{"report_id":"1de001ee-424f-4b12-8136-215580b51dfa","version":6,"status":"done","tags":[],"date":"2026-04-26T14:28:17Z","url":{"schema":"http","addr":"tornadocash.ws/","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"tornadocash.ws/lander","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"title":"tornadocash.ws/lander","dom":{"size":922,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (776)","md5":"4d699a5dadfd1229461f03af1def7244","sha1":"4b9e802e56a9ee29a61b8f59505834bc99baeb90","sha256":"39ca54195420174da7f244e36db3687403e9e7ca0eda7e444ee706f5f4c74612","sha512":"1e35de61034287a90823a4fb783ab69ebef9e32bbb520eb58a6b7229bba5d5a2232e6b253deb6facd7e4132ce2c70c86bf6624a6d52c4b43a8b3a86d58394086","ssdeep":"","tlshash":"0d1100c38c51c22c19b085dc7932fb2ea257901e9dd1ec90f5f0006969cebd34c5a994","dom_hash":"domhash3eda90ef943b5e2e25bb94c9e2b5bdc3","first_seen":"2026-04-23T22:57:13.447031Z","last_seen":"2026-04-30T18:35:14.668178Z","times_seen":344,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tornadocash.ws/","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-31T14:28:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"csp.secureserver.net","ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"1998-03-30","domain_rank":62352,"first_seen":"2022-12-18T21:17:09Z","last_seen":"2026-04-20T06:44:30.515553Z","alert_count":0,"request_count":2,"received_data":1017,"sent_data":1106,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.155.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-04-19T22:38:36.404513Z","alert_count":0,"request_count":1,"received_data":354,"sent_data":441,"comment":"","tags":null,"fingerprints":null},{"fqdn":"img1.wsimg.com","ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"domain_registered":"2008-03-17","domain_rank":58983,"first_seen":"2012-06-20T14:42:31Z","last_seen":"2026-04-19T23:26:24.982712Z","alert_count":0,"request_count":5,"received_data":821635,"sent_data":2287,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"tornadocash.ws","ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2025-06-03T20:04:32.26156Z","last_seen":"2026-01-18T08:57:02.449176Z","alert_count":4,"request_count":2,"received_data":1711,"sent_data":1007,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tornadocash.ws/lander","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"396983b43a97ac40197e7d22399b707b","sha1":"9c54ff4c30658fd6a7e94eaaae5072b3ed2ec1dc","sha256":"de4e0ef840a4a74223bb4637d128d0fd8894ac9f95bf604576e8c5280c768442","sha512":"82fd10e645edc15d344110f8b284535fb26273101b469e7db360c1aecec7c1d3fe30a0520a96e5b893ed378c90ed246b9224bd79dca35918753e2b4cb628e1e1","ssdeep":"","tlshash":"d5700028008000008830aaeb230b228c322ef0e0a0008e223220220020c80038802080","size":25,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-08T06:54:38.055245Z","times_seen":15264,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/js/main.1562862f.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"306dafd9553cd72c1cef1154f34e1a48","sha1":"b49334b5c4dbc9ad5367526a23f72b0c08f5ebcf","sha256":"dc135ff3881564b948ede306d017fe627dedd3771268df2fcdb67fac1b7ed465","sha512":"9568f8a55572dfb213cbcc6c32dbb05fef382851290412b8440833131547be6de409a916179663f42d249a3d5fd48f756f8ae29b22375407578fc8413113c712","ssdeep":"12288:7pwc2itW1rQYnT7QYnT1DUk4f0WTI4WugqciqXD5r89MzZH:9wn4erQYnT7QYnTH89qZH","tlshash":"7be42bce76e1b0b407e292eac43f6c4fb3686e15d008c561efbad9da94694498137f1c","size":699558,"data":"","first_seen":"2026-04-23T21:00:55.648254Z","last_seen":"2026-04-30T18:35:14.672314Z","times_seen":2139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6b309239dc60d45e344f4d49a2c5f041","sha1":"c3f931166c53c402c065d8d63119f1009bb30ccf","sha256":"aed4593b11665f063ca6e5e6184435777c74615f5b5991ccdf4acfb8b08e2431","sha512":"4486905b59f275f398b0ffb6aa63dd92662a12d674861b2464a11797f6d0c322df6504f16dbd7c67b3562a9af55e32f344ee8ebc6b5dea2af869630099341a37","ssdeep":"1536:CzSGh6DmEMRNJHY/vbV4vlzH9UOa3mTM+xLxCLuf:8N9Y/ZE1f","tlshash":"33a3a598f6a1f07142e76165412f010bf379a966b0aed0d4e725e8f4adf84ce8173f29","size":104464,"data":"","first_seen":"2025-10-08T00:41:42.369445Z","last_seen":"2026-06-21T14:49:19.309354Z","times_seen":25016,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tornadocash.ws/","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3effca764b1325dc476a4f275bb79d63","sha1":"83e96d57b2196e7dc7422e373d844941644d29ba","sha256":"6525c7cbcf52f274ffc5cbe01fd43c03fd77e9463d0757999a596776f0d4184b","sha512":"72188e1090ac227d6b67206326ff52924f0a264371024d22b1bed0a83a327e338b4044955da06d6bf02aa691b776990da4fddb1bdfead635696598d67646ad1b","ssdeep":"","tlshash":"20900289b011e5c411fa55265b17ba086063219bca105a4444010861653470f451abca","size":56,"data":"","first_seen":"2025-03-02T07:03:41.445505Z","last_seen":"2026-08-08T08:09:51.202345Z","times_seen":143847,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tornadocash.ws/lander","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4566be3a5ae95b1cc330f895a1bf2265","sha1":"712e5d763efe3bc39da3e99fdd0e13c3a5cbc943","sha256":"b23d5005af4518da7309bbb1f5dc1acf5adf215a3e28e21c59501eedcc7f08e4","sha512":"6b733bf4affdac5ace6d720afe9b8626a6f2a1c9c5c3e93b1a3b51611825398acae79c46a907bcf0cf4aef0e36947655673a5202362eff3741cc5d1fdfda8297","ssdeep":"","tlshash":"e6a00261508050e444fc911533733f17f7a3140524806450d7d0051472dfc27d0043d2","size":63,"data":"","first_seen":"2026-04-16T20:30:26.794154Z","last_seen":"2026-08-08T08:45:32.873397Z","times_seen":17788,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tornadocash.ws/lander","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d5d32b0ee8d41b1e47a523df01b25b68","sha1":"ac3178156ab1fd26ac597c73367bed18880c5ce1","sha256":"167d38de22fc467ddbebd2a93ac19cd51bf189e0147c168a07f147ef8da0b609","sha512":"6a53edbf80bb8214232a9c68ce71076f23a0af76870a81219cc32cd31bc08558b2ebcfddeff4b0b86e983b1f1b63d65d82fdf792a0abd816587c4fd0e8688c9a","ssdeep":"","tlshash":"d09002840262480848ea662c0b06aa323730820880f3cce088c0e008320be43628b9c7","size":53,"data":"","first_seen":"2026-04-16T20:30:26.798415Z","last_seen":"2026-08-08T08:45:32.877325Z","times_seen":17788,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"csp.secureserver.net/eventbus/web?clientid=8da2217409854bee82e12dc4ca0b39fb","fqdn":"csp.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:28:00.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.secureserver.net","organization":"Special Domain Services, LLC"},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Thu, 23 Oct 2025 00:07:48 GMT","end":"Tue, 24 Nov 2026 00:07:48 GMT"},"fingerprint":{"sha1":"0C:85:75:97:2A:6F:2B:92:48:28:1A:FB:30:8A:C4:98:A7:9E:26:CE","sha256":"2F:4B:65:33:11:10:9D:A1:94:4B:5A:5D:40:E6:63:70:B6:7E:1A:7F:E7:90:E4:E8:F4:4A:37:2E:94:17:64:AB"}}},"request":{"raw":"POST /eventbus/web?clientid=8da2217409854bee82e12dc4ca0b39fb HTTP/1.1\r\nHost: csp.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 1715\r\nOrigin: https://tornadocash.ws\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1715,"data":"{\"schemaId\":\"urn:shared:user:events:/v1\",\"data\":[{\"global\":{\"traceId\":\"8eb59e9e34824b24ae452d6676fc2f52\",\"client\":{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"sdk\":{\"name\":\"scc-c2\",\"version\":\"1.3.0\"},\"device\":{\"viewportWidth\":1280,\"viewportHeight\":1024,\"screenResolutionWidth\":1280,\"screenResolutionHeight\":1024}},\"page\":{\"traceId\":\"8eb59e9e34824b24ae452d6676fc2f52\",\"host\":\"tornadocash.ws\",\"path\":\"/lander\",\"location\":\"https://tornadocash.ws/lander\",\"referrer\":\"https://tornadocash.ws/\",\"sessionPageViewCount\":1},\"context\":{\"userType\":\"c2\",\"visitorId\":\"35206bd1-f7f4-4262-a239-62c54383cd68\",\"sessionId\":\"35206bd1-f7f4-4262-a239-62c54383cd68\"}},\"events\":[{\"schemaId\":\"urn:shared:user:event:/rigor/page-navigation/v1\",\"data\":{\"eventCreationTimestamp\":\"2026-04-26T14:28:00.256Z\",\"navigationType\":\"navigate\",\"timing\":{\"navigation\":{\"connectEnd\":1777213678992,\"connectStart\":1777213678992,\"domComplete\":1777213680250,\"domContentLoadedEventEnd\":1777213680250,\"domContentLoadedEventStart\":1777213680249,\"domInteractive\":1777213680179,\"domLoading\":1777213679905,\"domainLookupEnd\":1777213678992,\"domainLookupStart\":1777213678992,\"fetchStart\":1777213678992,\"navigationStart\":1777213678992,\"requestStart\":1777213679011,\"responseEnd\":1777213679896,\"responseStart\":1777213679895,\"loadEventStart\":1777213680250,\"loadEventEnd\":0,\"pageLoadTime\":1258,\"domContentLoadedTime\":1257,\"domInteractiveTime\":1187,\"pageDownloadTime\":1,\"serverResponseTime\":884},\"paint\":{}},\"traffic\":{\"pageLevelProperties\":{\"ap\":\"parking\"}},\"producerEventId\":\"d639ff00-2e15-4913-a41c-7e5f984005f8\",\"contentLoadType\":\"hard\",\"response\":{\"transferSize\":1547,\"encodedBodySize\":795,\"decodedBodySize\":795}}}]}]}"}},"response":{"raw":"HTTP/1.1 202 Accepted\r\nContent-Type: application/json\r\nContent-Length: 2\r\nAccess-Control-Allow-Origin: *\r\nx-bus-trace-id: 193515311117498695372973058029489041595\r\nx-envoy-upstream-service-time: 164\r\nx-error-info: 0\r\nx-request-id: 445d6c63-71b6-4eb6-8600-486b1ba00d67\r\nExpires: Sun, 26 Apr 2026 14:28:00 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sun, 26 Apr 2026 14:28:00 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=86400 ; includeSubDomains ; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-08T09:24:41.048594Z","times_seen":756996,"resource_available":true,"data":null}},"time_used":508,"timings":{"blocked":73,"dns":36,"connect":6,"send":0,"wait":359,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js?abp=1\u0026gdabp=true","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.155.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:27:59.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 30 Mar 2026 08:37:36 GMT","end":"Mon, 22 Jun 2026 08:37:35 GMT"},"fingerprint":{"sha1":"08:79:9D:7F:DB:8C:0A:9F:3E:E2:C7:8A:F2:4D:E4:E2:5B:36:28:22","sha256":"07:42:F0:13:40:B6:A1:62:31:62:8E:96:2F:96:8C:7C:C0:5B:F0:8A:DB:0B:A6:E2:44:14:41:7D:B2:7C:B9:74"}}},"request":{"raw":"GET /adsense/domains/caf.js?abp=1\u0026gdabp=true HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncross-origin-resource-policy: cross-origin\r\ncontent-type: text/html; charset=UTF-8\r\nx-content-type-options: nosniff\r\ncache-control: no-store, must-revalidate\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\nserver: sffe\r\ncontent-length: 1604\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T09:24:26.035056Z","times_seen":17776616,"resource_available":true,"data":null}},"time_used":412,"timings":{"blocked":194,"dns":1,"connect":7,"send":0,"wait":20,"receive":1,"ssl":184},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/css/main.ec943a05.css","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:27:59.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/static/css/main.ec943a05.css HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: n3Y9ke4i1tmGbQ9X+J5DyGlr2s8La1XMf4jFqk3mf0i4kioextAJHEaE+UskA9oB29ApO8167fs=\r\nx-amz-request-id: ATYHB1G8RSQHTS67\r\nlast-modified: Thu, 23 Apr 2026 18:50:00 GMT\r\netag: \"d854c2b8ab9039657d43ec9658153468\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: HU62h__lgUXhRkmt8szRu5Ru4PGiMIhr\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Mon, 26 Apr 2027 14:28:00 GMT\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\ncontent-length: 3336\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":14381,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14336)","md5":"d854c2b8ab9039657d43ec9658153468","sha1":"39b44d5fc4a4b91e94bc4eb6dd1185d15851e861","sha256":"03653d9701834f17d4eead73e1c53c70c80ac943ce6c0e70e46d60370fde1bd0","sha512":"e31d372531da19859423a1671e2b4f26372a1e98ea6c76d6099143c11412d06363d020668eee70727002031156dfcdb1910f598357c1bdd38883753d10f67017","ssdeep":"384:v9HfffU8GKbmB9aLNLi6qjUYyQyl/gj1nXSxHqUqCtC/0rtYYl2:v9HfffU8GKbmB9aLNLi6qjUYyQylYRn/","tlshash":"fa52b7621d56053de127c028d9f1e75d906af056d2afa7f5d836232f86df0c2b27ba08","first_seen":"2026-04-23T18:54:32.282382Z","last_seen":"2026-04-30T18:35:14.671749Z","times_seen":2143,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":49,"dns":33,"connect":1,"send":0,"wait":7,"receive":1,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/js/main.1562862f.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:27:59.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/static/js/main.1562862f.js HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: FhwwaFTuBZoaZSYclJcLLEF1uCM8ZWxOCetp0F9kCRzOKPr9ZIl+U75SuXCo2ZlbS88kDPNc8gr91IHMpZx6r4FMq4Hp4+TlDrw46jlj4MU=\r\nx-amz-request-id: R35Q3P96R5SVHZ6H\r\nlast-modified: Thu, 23 Apr 2026 20:55:51 GMT\r\netag: \"306dafd9553cd72c1cef1154f34e1a48\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: JEFncjWuCbYtD.bYzfIDhmzf7grvXdvi\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Mon, 26 Apr 2027 14:28:00 GMT\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\ncontent-length: 183687\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":699558,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"306dafd9553cd72c1cef1154f34e1a48","sha1":"b49334b5c4dbc9ad5367526a23f72b0c08f5ebcf","sha256":"dc135ff3881564b948ede306d017fe627dedd3771268df2fcdb67fac1b7ed465","sha512":"9568f8a55572dfb213cbcc6c32dbb05fef382851290412b8440833131547be6de409a916179663f42d249a3d5fd48f756f8ae29b22375407578fc8413113c712","ssdeep":"12288:7pwc2itW1rQYnT7QYnT1DUk4f0WTI4WugqciqXD5r89MzZH:9wn4erQYnT7QYnTH89qZH","tlshash":"7be42bce76e1b0b407e292eac43f6c4fb3686e15d008c561efbad9da94694498137f1c","first_seen":"2026-04-23T21:00:55.648254Z","last_seen":"2026-04-30T18:35:14.672314Z","times_seen":2139,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":52,"dns":32,"connect":3,"send":0,"wait":7,"receive":7,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/px.js?ch=1\u0026abp=1\u0026gdabp=true","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:28:00.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/px.js?ch=1\u0026abp=1\u0026gdabp=true HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tornadocash.ws/\r\nOrigin: https://tornadocash.ws\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: zXSi7ozY+8IUfkedw5upA8Z6ROUCjJKHD5zoYeWv3cxIVROUluQowxkzZwB/bfyshmsWMAqcQcQE09Jqi4bjwqQOJgLvQV71\r\nx-amz-request-id: 955MHB8VVQGJ4QWS\r\nlast-modified: Thu, 23 Apr 2026 21:16:10 GMT\r\netag: \"d41d8cd98f00b204e9800998ecf8427e\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: PXQvo3WSoiZ6ILkCvgAPALEI61_c16Ad\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Mon, 26 Apr 2027 14:28:00 GMT\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\ncontent-length: 20\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T09:24:26.035056Z","times_seen":17776616,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/px.js?ch=2\u0026abp=2\u0026gdabp=true","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:28:00.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/px.js?ch=2\u0026abp=2\u0026gdabp=true HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tornadocash.ws/\r\nOrigin: https://tornadocash.ws\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: CQ3XjoNtpH/LEJALgfMZkq6w8YsN5udOMpFfPtVdKecLvcGmkYELzYwc98GO6SIqcc2XgvWHH1pJN3MCmmtjD6Gu5Y96QQ/+\r\nx-amz-request-id: 955NM8EP4YFGW15P\r\nlast-modified: Thu, 23 Apr 2026 21:16:10 GMT\r\netag: \"d41d8cd98f00b204e9800998ecf8427e\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: PXQvo3WSoiZ6ILkCvgAPALEI61_c16Ad\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Mon, 26 Apr 2027 14:28:00 GMT\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\ncontent-length: 20\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T09:24:26.035056Z","times_seen":17776616,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.secureserver.net/eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3","fqdn":"csp.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:28:00.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.secureserver.net","organization":"Special Domain Services, LLC"},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Thu, 23 Oct 2025 00:07:48 GMT","end":"Tue, 24 Nov 2026 00:07:48 GMT"},"fingerprint":{"sha1":"0C:85:75:97:2A:6F:2B:92:48:28:1A:FB:30:8A:C4:98:A7:9E:26:CE","sha256":"2F:4B:65:33:11:10:9D:A1:94:4B:5A:5D:40:E6:63:70:B6:7E:1A:7F:E7:90:E4:E8:F4:4A:37:2E:94:17:64:AB"}}},"request":{"raw":"POST /eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3 HTTP/1.1\r\nHost: csp.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 1011\r\nOrigin: https://tornadocash.ws\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1011,"data":"{\"schemaId\":\"urn:shared:user:events:/v1\",\"data\":[{\"global\":{\"traceId\":\"8eb59e9e34824b24ae452d6676fc2f52\",\"client\":{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"sdk\":{\"name\":\"scc-c2\",\"version\":\"1.3.0\"},\"device\":{\"viewportWidth\":1280,\"viewportHeight\":1024,\"screenResolutionWidth\":1280,\"screenResolutionHeight\":1024}},\"page\":{\"traceId\":\"8eb59e9e34824b24ae452d6676fc2f52\",\"host\":\"tornadocash.ws\",\"path\":\"/lander\",\"location\":\"https://tornadocash.ws/lander\",\"referrer\":\"https://tornadocash.ws/\",\"sessionPageViewCount\":1},\"context\":{\"userType\":\"c2\",\"visitorId\":\"35206bd1-f7f4-4262-a239-62c54383cd68\",\"sessionId\":\"35206bd1-f7f4-4262-a239-62c54383cd68\"}},\"events\":[{\"schemaId\":\"urn:shared:user:event:/data-platform/signals/page-view/v1\",\"data\":{\"eventCreationTimestamp\":\"2026-04-26T14:28:00.247Z\",\"forensics\":{\"traceIdAdopted\":false},\"traffic\":{\"pageLevelProperties\":{\"ap\":\"parking\"},\"customProperties\":{}},\"producerEventId\":\"445544f9-0aa7-4fb8-8f39-9852b06b9959\"}}]}]}"}},"response":{"raw":"HTTP/1.1 202 Accepted\r\nContent-Type: application/json\r\nContent-Length: 2\r\nAccess-Control-Allow-Origin: *\r\nx-bus-trace-id: 249204783619634986614357642115245135351\r\nx-envoy-upstream-service-time: 89\r\nx-error-info: 0\r\nx-request-id: a81bceed-c7e4-4516-ad25-e930cddf77ef\r\nExpires: Sun, 26 Apr 2026 14:28:00 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sun, 26 Apr 2026 14:28:00 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=86400 ; includeSubDomains ; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-08T09:24:41.048594Z","times_seen":756996,"resource_available":true,"data":null}},"time_used":344,"timings":{"blocked":75,"dns":37,"connect":1,"send":0,"wait":192,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tornadocash.ws/","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-26T14:27:53.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tornadocash.ws","organization":""},"issuer":{"commonName":"GoDaddy TLS Intermediate CA DV - R1v1","organization":"GoDaddy.com"},"validity":{"start":"Sat, 18 Apr 2026 08:12:52 GMT","end":"Mon, 02 Nov 2026 08:12:52 GMT"},"fingerprint":{"sha1":"4D:E4:62:28:AB:DE:D4:45:7F:9E:99:FB:79:F8:5D:79:31:98:23:73","sha256":"BB:80:CA:50:60:B4:35:BF:FE:30:15:9B:26:EB:3A:BF:58:49:83:5B:05:DA:92:A0:69:7A:C1:C7:B6:98:81:12"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tornadocash.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nDate: Sun, 26 Apr 2026 14:27:58 GMT\r\nContent-Length: 114\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":114,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"e89f75f918dbdcee28604d4e09dd71d7","sha1":"f9d9055e9878723a12063b47d4a1a5f58c3eb1e9","sha256":"6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023","sha512":"8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0","ssdeep":"","tlshash":"eeb092ddbc61e48018e535511ea3b60d146a22ebb9018b4018c00836a96035f8d0aac5","first_seen":"2024-03-15T21:37:10Z","last_seen":"2026-08-08T08:28:19.815496Z","times_seen":161281,"resource_available":true,"data":null}},"time_used":9589,"timings":{"blocked":4570,"dns":12,"connect":1,"send":0,"wait":448,"receive":0,"ssl":4554},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tornadocash.ws/lander","fqdn":"tornadocash.ws","domain":"tornadocash.ws","tld":"ws"},"ip":{"addr":"52.223.13.41","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-26T14:27:59.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tornadocash.ws","organization":""},"issuer":{"commonName":"GoDaddy TLS Intermediate CA DV - R1v1","organization":"GoDaddy.com"},"validity":{"start":"Sat, 18 Apr 2026 08:12:52 GMT","end":"Mon, 02 Nov 2026 08:12:52 GMT"},"fingerprint":{"sha1":"4D:E4:62:28:AB:DE:D4:45:7F:9E:99:FB:79:F8:5D:79:31:98:23:73","sha256":"BB:80:CA:50:60:B4:35:BF:FE:30:15:9B:26:EB:3A:BF:58:49:83:5B:05:DA:92:A0:69:7A:C1:C7:B6:98:81:12"}}},"request":{"raw":"GET /lander HTTP/1.1\r\nHost: tornadocash.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=86400\r\nContent-Type: text/html\r\nDate: Sun, 26 Apr 2026 14:27:59 GMT\r\nServer: openresty\r\nSet-Cookie: expiry_partner=tucows.EXPIRED.CF3F10F5-9663-4600-977B-E13B5DC69A28; Path=/; Max-Age=86400\ncaf_ipaddr=91.90.42.154; Path=/; Max-Age=86400\ncountry=NO; Path=/; Max-Age=86400\ncity=\"Oslo\"; Path=/; Max-Age=86400\nlander_type=parking-tucows-expired; Path=/; Max-Age=86400\r\nX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Ccifgge+fcRPiJVU/EGYfEuA6mV+Kh21jzt/p8lT3kvkw7Ty9/ZjmsEazmzoKWuA89DPnF9YMDu5fnI1uHcxGw\r\nX-Content-Type-Options: nosniff\r\nContent-Length: 795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":795,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (794)","md5":"b98b211e76afef7cd37a30faeb15cb75","sha1":"ae0d71053ddbbd6cb7f96aa9f8647cc8a9d28fed","sha256":"fd4b3da8ef1c0d7abe35e9acd111cf7e08a8b2e67f7c6f0d167354d77b981ee3","sha512":"fd46815434a722b57ca5f29fb870958e6cfb95cb2ccd6ab3a5c39c28d351190b1cb92d182b2c429bae57e2e13de4ca1ffcc2fdd11dc5c8bbf83b97382140b2b9","ssdeep":"","tlshash":"8801bdd38c51c22c0ab095ad7a33fb2ea216e01adcd1ec81e5d0002568debd34c5ed90","first_seen":"2026-04-23T22:57:13.46335Z","last_seen":"2026-04-30T18:35:14.670674Z","times_seen":347,"resource_available":false,"data":null}},"time_used":885,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":884,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"tornadocash.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.50","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tornadocash.ws/lander","date":"2026-04-26T14:27:59.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /signals/js/clients/scc-c2/scc-c2.min.js HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tornadocash.ws/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: sZHtSt/BAcaTNUdoxqmqc/sqQ4Q9S534Aven84WQkdXv1JYienXoeInBXkfA1kgn9Ov1XGgZSms=\r\nx-amz-request-id: P8Z2VKH8KJY1TRQV\r\nlast-modified: Thu, 19 Feb 2026 18:11:28 GMT\r\netag: \"6b309239dc60d45e344f4d49a2c5f041\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-version: 1.3.0\r\nx-amz-version-id: 5rz5mfani0A4Sx2XrwmZgSvEFZ7uFBOZ\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 21133\r\ncache-control: max-age=1800\r\nexpires: Sun, 26 Apr 2026 14:58:00 GMT\r\ndate: Sun, 26 Apr 2026 14:28:00 GMT\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":104464,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6b309239dc60d45e344f4d49a2c5f041","sha1":"c3f931166c53c402c065d8d63119f1009bb30ccf","sha256":"aed4593b11665f063ca6e5e6184435777c74615f5b5991ccdf4acfb8b08e2431","sha512":"4486905b59f275f398b0ffb6aa63dd92662a12d674861b2464a11797f6d0c322df6504f16dbd7c67b3562a9af55e32f344ee8ebc6b5dea2af869630099341a37","ssdeep":"1536:CzSGh6DmEMRNJHY/vbV4vlzH9UOa3mTM+xLxCLuf:8N9Y/ZE1f","tlshash":"33a3a598f6a1f07142e76165412f010bf379a966b0aed0d4e725e8f4adf84ce8173f29","first_seen":"2025-10-08T00:41:42.369445Z","last_seen":"2026-06-21T14:49:19.309354Z","times_seen":25016,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":54,"dns":33,"connect":0,"send":0,"wait":13,"receive":1,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}