzAI6kogCxup%2FH4kpCXl8%2FqmdDnCLQzpc%2FcrWoZHaIM%2Fw5t69D82ezK2VckKKDQ0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c3656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":74383,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"05a5208c049b2597d5096f8e8cb796c5","sha1":"d4da915e891929088a973e4fb53d17c1e31b9f29","sha256":"f82d862bb85bde2d47b165a80065c0375d255d58a868e4b5de1e07af52737fb1","sha512":"005978eaee37f2ef5956c67fef17adc71b0fe8923e287a4e383ef32ebe6c34c801be8c87f9bd02e355fffe157494b332b03740a55bbf610c1c8275db3bc0fe95","ssdeep":"768:zil8sc6N/prKCpAE1E/68MyJEJtfc7Us0Xqrrco/TiL73Kcz9qz/cOT1cQciraQZ:gp+Cg/ttJEDKUsaShX","tlshash":"3e7394da590ad0d69e1210ddd873f80af4680967cdacf053a62cdec6b42ef66c45723b","first_seen":"2026-02-03T21:40:16.467073Z","last_seen":"2026-02-05T20:53:49.753677Z","times_seen":2,"resource_available":true,"data":null}},"time_used":576,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/8837006a0f822559427e16f048e134c116dfb108.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /8837006a0f822559427e16f048e134c116dfb108.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 1527\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"5f7-19c1975c91c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7Vw3%2BS%2FVPflUpyUtLCBXeInc26P23rxZSsWBHPiqqJ%2BW0v0Km65vrhg58eyBs%2F1%2FR%2B9uxjB5Z1I9WzdXRAPiLFL0VzmbahbrcXOBxuI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c4956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1527,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 50, 8-bit/color RGBA, non-interlaced","md5":"ce834fe0646d011e866f5be395c1e745","sha1":"8837006a0f822559427e16f048e134c116dfb108","sha256":"f0268446d44cb7fb9ca3e46e11a58be0a2c88a5c43c6608d80987a880cc1c799","sha512":"ab5e7fa668ad61c6d8faa5432ff33f5836d18c5a370b07862863d64a789e2f3a991b4991b9a181289722bf1703eeb9aff8094dfc8f4987cc3068630d6d6d3460","ssdeep":"","tlshash":"7331d7991ebd48fe6a51577c113ce06bfcae76f69c4210909893586351e2a806e8c6b8","first_seen":"2024-08-19T21:42:29.11378Z","last_seen":"2026-08-04T03:30:22.346493Z","times_seen":24,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/secureproxy?e=jscdn/getFile","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:47.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefi.finance/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://curvefi.finance\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"ut5kd4to8haskdpyl5jg\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XOK0dg%2BjWfPoCgLcgqRZsyk2x7t%2FVaNTk1G24mKdWdI%2FcW8LgcBSNNZFQdv%2BAUTRVD2G41Bhe3iKxSXjUw9XvMxuUPDZvBTFX00fAvpvF6oLVA%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\npriority: u=4,i=?0\r\ncf-ray: 9c85153fb9f356bb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3422869,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e26b645d02c45a7a43a8b0b8830d7f86","sha1":"aeb54ed32386ab1fe9e5fb0e989e87fc46c2330f","sha256":"728ad1f8720580670edc406b6c8542c548082b4ad50b4df04faabd15b86eec4a","sha512":"b406ab572acbbed814bd3457fce9b2796e1b52c7a6825fcb7a13b18e9e0e44e57f2df7c7e434db9a932207e888558569f078860b3a5572d20185af2b19186dd1","ssdeep":"24576:JV8/8Yae0PgGswPpBroS7InwbjtsJshJuEbdvxcTonBo:J7OwPEZJs2yo","tlshash":"402533512da7fe568f4caa7674b7ad0369510b43888ca4c7e92addc0106c3b542def1f","first_seen":"2026-02-03T21:40:16.46837Z","last_seen":"2026-02-03T21:40:16.46837Z","times_seen":1,"resource_available":false,"data":null}},"time_used":829,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":505,"receive":324,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.curve.finance/apple-touch-icon.png","fqdn":"www.curve.finance","domain":"curve.finance","tld":"finance"},"ip":{"addr":"172.66.40.133","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:48.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curve.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 08 Dec 2025 17:44:26 GMT","end":"Sun, 08 Mar 2026 17:44:25 GMT"},"fingerprint":{"sha1":"33:72:9D:86:4A:F0:48:69:C9:1F:CA:7B:B7:3D:20:80:E9:75:7E:96","sha256":"9F:40:D4:CF:E6:9D:A9:7D:40:23:FD:88:6F:EB:DB:55:A0:06:7A:E7:40:45:32:E7:F6:7B:C3:C7:4C:80:E2:9C"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: www.curve.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 16657\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 2091\r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-disposition: inline; filename=\"apple-touch-icon.png\"\r\netag: \"b9e289585545a114325910f23d08276e\"\r\nlast-modified: Wed, 14 Jan 2026 09:08:34 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::g782s-1768383806078-3f35de84b527\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=krJ%2Bhx7fT1UqmLdHbro4Di2xBZO9QXwzlq70TrR1gRMUZZf4zA8%2FCuSodjvM7E6rs5Fxb08j6ejVNeSQekua0N432naSNMxJLLXTywNd\"}]}\r\ncf-ray: 9c851543da57b503-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16657,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"b9e289585545a114325910f23d08276e","sha1":"06f2dad43c9da53e7898fba6bd61a360ba6e551f","sha256":"5581f92f23b25393a433783a995aff7d60dbdfcc9645d3942dce6a7fef61c07b","sha512":"210142992953966a7bd200a7835bfbd3a734017f5ff791ad0ad982d1a70c277e1c7266f2b3e02314d1ad6d869baa17ed19989095615dc37d5cff1d90ae8b4ea1","ssdeep":"384:Y5V8orDdE/qRxAYcKlSKXme8KRzoL002wEBooH:o7XdxnVvq32wEBooH","tlshash":"a272cfd1f455ec30853c15bb9943cf6bb2b48ee8bc87ccba26e7c04096cc12e695311a","first_seen":"2025-04-17T13:29:06.540937Z","last_seen":"2026-08-04T03:30:22.348806Z","times_seen":35,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":29,"connect":1,"send":0,"wait":143,"receive":2,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/favicon-16x16.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:48.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 1438\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"59e-19c1975c923\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WAzGCKKdiOHCf78yYSTrU7D5hl0LaL%2Bu%2Fc3%2BUzYQtq%2F%2BirWXHCscjnPq2lUoxljba35s7yfGAButlP6XILpC3H%2FPiPDPVLNUf8lYKo4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c8515438d6e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1438,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"88f72945db4876404e25713b11e256a6","sha1":"c0ee8047a94a072c3bd803982546d7f5a003e9d9","sha256":"45f11427c68c09536da4733c1873a83d29e3558a5f5424d1c601c73effa072c7","sha512":"a48676e048916c70a55431958c4d4802e7baf735b6ec26eefb46a5e95265f6937fbed42b5a18827ad24949b4d3bd8376f14e9e8e1b499af59b5f290b7977f894","ssdeep":"","tlshash":"6f21d8c4adbceb29d4059b72d500048ca63589bb19f049ff7256d0162ebfe1590f5a03","first_seen":"2025-04-17T13:29:06.546942Z","last_seen":"2026-08-04T03:30:22.348287Z","times_seen":29,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":340,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/e8401a78ba3b7fd40b62ff0bac32bbd6be56ab84.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:46.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /e8401a78ba3b7fd40b62ff0bac32bbd6be56ab84.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 1046\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"416-19c1975c91e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nBliyDdAuOLbR99oa4z%2Blug%2FOPcsUvSCmMMTS%2FQnnOfmKGDRyfgI27fvUpjWLejS2ZkP8s5Jl1eAwzCJTQkDBXNo8rcIehabWexVTAo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153a7c4756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1046,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 240 x 160, 8-bit/color RGB, non-interlaced","md5":"0b23b0bfaf304e900a684c1c66d45a62","sha1":"e8401a78ba3b7fd40b62ff0bac32bbd6be56ab84","sha256":"3f1f3114698752d342c7d1f6a51254e3e9cd66e5a578418ef18721e4e1f1bd29","sha512":"33f3824391856ddc76e92b8f9f15776453b81955416edadbbfc07b7982d7058ba9a3d38063c79928339fd8a186b4200511bd1d067d99612d8e32d5553ca0189e","ssdeep":"","tlshash":"dc1180f3e913e8e5c78fde30c147102249589906ca45437c7b97360748ae74a2777e0a","first_seen":"2025-07-20T10:24:55.875332Z","last_seen":"2026-08-04T03:30:22.352412Z","times_seen":17,"resource_available":false,"data":null}},"time_used":405,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":405,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:47.752Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 3868\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"f1c-19c1975c91a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oIDdbEraKntCrek4nXIYkghxIqFuIP7%2BXU3BUH%2B6pIRidSun1PQPjePYeq1ToSCR3TiGrAzN%2BsLHkcK4hlLJSpoSbCQZJAKEiFDhvwk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153f697d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit colormap, non-interlaced","md5":"3e4da4e69d768ea1f3a616c365cde222","sha1":"c09ded1da7bc8ee7669707364ca8aa5a0fff5108","sha256":"253e24a89c00199ded934161a9ee5808745346c6ca173441da30da6b4d60fcd4","sha512":"dc375412e0ab0354133081f21e2f1a57f0e5f18272189bc711096ab1bae860e5eeb1704618c45a27c052258a738e76fad1511c9cc384a2188895bafafee1f7df","ssdeep":"","tlshash":"9b814c174f293ff52dd6527aaf070348f57384f7d0a681aa9eee11c9010d6a1b56bb02","first_seen":"2024-12-22T19:24:23.009993Z","last_seen":"2026-07-13T04:59:52.956768Z","times_seen":29,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefi.finance/0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2.png","fqdn":"curvefi.finance","domain":"curvefi.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://curvefi.finance/","date":"2026-02-03T21:39:47.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefi.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:28:19 GMT","end":"Sat, 02 May 2026 13:26:57 GMT"},"fingerprint":{"sha1":"B7:CE:E8:25:EC:0A:72:84:C2:B5:9E:C9:5B:89:4A:26:A8:3B:59:30","sha256":"AF:CB:85:DB:68:FF:88:6C:D6:85:79:6E:57:7C:09:0C:D8:8E:9E:5F:37:55:89:2A:15:EC:BD:5D:47:E3:7E:00"}}},"request":{"raw":"GET /0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2.png HTTP/1.1\r\nHost: curvefi.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefi.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 03 Feb 2026 21:39:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 12266\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 01 Feb 2026 13:47:55 GMT\r\netag: W/\"2fea-19c1975c918\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0Lq9YCBZyuEyb8evYCikBC7bZp6oZYVHgEn09jt0QywnS19iODwEqwOoWPOgq3oF14UcdDIV2goAZVyg3Hi2zLOZwnlN1eIJmkttDLA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c85153f697f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":12266,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"a71d8648628e5a4279421c13d6693b00","sha1":"243ebf605c764594433b1e9d48f1483e5e04f237","sha256":"924547120f439eb58d63e48090995f562baadc0461fc5dd6205fffc5049191df","sha512":"da0c2546f5863398319584693f1434ea667419bf8c07eef85535ca326235b439962f757bd9616e5cf4a1c2d1664b5c5f3f68922ed31e243251f3eb075cf6e788","ssdeep":"192:Btwwwr1ToGgqmohBLLbPB0Cc0V2ItVSJyydjHVvxq/uPw0FO9i6F1mqrBD:vQJT7gqmoHbPmCcs2UVSRdjHV+wp6qqh","tlshash":"7442bf976831e0230be247f01bbafc89c1754ef64b3a95e021090c4ada9cb4f367b597","first_seen":"2025-04-02T11:22:24.566191Z","last_seen":"2026-07-13T04:59:52.993595Z","times_seen":11,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":417,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"curvefi.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}