{"report_id":"249ed4c4-ee5e-4e9b-9ffc-25889674b052","version":6,"status":"done","tags":[],"date":"2026-01-11T06:27:18Z","url":{"schema":"https","addr":"trustwsallet.com/","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":0,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"trustwsallet.com/","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"title":"TrustWallet钱包app下载_TrustWallet安卓版下载_TrustWallet官网_TrustWallet钱包官网版下载-全球领先的数字货币交易钱包","dom":{"size":28671,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2644)","md5":"a6526f7f3be5daf6f6a72d8c29bbb86b","sha1":"ed1550c8df7bae8381d12bc13dc8d3dc65d0529a","sha256":"763b05d9e60ed2b3c2443fcf3f77b804dc4affcae54a0bd58e2763e9b4ba6c04","sha512":"5d80c0d3734cd4d4bc1303cce98a1fc657a46b71c05d041aa6e870964f374cd5ce82cf074f1104cf976f27a1de73e618f8f5395b264c0a13a344a2c72f749d62","ssdeep":"384:0wBxCxC4fChEVdVypJFYIyDgW9h3D0M7K:jxCxC4fuEHIYBDgwhz0M7K","tlshash":"ddd2957206d1192202635bacf9eb13bd28904ecfcd075d5836ed8ebc6f92d65ed0a50b","dom_hash":"domhash2a52984990137ac733a978906dab42de","first_seen":"2026-01-11T06:27:23.933728Z","last_seen":"2026-01-11T06:27:23.933728Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"trustwsallet.com/","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":0,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-15T06:27:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"trustwsallet.com","ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"domain_registered":"2025-04-26","domain_rank":0,"first_seen":"2026-01-11T06:27:19.372427Z","last_seen":"2026-01-11T06:27:19.372427Z","alert_count":56,"request_count":28,"received_data":1163243,"sent_data":15467,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"trustwsallet.com/images/js/swiper.animate.min.js","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c65f46168f8b46c37f8394155793737","sha1":"a681bd4ac1d3972e7664e0f35d88e6ca9cfcd713","sha256":"d1136c5c805e2069d250b1036023cb10b424d690aee26525337957b67509ea39","sha512":"807167ab1c7b934efffcfa2628920a8586246d9149975c49350ce44d89212aed73eaaf8229aed203b34c45792da617e0aeadc17888d25d720a8d5b28d192ac32","ssdeep":"","tlshash":"1a314a52c30046beea123a92564f04582c305a9d5a859cb474f9af7f88ec63285fd7bb","size":1743,"data":"","first_seen":"2023-03-07T22:33:39Z","last_seen":"2026-08-05T21:36:10.566213Z","times_seen":1023,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/js/swiper.min.js","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5bb26def607ac0e0e114a502ac65e38","sha1":"2cd244e7a00c598ed9ec4e0d04325f8511667816","sha256":"770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b","sha512":"3db22c669b0df4cc315529cb2180e90d3318bec989cb5c01e130919c9889e7e6102150a138ea53114889965607add93ac5a5407a0bc10e4612970220dfc5ebd1","ssdeep":"1536:Fj2qhgxfeuGMfoqi2ZLjK8ieVlLXCiiSsWRLK7A3dnaKBjY4vHgZsUOUTqiqpBgT:wxoo6desFshaKi+HgZsUOUTqiqM37EO","tlshash":"d9d3194eb39061a551e36257535e8241a3b72809780ad0ac35b688e79dbde4c13bfffc","size":139191,"data":"","first_seen":"2023-03-07T01:06:35Z","last_seen":"2026-08-05T21:36:10.564992Z","times_seen":2085,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1ec6b419d7dc4d8deec400ffa594bbad","sha1":"9ec5ec6780c8055507bbcb45081a160e72e1ffd7","sha256":"2b9b339f663e0bd5c07dbdbc2dc0c8ac3b2425098759b7e7a8df3104032ef079","sha512":"f1dae243f026a7a0108e210db8a674aef193636e0462423a0a287ff335568585c03beacb1c830dae17c3adf1167d408c8f078f730390a85cc18349e7cbc02241","ssdeep":"","tlshash":"4d01ac97296064a24a2b79774c9f9500367281576d0ebedab54e0ca4cf5102c03bcbe9","size":723,"data":"","first_seen":"2023-06-10T03:36:53Z","last_seen":"2026-06-06T17:13:29.23441Z","times_seen":318,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/submit.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/submit.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 615\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-267\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":615,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 16 x 16","md5":"de35dc2862c3fde1eb406146793a5916","sha1":"22d832a12c1d1d393d331e007bc5a972b41e3922","sha256":"9cb5cc71dd36876d6663587aa64a3b5a8092715060a0a83c346ec5bd69f807fe","sha512":"00fa9edb52ce9accf513df8e4d1c419a965627e68837eb399ac6fe710f1546e87317b764edf572ba4f5eca013f1d37dd6b6536962e41fd022d34ce1735f831d3","ssdeep":"","tlshash":"95f0e14f7377f3b9c40566fd8331da71405cda945624b4905511e91db08036a8943a43","first_seen":"2025-10-27T01:41:27.095702Z","last_seen":"2026-01-11T06:27:23.936162Z","times_seen":3,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/PostHeadBottom.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/PostHeadBottom.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 150\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-96\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":150,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 550 x 4","md5":"83cc1ccabed128d23bd309d96b4425ce","sha1":"7c13db548105c17dc976e7fa1654659ecd812c7b","sha256":"d36e356e84c9b2c4cb5ce3abf2ee52c1d37f7207d617cff40d3a327762aff323","sha512":"ddc90aadb75bbf470988fad3b179441ecefd2ebab78bcb880006736dc212e386fa373f3654945806e3f2332bfcb4a3f0e0c1758f45e4f3240005d71aeedecaa1","ssdeep":"","tlshash":"2ec02b13d03cc1a7d22140300903b0c47622636908347d857216836da9d4411224400d","first_seen":"2025-10-27T01:41:27.093551Z","last_seen":"2026-01-11T06:27:23.938975Z","times_seen":3,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/favicon.ico","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:03.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /images/favicon.ico HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:03 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-06T03:00:03.805983Z","times_seen":546774,"resource_available":true,"data":null}},"time_used":2302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-11T06:26:57.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:58 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D; expires=Sun, 11-Jan-2026 06:27:58 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}],"data":{"size":26767,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1092), with CRLF line terminators","md5":"a68bb90d32a90c56ad5239d506ae26b5","sha1":"a8943acf3077655de2761315c52117d8d363d898","sha256":"55433f4a1c963dd09c8381368a4e7bb3ded58d48a085e9a5b892d0f76d879528","sha512":"ecd63e70c3d0f1a333ae475ac0100ac1f7b5d8b8849f3329d5cb83f7fd2f0fb1a587284ee8d3900ff7a4a64238e22887ec61443751314d14e149943062ed17b0","ssdeep":"192:o9bVkrKNAk7I+gXsMG9xO/d5QkPRR2zu8mIL9jmCOZ1dsu3sPrEe4mHEDVXfLh55:iM12zACxEldQgoJIKm2NwsJ+IlG","tlshash":"27c256a506c21a1b03333aec5a4b63bceb140dc79d121c947aae573f3bb1d59b90b51b","first_seen":"2026-01-11T06:27:23.942011Z","last_seen":"2026-01-11T06:27:23.942011Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2987,"timings":{"blocked":1096,"dns":424,"connect":457,"send":0,"wait":790,"receive":0,"ssl":215},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/style/style.css","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/style/style.css HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D; expires=Sun, 11-Jan-2026 06:27:59 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":71585,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with CRLF line terminators","md5":"8976859e50064632cd91e0c42765036f","sha1":"7c74b177162df98b841b0b1d7a2cc13d9b1a269e","sha256":"5c2c89107a18595aea4d22cbdd9233095a25b3b90050b786711964ea9705d0d5","sha512":"a919ead252a7bd9aae307125d1065169608560bdd7d0686c245aa0b5e09f601bbd33ef38049b49f3482a0af611940fc6c142c8ea1f31b62df28600540db39bc5","ssdeep":"768:uqcItPE2qkwomXpAMri4b4rTo7oCJAlcK0En2KORpoSr:uqcItPE2qkwoAC/cK0BF","tlshash":"e163f3acc503d64235f8b9a03b9a5695f8714357af0466a93bf95089efb4a3e0010ffd","first_seen":"2026-01-11T06:27:23.943253Z","last_seen":"2026-01-11T06:27:23.943253Z","times_seen":1,"resource_available":false,"data":null}},"time_used":755,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":755,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/HeaderBottom.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/HeaderBottom.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 184\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-b8\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":184,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 940 x 5","md5":"2c795fb758d2443019472ebe1f302a01","sha1":"50ad313c9bbf50b025c4500f3abe12d4d067cf1c","sha256":"4a317da93049c86175902d2dc4952733682e1959fce54262f72938699a398791","sha512":"c99b90eea6c1e3fcc40c1b89741324a434cfe4b7b7dc4ab5637720f21ccbb95a77e4af1125e481a3fe63cb1f3b9d958c9b7684fda54e453133d998f0d4002f5a","ssdeep":"","tlshash":"a0c0c02cc1b40004cf258834494ab0013888071c2813fed38088c77b03703631001011","first_seen":"2025-10-27T01:41:27.08441Z","last_seen":"2026-01-11T06:27:23.944959Z","times_seen":3,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/HeaderTop.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/HeaderTop.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 185\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-b9\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 940 x 5","md5":"9639ee686d4bff387ec0ca27752ff4ae","sha1":"ee0cf06245fc316e1f08e7ad496b9e47baae6ff9","sha256":"66164558ac2faf91059a4f55af5c1130127b57a74a3b66c2ffaeb69113e1dcc8","sha512":"7d226a975282a43b1af26931a46b02328e568eb524acf32a17cf100cd5149fa71da50e2cb42646ca708db147acd1971b57ebc1948188d69b25c2feb9e4626691","ssdeep":"","tlshash":"5dc0c00ee5e09200cf3304f38403d8882d7c8f14c4049cfa866573c0f9343251185c03","first_seen":"2025-10-27T01:41:27.069713Z","last_seen":"2026-01-11T06:27:23.946092Z","times_seen":3,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/SynRssCom.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/SynRssCom.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 533\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-215\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":533,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 12 x 13","md5":"2d880e48958ba75aaa236782431403b6","sha1":"02aaebf51f396fbb75a839ee1b55e2ac0714eb4e","sha256":"2ac7897d4915e4bb9c49421687390919db439e246753874511907810eaabfe90","sha512":"3db381bba65a9eb2b8dfc330bed6e37a15b0b0311b216fb3516542328ae07021b1ffd8a64b3abe8cf64c0511e8acc760f8db3fbc9ba4e139ba445668d6a37ef2","ssdeep":"","tlshash":"1df0c09354c5cfc0df0f71345ac74126e1145dc9d5045e69ad027e829f4b034d214848","first_seen":"2025-10-27T01:41:27.07637Z","last_seen":"2026-01-11T06:27:23.947751Z","times_seen":3,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":411,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/style/animate.min.css","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/style/animate.min.css HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D; expires=Sun, 11-Jan-2026 06:27:59 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61353,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (61191)","md5":"d6dfff213c31504dc0a27d36c8e320bd","sha1":"8411c1c0418521c96d07bcca0d9dbce7e832ccc9","sha256":"f89ad2fbc54ddd9e111ed8dc7b6e4d88e6c3463134b5264da879305866e5f458","sha512":"e1cd6bd615407b53490c25ae6bbaf21977d1339477772234631054f5213253a8b254a95fa006fd9f9a40cf5d4ba18ec988c03676cc510d899daeb51da4044ffb","ssdeep":"768:hkZlIuqI46CIBqI4IuwG1RASkMDs3Uyp5CrWeu0GT6sPasb:hkZ6IuwG1RASkMDs3Uyp5CrWeu0GTT","tlshash":"cc5347ae5891228991664b66c3cc4e684b3dc77714625cdf3385684b8f87f9f33ea207","first_seen":"2023-04-07T10:13:34Z","last_seen":"2026-08-05T21:36:10.537914Z","times_seen":1490,"resource_available":false,"data":null}},"time_used":2981,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2981,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/uploads/allimg/250430/1-250430142324.jpg","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324.jpg HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-79f4\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31220,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 750x375, components 3","md5":"0acc6f12b13689c4eefd8a473bae5e21","sha1":"2917ca56c67b682b176ca6dc96ad46e3fbee8164","sha256":"a6e7b8a0da45d4e0f17a12988e15da0afc81b08f04fa3ec80c5ce4b085c10bc1","sha512":"47ad6afd7ae3ce56cb0fb946d02015f1b08b778b1872027fa3b6f52530c03405596b7813b013c0010b867e85c8e92b6bab3ff7a831effe740023d73a5573438a","ssdeep":"768:ffOEsqbaUkfG8H23TpC1GH0WEmOXiaTyGHjS/B6IOOMH1:uEpaZOE1eVEqaOG+P8H1","tlshash":"55e2f155865086cee0fd423e40b38f7ba3cc4deb3953605e02d60e42abfda67c81c0a9","first_seen":"2025-06-26T17:56:30.593431Z","last_seen":"2026-04-06T08:28:59.29441Z","times_seen":44,"resource_available":false,"data":null}},"time_used":2266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/js/swiper.animate.min.js","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /images/js/swiper.animate.min.js HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Nov 2021 06:35:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"618b6826-6cf\"\r\nexpires: Sun, 11 Jan 2026 18:26:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1743,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (1690), with CRLF line terminators","md5":"7c65f46168f8b46c37f8394155793737","sha1":"a681bd4ac1d3972e7664e0f35d88e6ca9cfcd713","sha256":"d1136c5c805e2069d250b1036023cb10b424d690aee26525337957b67509ea39","sha512":"807167ab1c7b934efffcfa2628920a8586246d9149975c49350ce44d89212aed73eaaf8229aed203b34c45792da617e0aeadc17888d25d720a8d5b28d192ac32","ssdeep":"","tlshash":"1a314a52c30046beea123a92564f04582c305a9d5a859cb474f9af7f88ec63285fd7bb","first_seen":"2023-03-07T22:33:39Z","last_seen":"2026-08-05T21:36:10.566213Z","times_seen":1023,"resource_available":true,"data":null}},"time_used":2972,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2972,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/HRBottom.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/HRBottom.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 159\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-9f\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":159,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 728 x 4","md5":"841eee76839e87bcee634bd8207c766f","sha1":"f2573b7a5a62614dd0abad513bb8718cab60c00e","sha256":"ebc1da17f28c8cd50c3a895367f4f7690dbd962f52b2988536d042b55b7be7cd","sha512":"6e6c2bd3a21bc61de11eb2f1b82eacf9a36759f83329615e56fddd1affdd77ec4b2f682c951ca8e0d9c8c98a43150c62655f2f19c61d1f1b4b9bc96679366909","ssdeep":"","tlshash":"a4c02b5cc9da26ffd6530d70664f1b193f08037e45591d5108b64b22309804711c6f2c","first_seen":"2025-10-27T01:41:27.085526Z","last_seen":"2026-01-11T06:27:23.951831Z","times_seen":3,"resource_available":false,"data":null}},"time_used":563,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/HRTop.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/HRTop.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 159\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-9f\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":159,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 728 x 4","md5":"e18d5f0027965196d5ff6fa2b6d440f3","sha1":"82c4acd9a66bc392f6c2808dc94f4a1c35163d72","sha256":"911c6161ddb85a82a9e2a16975fd743bc64e19c63bff5b4acae9bde2b1a74cec","sha512":"2acc626eb61c91e8b41aa9df7e27046ed42840b7772e9ad7e3896af741dc129d71b189eacf66add8c90078c9158d5382ad69803149a1712d59482ce008e6f76b","ssdeep":"","tlshash":"f6c02b3de1273133c323cc70cfa146ad3fbda32a80091c43009a43b3b0ac2a76004e90","first_seen":"2025-10-27T01:41:27.075015Z","last_seen":"2026-01-11T06:27:23.952877Z","times_seen":3,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/BGCTop.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/BGCTop.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 182\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-b6\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":182,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 960 x 5","md5":"71453a442b4c276b2acbb6746285f1c2","sha1":"6b2fdd50a5d316746edde9674c8b708228fb30b9","sha256":"a507de1881e2e5ddfa5e472e9faa166fc7694c91663feefa77444251e9fce3ff","sha512":"89f52243b3c489f042bbe2a25c3250c63d7b1401a72eb8aa9fd7868cde9788c6e3180f160742a3ee782dc3d777928c207cc556b053c7874aebc940b33aa107a1","ssdeep":"","tlshash":"dbc0c08cd450e6f4c32140f3ce1140081c280b791440ddc30a590fb834f82160083000","first_seen":"2025-10-27T01:41:27.073779Z","last_seen":"2026-01-11T06:27:23.954624Z","times_seen":3,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/uploads/allimg/250430/1-250430142324-50.jpg","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.601Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-50.jpg HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-1bf5c\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114524,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x720, components 3","md5":"f11ba385f6e8b46d61aaa66eff745767","sha1":"9a067fe1d1b3ebc213ecc628d00e0282b834ed5b","sha256":"50112dd4efc8d06d94fa8ef15a26854ceb796ce26e22dee1148e57fbaf34d7bf","sha512":"d1a69e0b220048f7517e2ac98266b1aed140a6ff4ed7818f3d4a2dfeb0126748a1acb389a4f345eb94129211aa6072a2e13076f8279dc3e8ac86d24977e9c2fb","ssdeep":"3072:8JWDVwNY9K65GJQz75rXRklqmBlsmESj98ZCxNdoFP:88Ra65GiRR9GumEw7doFP","tlshash":"c3b302986176eccefd43ba39f1278474c39cfb45d18de2c5309410962a2f98d75abb22","first_seen":"2025-06-26T17:56:30.600402Z","last_seen":"2026-04-06T08:28:59.290562Z","times_seen":43,"resource_available":false,"data":null}},"time_used":1368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/uploads/allimg/250430/1-250430142324-52.jpg","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-52.jpg HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-9c42\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40002,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 644x363, components 3","md5":"4301c16a63d529faaf57800d0339b09d","sha1":"5d944f044c817fb66e43a23a0198479473cc8753","sha256":"b879d709b7237b97f6c9dfc3a4770eac242dfc5aeb9f081d880f808312624bdb","sha512":"7e7bb519c51a42b3f6966293fe1d6d79e588c70bc1767b04c34d21bfaf30cba943fa0948ece031e7d2da9e2fa3ea1eab394d0c8afc4176fa45ae911c7b6c5ed1","ssdeep":"768:gZKSx/DpKXaL8GTCo2ivGyl3I/ebdJGsn4Wjd6VyVpUZ8jFq9uj9EeSIyFnj:gosacbT5i83I/ebNjMVyVp/k9uj9EeYV","tlshash":"9c03f1204fa7a3d0f6138ab5828ded45f3c67785792f8fa1a7d112881c0c5d49fa35a9","first_seen":"2025-09-03T17:25:24.678217Z","last_seen":"2026-04-06T08:28:59.313174Z","times_seen":40,"resource_available":false,"data":null}},"time_used":2264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/js/swiper.min.js","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /images/js/swiper.min.js HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Nov 2021 08:06:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"618ccf20-21fb7\"\r\nexpires: Sun, 11 Jan 2026 18:26:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139191,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65280)","md5":"e5bb26def607ac0e0e114a502ac65e38","sha1":"2cd244e7a00c598ed9ec4e0d04325f8511667816","sha256":"770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b","sha512":"3db22c669b0df4cc315529cb2180e90d3318bec989cb5c01e130919c9889e7e6102150a138ea53114889965607add93ac5a5407a0bc10e4612970220dfc5ebd1","ssdeep":"1536:Fj2qhgxfeuGMfoqi2ZLjK8ieVlLXCiiSsWRLK7A3dnaKBjY4vHgZsUOUTqiqpBgT:wxoo6desFshaKi+HgZsUOUTqiqM37EO","tlshash":"d9d3194eb39061a551e36257535e8241a3b72809780ad0ac35b688e79dbde4c13bfffc","first_seen":"2023-03-07T01:06:35Z","last_seen":"2026-08-05T21:36:10.564992Z","times_seen":2085,"resource_available":true,"data":null}},"time_used":2973,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2973,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/BGCBottom.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/BGCBottom.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 180\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-b4\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":180,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 960 x 5","md5":"937e92ec2644f497c093f24c54c9c9d4","sha1":"b6e44ca186e0b9c3da3671b5be41c192fb851193","sha256":"89650568ccad7e484f59a16e6a2b487b3aaeeb4b13a64a2dfef81286f02cc5cf","sha512":"11f14a0626ac5f483c9a05c8c1d590ae467c16c52c9d283413f9f87e07fd11f79f8f89babbaa65cb7dfaf3f036c0e3fcf52b29801142663d4a27c25d953e677f","ssdeep":"","tlshash":"4fc0c03fc7b254d5d34002f3613141041b4ac500ec411e43300d074e347018670000b4","first_seen":"2025-10-27T01:41:27.072729Z","last_seen":"2026-01-11T06:27:23.958829Z","times_seen":3,"resource_available":false,"data":null}},"time_used":560,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/uploads/allimg/250430/1-250430142324-51.jpg","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-51.jpg HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-19fa6\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106406,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x669, components 3","md5":"9eee6cdd6bf1588bbc8f675e583a5496","sha1":"469c08ffc60ae968b4be1ad08fc74ba6d5e14abd","sha256":"47c22a0014a878a4fca5de7cc1a76324c2d6ecc3a641e152636d66c67c28ef46","sha512":"6601113b9a5e7d5b558fb03ed8f0b76761905ee322bd701fbb5eebc35b4d1adf9bd2ce9ffb525d055c7fcb08d27247e7166d6442eb3fef4374b6ca0bf4dc6720","ssdeep":"3072:SJSCNhw56CQIZjUSnhBuGvpkBBZvQKGlRx70H36vF:it9CvLuGGBZQjx70H36vF","tlshash":"fda30253eb172bdfda580772a1e71b35b72aab7623871b308ac515b50f006d93f04a91","first_seen":"2025-06-26T17:56:30.603836Z","last_seen":"2026-04-06T08:28:59.298789Z","times_seen":41,"resource_available":false,"data":null}},"time_used":2266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/Submissions.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/Submissions.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\nlast-modified: Thu, 21 Oct 2021 07:07:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"617111b8-f4f\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3919,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 323 x 68","md5":"c9fd046b90587076ddc1166939ab93f9","sha1":"3d47e435995041fb7590d9b98eff82e05005b32b","sha256":"402059c7222a59381b26c98c981271948a6747a5151e9db64872d98c498b50d5","sha512":"a7be65ca9cc559d850e4b7fb69d9b60f573036307652cf8b8d1faf0504000a130e61f25cc78b71e7ed18b79a0e0d0b69d6b834d7aa81008c1279b11d3e549aae","ssdeep":"","tlshash":"4e815ce4d203cc76cb3a393e53fe350911ee617d586bd7a884b085a506865a2afc0317","first_seen":"2025-10-27T01:41:27.096811Z","last_seen":"2026-01-11T06:27:23.966585Z","times_seen":3,"resource_available":false,"data":null}},"time_used":556,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/favicon.png","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:03.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /images/favicon.png HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:03 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Jun 2025 08:38:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68551e12-6758b\"\r\nexpires: Tue, 10 Feb 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":423307,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1230 x 1176, 8-bit/color RGBA, non-interlaced","md5":"b9cdafdd1ae5ce684774213c2de6c539","sha1":"88e6d8bf57afd226ff1482adcb535c2bc99805bd","sha256":"bf263ba443a53699d0d4eccf634a0b1702bee88393213805c02d0caeae4d022a","sha512":"5e7166311b5718b78b5a8799f0166fc1e83ffb914e10dec767fee3ed5760e01bac24f917378b0cc3b875bc460110875661ae55b8bac156797ac4421dfe997693","ssdeep":"12288:6L04qVepvSJQ/FSQecdEyIBrnZ2wse8sxMW:6pK0aQFSI+yIBoteJd","tlshash":"6e941233da29647287dadb69482323e2451c7add683f9c50c3c67e61b37f2de3445909","first_seen":"2025-09-03T17:25:24.663113Z","last_seen":"2026-02-19T21:55:36.646213Z","times_seen":36,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":656,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/images/logo.png","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Jun 2025 08:37:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68551dc1-342b\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13355,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 48, 8-bit/color RGBA, non-interlaced","md5":"1337579eda79fb2019b069d0e01fad42","sha1":"4f9d41804581e030c88530a26af03d16f183ea07","sha256":"b0bd4d3afd369bc29d3c3184e94746963165a75b594e257bb6872a6d5e5aa75e","sha512":"7b865f1d556a0ae5793bf19117dfbeae8a0c8ae2d78f68e891a280db99f284e61d9bcd725691e271b31f3041b58490bf2cc02b554d9c5ae38c47d24d72d9f594","ssdeep":"192:A/LhlNAlnaebeZJqAVg+TgYvhTeH9goM41K2CWS74JNeaAqMN1489EXE93AotPmo:ASlna1Zda+kYRg9/KFTbaU3f9hBZ","tlshash":"9552c0062251c454c42d002ad85cac99c7fdca1b87e60a25bbfd519b7d6ec99cd9fc32","first_seen":"2025-06-26T17:56:30.607377Z","last_seen":"2026-04-06T08:28:59.306138Z","times_seen":48,"resource_available":false,"data":null}},"time_used":1127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/HeadUnTop.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/HeadUnTop.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 182\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-b6\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":182,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 940 x 5","md5":"06f75b6b290cfd3c9d94bccea86cecab","sha1":"b8a5653002c4c5d17713976f023b8b13611ff8cb","sha256":"6295910c6e7d7e15708ce98c4da16e16c802b52626d098cbfab7ce27742c9762","sha512":"a3aecfbcf6852c768ed8ac6753219a5d0872817d82519e831947cd076ce5bf6b9132790ce2e405fe4ba617af357317220bb65ff89f5ecc5045cfc9798ff1d13b","ssdeep":"","tlshash":"80c0c04ce0809193c7008137e936c080130e0b768cd07ff378778283703012164438cd","first_seen":"2025-10-27T01:41:27.092574Z","last_seen":"2026-01-11T06:27:23.976351Z","times_seen":3,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/Footer.png","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/Footer.png HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 217\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-d9\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":217,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 940 x 4, 8-bit colormap, non-interlaced","md5":"2c1e960be434484d65c1c3dd924d51a7","sha1":"9090b4ed86afa396c330aafebbdc54777018c10b","sha256":"642679b7b78dfbc64ed2407b52ca9cb412b4b2965554a594b48c206a9bfae8a7","sha512":"f10acc8c0cd5b72a69d1bb5c0eec4a7b6af8e155bf1fc5f273bd39215babce615181117daf5ad49585caed679cf2b12d247820076c01c3948edf6b456e26ecfb","ssdeep":"","tlshash":"70d023f5bf45cc4cc15602a314de6171e4571b2a8d159ba39ddacd42d73d144c090785","first_seen":"2025-10-27T01:41:27.078388Z","last_seen":"2026-01-11T06:27:23.981579Z","times_seen":3,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":409,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/images/geekgicon.gif","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:27:02.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/images/geekgicon.gif HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/templates/vip2mb00004/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:27:02 GMT\r\ncontent-type: image/gif\r\ncontent-length: 766\r\nlast-modified: Thu, 06 Sep 2018 03:43:40 GMT\r\netag: \"5b90a26c-2fe\"\r\nexpires: Tue, 10 Feb 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":766,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 22 x 21","md5":"64f56ef876ec28a3834a81f67b068682","sha1":"4e8f8798a988159bc475d08f8d377a740c33c8da","sha256":"8c1e5f3da5212655a625a8484de4fd143854307033be2aa92961bc191be057c9","sha512":"682ecb76b28afd742e15d35273e58a76ea3409436ce6e34b70094353b014155db250e5cb89d3dab9ac46e96fa929e79aba97775cb898cc182c339da5eeb3270e","ssdeep":"","tlshash":"7d0160f7fc20c550f355a4b9583c3665042d8f853c7de0208e902a0a252c32cbcbbb82","first_seen":"2025-10-27T01:41:27.077287Z","last_seen":"2026-01-11T06:27:23.983837Z","times_seen":3,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/templates/vip2mb00004/style/swiper.min.css","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /templates/vip2mb00004/style/swiper.min.css HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D; expires=Sun, 11-Jan-2026 06:27:59 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14015,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (14004)","md5":"42a7b3b0e356d5d4b9a29a40e77f3dc8","sha1":"669df5ba901266814a7db67da57cc498433612d2","sha256":"2e6ab360427637e592549154e6fae3bd663ea67df74b1d6ee66c9fa7be573d23","sha512":"56af3fb6e844a7f9d8d2d23e2bccd124de60f88dd9b6b5064470dc99ad64edc761a7d2c6b5ea115a12c05e7a71575cb5ab71feb8801ce35a8841a59365ab6671","ssdeep":"384:3Ubeo7zOqgx9BUsm/XHCXif65W/1mXA82FHy8:kbr7zOlbDm/XHwif65W/1mXA82FX","tlshash":"4152236417003837f3774f6e46a1e6b59f60cc838a934dadb2c0dd44d6fa8b9122eb95","first_seen":"2023-05-13T21:20:52Z","last_seen":"2026-08-05T21:36:10.53254Z","times_seen":585,"resource_available":false,"data":null}},"time_used":2980,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2980,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/index.php?act=api\u0026aid=1","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /index.php?act=api\u0026aid=1 HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A2%7D; expires=Sun, 11-Jan-2026 06:27:59 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T03:01:06.849517Z","times_seen":17735808,"resource_available":true,"data":null}},"time_used":2980,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2980,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwsallet.com/uploads/allimg/250430/1-250430142324-53.jpg","fqdn":"trustwsallet.com","domain":"trustwsallet.com","tld":"com"},"ip":{"addr":"156.243.14.54","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwsallet.com/","date":"2026-01-11T06:26:59.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 18:04:20 GMT","end":"Mon, 23 Feb 2026 18:04:19 GMT"},"fingerprint":{"sha1":"C2:72:B5:96:B1:BE:39:BA:A8:95:89:37:8E:7E:4A:07:8E:73:1F:11","sha256":"5D:8F:89:A2:57:BA:71:43:4D:8E:33:0C:A3:D7:92:1B:A3:CE:B8:73:D7:E6:01:19:BD:E6:DE:AD:0C:4C:9C:23"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-53.jpg HTTP/1.1\r\nHost: trustwsallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwsallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1768112818%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 11 Jan 2026 06:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-17f12\"\r\nexpires: Tue, 10 Feb 2026 06:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":98066,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x720, components 3","md5":"496f1790bcd586dd26fc8b9500366121","sha1":"58e19279360e9dea1588c4bc84f5de07e76413a3","sha256":"4fc5824a5cda76338d16c9c9eebdac0bbd4cc1e6c6c9b1176e0c5f49ceb8e76e","sha512":"0e2999897359f11da3f6320506ab1a4a8451594475b53361123329d3b15cd2a9eaca6f88650575ed4df81757203b4cbbe72dbe2fe78b110dd2900c9b542052e5","ssdeep":"1536:lp54PC/ZseXBzhQPMkI17LgUe+lC9J7deiRRMIyHtAtXQry6SAptewfyP/prq:H54PIYEk4/e9xeoqIyNHSA/XaP/prq","tlshash":"9aa302271b7427e6f2742ef47f63eba56e6a70a773903686f042300d9d72b892905f44","first_seen":"2025-09-03T17:25:24.696075Z","last_seen":"2026-04-06T08:28:59.299918Z","times_seen":40,"resource_available":false,"data":null}},"time_used":2265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2265,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-11","alert":"Sinkholed","trigger":"trustwsallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}