{"report_id":"2d503ba7-609e-49f3-acc2-f7c20f1ceb0c","version":0,"status":"done","tags":["suspicious"],"date":"2026-08-23T18:22:37Z","url":{"schema":"http","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"172.67.147.116","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"title":"Claim | Lab","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"172.67.147.116","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-27T18:22:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":7}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Medium.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Regular.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Bold.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/favicon.ico","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"stake.lab.pro","ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2025-05-27","domain_rank":0,"first_seen":"2026-08-18T02:43:09.194678Z","last_seen":"2026-08-18T02:43:09.194678Z","alert_count":0,"request_count":4,"received_data":137236,"sent_data":2181,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"ipwho.is","ip":{"addr":"172.66.175.107","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-29","domain_rank":18239,"first_seen":"2020-06-08T11:52:47Z","last_seen":"2026-08-18T22:32:03.944428Z","alert_count":0,"request_count":1,"received_data":941,"sent_data":443,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-08-16T23:03:23.649094Z","alert_count":0,"request_count":1,"received_data":14927,"sent_data":543,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"tokenop.xyz","ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":54,"request_count":24,"received_data":8809212,"sent_data":11663,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-08-19T23:49:39.202732Z","alert_count":0,"request_count":2,"received_data":724,"sent_data":1165,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"cc446d5e09a51c9cd728c679f15967f3","sha1":"8c5b6c86302321276d508b9dd41d6e66a49cff9b","sha256":"eaa8e19e095aa5103d3ab5896b6c545fac18e5b866c0725597fc522b15873390","sha512":"3dab85eaf3b6707913080516f20d2b4b21a387e5db88ddaf414fb01f6e3ba7a45436ed3e873a3c4c4664e055bec0b894734651b54e2b695e4e2d58382e22eef1","ssdeep":"48:Bt3RT0iLCZXEEt4k7On0KbMVUsPD2gxV2dgcBelfloWuqFfoWp:97k7O0KA+U2gxMdgcBeYWRAWp","tlshash":"c391dc8d82fe0b712957b4b827cbb1683236d05b2590da463e8d43450f8936e86f5bdf","size":4306,"data":"","first_seen":"2026-08-18T02:43:16.211731Z","last_seen":"2026-08-23T18:22:51.315254Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a97d6ef5abced657bf5d46b969b239da","sha1":"212f1fc55f39b82d41e88c7628aec3b33d263afc","sha256":"fd3d3ea23ebc1d6ff9299cbe2cc651dfcd714b9be828c8ca2a81540e2f85eaf9","sha512":"6f35480a04c1360f72ae3d1dec34f1357b49fb10a7c7e6de8124e33a87b075127206686daa9145d40be27c4dd761f078d085a1f2538567c714ede67f66122c7c","ssdeep":"192:7mmQewTVPeY8DpuTM3kpVg9LuKXgnudSWXLPKPIlH4SjmnUYsCc0V02Y2pE2XuCh:7mmQewTYY8Fb3kjgTtLPKPIJgcx0V02l","tlshash":"8732c5b06a242ad911d604e20ace4f5d74f591611179dc249b3ef28a2fec3cab7d37a1","size":11308,"data":"","first_seen":"2025-08-01T04:17:54.885074Z","last_seen":"2026-08-23T18:22:51.316016Z","times_seen":1626,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/e8d8a62e-e59e-4be2-b5f3-d296728ef507","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ccc56909d51e22e4a66d10a635815caa","sha1":"861d46c2db23bb852cc2990b9075d4f1725ba65a","sha256":"76588963ee837f84c0b7d1425e81b4cd8e82b32800dfcd9ffcf79e65258d2cb3","sha512":"b488bed96679f65a399badd3d4a011724e420894af3c5bfbd45314fd2eb482e21cf7508c3a74d79f91327ac679c41a0b02fe1b9b73b4aeb885b618d4047c42cc","ssdeep":"3072:i/K6lOvE4CqAfWGcNQ5YFxU1a905wvENwo20ACgKwL5eToDDvL/roado:i/Ki8XNQWq1s05JNw5CgKwL5eUhdo","tlshash":"bff4f89da44f3336ce5d27aa41abe880dc14bd528acc2456f49cdf917788e63e3d612c","size":772719,"data":"","first_seen":"2026-08-23T18:22:51.317526Z","last_seen":"2026-08-23T18:22:51.317526Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-23T20:16:39.809836Z","times_seen":92702,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f278e1582a6b32d6a9a05328bba73b0f","sha1":"02780b645a044990e49787663d3dba06626b1e3d","sha256":"07317dc90130ec69ed8e07a8362168074f9067473354101f361449cff37110aa","sha512":"08463b63ba1654bf203117d8f0c0a2ce4b5d92914ffba7c8ac3d942ff1a812c86cc61d9e840e5f3422c2b22d1b71b1a06b9a6d40d4e4259b32fd8cd40cc8357f","ssdeep":"","tlshash":"55319948a43216904242e8f1c676abeeabe774080574446d349cbec7eff8447e521678","size":1529,"data":"","first_seen":"2025-08-01T04:16:24.221852Z","last_seen":"2026-08-23T18:22:51.320791Z","times_seen":3499,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1e21743cd2ee2004cd56bfc5c29e3609","sha1":"bf516634ffbcfd3186b71dafc0ecdcc47894c439","sha256":"0e428980439e794b176e0ee3cd84e4878510b1d52c1efc1c00f4af9729a17029","sha512":"4264e5ce5b4f3acb24046582388132a5915398c9266c18c6349d75fb94bd74bac990dc6ebd12e1e118a3a24752a3e4badae2faabd69b9827d1f223a0750da4c2","ssdeep":"48:atoyTqSsM+c69M+c69M+c69M+c60778KK7NaaM//M+A:atlDNDNDNDl778KKw//M+A","tlshash":"25913f32165427da63ce8fd45a85751d01d2c89a383e60bdff3279eded3a683c031612","size":4506,"data":"","first_seen":"2025-08-01T04:16:24.215618Z","last_seen":"2026-08-23T18:22:51.323216Z","times_seen":3454,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"59a13eef9e5e0ec7844e58e8b47d54a0","sha1":"0fb2b2059a878b87f8524284d448dd46a4351953","sha256":"c890c150b008d069bfddb86ee2c2e3fe979515939053b4c53fd6853b68e4fe35","sha512":"7fcdb614d30b1141e9a1e134a98e2888007f786f866c24e6383106d3e003f094e72901aa295e7d3450fccf5a249b25b436401a5b9439205da6b0eec8d72cfc80","ssdeep":"","tlshash":"33f0beaf336126ca23ae6ad20796c01d1e72e4ab3002163c575a36ca0cb6f52521b07e","size":494,"data":"","first_seen":"2025-08-01T04:17:54.874483Z","last_seen":"2026-08-23T18:22:51.324236Z","times_seen":3281,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/jquery.min.js","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"90660c8b8e24d13932b4d1f79cbb2451","sha1":"9fd570a328662fc5648c4c4433ac6b52bd72c3dd","sha256":"212d0e0b838138d6911931ac47fe366f52e9e6686f72e044904d84eb69fe23ce","sha512":"5451dc8fc8013f77536127fef16501d7434307322a5b37742069ef52ce41363042084cbf450dc1f28927793eee6fee4bc8da43558a23264655e2842c09bdf1b5","ssdeep":"1536:/XjhjfKMB/ZqxiE4RyzgFTMd8vkkIuyDHVHjQXkU0XDsRJ0:/jh+oWiwzAQdayDHVDjXoRJ0","tlshash":"0fe3c7ca1906d4d65e6521dec4b3f809e0648e63ceadf057e62ddcc1752efa2849323b","size":155134,"data":"","first_seen":"2026-07-23T14:05:56.310836Z","last_seen":"2026-08-23T18:22:51.29674Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e1ee9f442371606d9a13b41a0dbeaff","sha1":"a05c25c8ad9127fe7d45319ce13e8b4a485d2e01","sha256":"713285cbc0cb910dfd2e7a86c604d191a27789ae50964ab1c674507ff4a20c45","sha512":"1dbac9fa1e0b338e780a3600f1a3da140a6c83a961a1d0c6c80fe3dc5a9041c346c471d264a07ccc87457cdccc2a28b768d02283512ba9cee0fc2e2b7124e42d","ssdeep":"","tlshash":"0221fedeb2826488526794d742cd8dceb8e617a919008c20452ef299225c3e8fb6ad54","size":1177,"data":"","first_seen":"2025-08-01T04:16:24.218288Z","last_seen":"2026-08-23T18:22:51.326147Z","times_seen":3391,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/00a0ba97-0ee3-4b3c-8d0f-974de98567b1","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f08d13b23fb4bddf9d9d59f9456cd35","sha1":"bc9ccd185e609ccf57c4717fe6e6b8b9e4ea2f02","sha256":"35e7e3dae7e76e16f989a3f9334664165fc7598c1c570cf1601efe390de6aa1e","sha512":"08f30fd7faa83ef59011b5278a625d06f96a841aba1303b83cd748ca40176cb0743752c1ac93e2af9655c32fa1e2f7d146c2ef2aa072433b4347d65b5ad53031","ssdeep":"49152:UYU7OwPEZJsS5wW2QUSvhjG+EyY4bfO3xrQanJfCpszVt5P:UYo","tlshash":"8af523c22c93e9a68f48435171fb5e0b54950d43989da0fbe3a4f9c1347cfa681eb91e","size":3446665,"data":"","first_seen":"2026-08-23T18:22:51.327722Z","last_seen":"2026-08-23T18:22:51.327722Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"6c84edbaf545a14aa5d7ccfc1300ac96","sha1":"b08bb4b4161e1a0712fe974748a1a592ec9f000a","sha256":"70784541f39081254e28c1c574a3ab66c20a622eabe25f2433231a0602ecc917","sha512":"b2170da294717caf171652dfa0dc25a9d558c1bf44aef70ad7af27360199dd3ebb3d6995ba2c1462fcae6ac9be0f3ed04580c70f9d6e66741c9c4d6d7754552a","ssdeep":"49152:vQK7OwPEZJsSZwW2QUSvhjG+EyY4bfO3xrQanJfCpszVt5T:vQS","tlshash":"85f533422c53a9b68f8c535171eb6f0b55990d43989da0cfe3a4f9c0347dfa281eb91e","size":3442170,"data":"","first_seen":"2026-08-23T18:22:51.331858Z","last_seen":"2026-08-23T18:22:51.331858Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3433c9d3e9b7e8e5b34ed72e309db572","sha1":"d53d7df082088749c1df6b08330ee9b9e4076932","sha256":"1d96fa9904e3743570bccd5be90e83fd91975299f374093cc6f723673d582dd1","sha512":"ffd0e047331871f21738643968b7eb7fa045ee0e45346a9ea986c4b8a3e745dd310542c6b2734f6d244408bba6548ec66f5cd7662c69485b5e59e3b9432cdff2","ssdeep":"","tlshash":"06f04245bd825a24d35670ddc41f978cc53690dd91491c4cbb64ece1de94c2cdfc6534","size":585,"data":"","first_seen":"2025-08-01T04:16:24.219641Z","last_seen":"2026-08-23T18:22:51.334646Z","times_seen":3537,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"ca9907f9269d59088215ac7dde3d4bc3","sha1":"c5279417f28cb5311b9758e8718a379dcd7607f8","sha256":"18d0ea3573281ff2f3268c41b00751fa5581c7ffffc4d1595e4026cba7bddde1","sha512":"c6d968fba0ba38f1f7608a8712b8947b54fa54482fdedeafd146672fd326fd5efebd0182bd87b68b76191f3c2bbaec3b14f5c011d8bdb0e81b5844c1a8613557","ssdeep":"1536:oZDqjvqJQGF9xGzGhV+DmNkmIuyDLlVpjIxkU03jq1vM:wDMvqJQK9xGzEIDKUDLzJf321vM","tlshash":"b8e3b5c91a06d4d19e6222dec4b3f409e1248e23ceadf1a7e52ddcc1756dfa2849713b","size":150176,"data":"","first_seen":"2026-07-23T14:05:56.323298Z","last_seen":"2026-08-23T18:22:51.336007Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2380d391cf784bce2f77e0e16fa2268b","sha1":"2b88cb08e3d7f56772d46fe1a10d84774e8728d5","sha256":"e65fcff70fe965f3d1878fe515a7ebcd265dfe61b15461521450c882e8d081d7","sha512":"0f3264af3a045928be20d2ee1ef3af905571d07e3fc25eaeda22199baca89b8c9bff94d90d81124ff45b16c5e40df291c2f49d9464ba901d2d961f6fd1196f1f","ssdeep":"","tlshash":"e6411b1e00aa0aa31ba3054333ce846d0956c2cedcc73534d3b27f8134c67832a93bea","size":2254,"data":"","first_seen":"2025-08-01T04:17:54.882582Z","last_seen":"2026-08-23T18:22:51.339343Z","times_seen":3322,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Telegram:map[actor:server1.conn0.watcher17.process7//obj23 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[kind:Object ownProperties:map[description:map[configurable:true enumerable:true value:Logged out writable:true] error_code:map[configurable:true enumerable:true value:400 writable:true] ok:map[configurable:true enumerable:true value:false writable:true]] ownPropertiesLength:3] sealed:false type:object]","filename":"https://tokenop.xyz/","line_number":110,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/bc2cc01c-a45bd5a263e5dd56.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.060Z","timestamp":1787509307060,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/bc2cc01c-a45bd5a263e5dd56.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-293d7\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Ud9eo81SZ1fMEeC%2FBYDBr%2Fyl8edc2oyjvTZaIi8%2B%2BBXvAOt%2BmB%2B9BMrxy0xFopThZYE%2FvFJC5UtKLlzuv7Fdlaq%2F8nZuibnyx4vdv7eGAga5ApZ6tANieA1toJM0A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff6042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 168919\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/_ssgManifest.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.066Z","timestamp":1787509307066,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/_ssgManifest.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\netag: \"6a7fc0de-4d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LyLA00wILMExtyDLFAH1IOfVBcXoJBKN%2FZcd955OqPmOoVK79tWw44VseZDOBd3OEd3fDb%2FPS674ngytM%2FfICjikc51zuBfHC7duKLvN13kI3ibUb23gM%2BSjFlWRtg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ffc042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 77\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-23T18:21:46.501Z","timestamp":1787509306501,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:46 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 03:14:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 257826\r\npriority: u=0,i\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xVztQImbRYxYZzv42zUUzVJ%2FGntM4Olp%2FOMECndmbFG4mXS8PWyXwmSq2n%2BQMzkw3GdV%2BwksxhfRMNO%2BUmnFbCVeGt7aSPdMkeUhB4RqDIFMZ7TBRZpE80qwjPa7xA%3D%3D\"}]}\r\ncf-ray: a2fc238def81042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1025989,"size_decoded":77486,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (431)","md5":"be7368d8ee4f92f55f0f6a40f8c84b3a","sha1":"3f0cb18b544a72b47e2faf0f6d13562b22a05635","sha256":"c705968d0434bdbaf06216052ad5c9eaad09571a015ef84b7f1c29f1a30ccc23","sha512":"18c8d9f87e558eae68bba5c5fb3620aa6d08f2f2e7a9799bbd92d1a1a0402940dfeec5c805f7ecbcfa67152e343040039db41d06b11e051fcf30f0e9abb886f5","ssdeep":"1536:QluJvWQRXzuSBSXbZZAzQvTBFnhQJYhCRYjaVSpEGM6MyxmcJ8jwFKopRfjS/mLF:9Xzutbnr+eZr+9r+X","tlshash":"a225442f167712607e43a13c1bff1284a234d403e94adc6d7ede5684cf9a398bd92789","first_seen":"2026-08-18T02:43:16.179699Z","last_seen":"2026-08-23T18:22:51.295862Z","times_seen":3,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":6,"connect":30,"send":0,"wait":35,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"tokenop.xyz/jquery.min.js","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.044Z","timestamp":1787509307044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /jquery.min.js HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 17:42:28 GMT\r\netag: W/\"6a5faf84-25dfe\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 634\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y5xhx9i0qqDpDFQhhfl8emg7hkRssrLwyHcDyp7M2rO4%2FMYEwK5xiIHvgbSNSpaoZ4Iwo4txMkJXP6QYGZhDlgakf1XF2EW21%2BjSOmxj9JHoYLP9ZCZdUL8LbiuQpQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a2fc23910fea042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155134,"size_decoded":44377,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"90660c8b8e24d13932b4d1f79cbb2451","sha1":"9fd570a328662fc5648c4c4433ac6b52bd72c3dd","sha256":"212d0e0b838138d6911931ac47fe366f52e9e6686f72e044904d84eb69fe23ce","sha512":"5451dc8fc8013f77536127fef16501d7434307322a5b37742069ef52ce41363042084cbf450dc1f28927793eee6fee4bc8da43558a23264655e2842c09bdf1b5","ssdeep":"1536:/XjhjfKMB/ZqxiE4RyzgFTMd8vkkIuyDHVHjQXkU0XDsRJ0:/jh+oWiwzAQdayDHVDjXoRJ0","tlshash":"0fe3c7ca1906d4d65e6521dec4b3f809e0648e63ceadf057e62ddcc1752efa2849323b","first_seen":"2026-07-23T14:05:56.310836Z","last_seen":"2026-08-23T18:22:51.29674Z","times_seen":26,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/801-f134190b1a90451b.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.062Z","timestamp":1787509307062,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/801-f134190b1a90451b.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\netag: \"6a7fc0de-12e27\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ayr5d92t%2FTrukz%2FxAuLC3XTS3l1PVE0rvOs4BD3phaXB%2FutEwU6nzdFBJCSArZOrp1hokVTJmP%2FKZ%2B4Ney0Uyte8Ql9GCawHdK1CSfzC8Wv7uki4jOW8eB74SkoHCQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff8042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 77351\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/index-65374920bd83a30f.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.063Z","timestamp":1787509307063,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/index-65374920bd83a30f.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\netag: \"6a7fc0de-1e343\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2xw9gv2SONkkWZQp%2BToLPxUVTl4CsK55l0CagkA0Gjd8ZhkXNpZwROY1qs7abDnB3HC4cHnMW1cHx6lQp1deAJvQZwwJ5jmre8H720smrE2ZZHG80npd5B1%2Fd15dyw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff9042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 123715\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/script.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.067Z","timestamp":1787509307067,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/script.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\netag: \"6a7fc0de-9bf\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OmOkiltCYHcmkd%2Br2%2BbLMlDAGETsClXkfnU98104mscRamOiw34uJ%2BpJwrpOZ2MTBv7lqBl3GCvKm4khAW231zpOPdbhoJiUIRcZCre5EtKa3yvqKmFJ7Yuog45gqw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ffe042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2495\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8788999322:AAHuuJMZHa-R6l_FB_M7zPPdOWF8HFDXpD0/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.324Z","timestamp":1787509307324,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"POST /bot8788999322:AAHuuJMZHa-R6l_FB_M7zPPdOWF8HFDXpD0/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nContent-Type: application/json\r\nContent-Length: 182\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":182,"data":"{\"chat_id\":\"-1003706392935\",\"text\":\"🔔 New Website Visitor\\n\\n🔗 Full URL: https://tokenop.xyz/\\n🌍 Country: Norway\\n🌐 IP: 195.64.118.152\\n📱 Device: Windows PC, Firefox\"}"}},"response":{"raw":"HTTP/2 400 \r\nserver: nginx/1.30.1\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/json\r\ncontent-length: 56\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56,"size_decoded":390,"mime_type":"application/json","magic":"JSON text data","md5":"d948d5845276032d39194409db9ad97b","sha1":"475fe4e71224df85d494e34e0cb8ed799afcdb0d","sha256":"a0a1e0f24b392c6da875c10977d169497a47f669b7e671e62330e125a56721fb","sha512":"3e538a78d85dc32eb47db705c97d627ed8851f6dd87904e2e39aa1d5357cdeaea2a7746fc2ccddbde9bcbcab66ddcceff4ab5cf8db169c49e0f81c592104c67f","ssdeep":"","tlshash":"22900244098ed56744da11605935954855b756b8641964404d95611d56421ea58f240a","first_seen":"2023-07-28T20:34:41Z","last_seen":"2026-08-23T18:22:51.298991Z","times_seen":478,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/e613f993-fa197cf910aeaf1f.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.059Z","timestamp":1787509307059,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/e613f993-fa197cf910aeaf1f.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-27d55\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rvYcKdgNM5D%2BI%2BKBnZCI0eopuz1HDyrpM2%2BmFABf5D33%2BaN98ylvAxT5MoVqItnwwltEwmwJG6fPmR7crEthdF%2FPppWWT%2B4HHSMNgGbwPgJJ7VMHh7SmY5wQne%2BMKw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff5042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 163157\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/fonts/Rubik/static/Rubik-Medium.ttf","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.246Z","timestamp":1787509307246,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Medium.ttf HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/Stake%20_%20Lab_files/83210ab95f315cd2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 03:14:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 634\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0JhAoeILtRegK%2BUCLgmo9PztgFZE%2FxAHhl1fX8%2FRc8Ii%2BnlusrrrrdnpLWMzHHqh36akWQvlgsi%2FYMlWi9lCRo0TotZHzT89LFwEEIx6BVzlo6F0tCZh7RrjJRk%2FCw%3D%3D\"}]}\r\ncf-ray: a2fc2392483c042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1025989,"size_decoded":77508,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (431)","md5":"be7368d8ee4f92f55f0f6a40f8c84b3a","sha1":"3f0cb18b544a72b47e2faf0f6d13562b22a05635","sha256":"c705968d0434bdbaf06216052ad5c9eaad09571a015ef84b7f1c29f1a30ccc23","sha512":"18c8d9f87e558eae68bba5c5fb3620aa6d08f2f2e7a9799bbd92d1a1a0402940dfeec5c805f7ecbcfa67152e343040039db41d06b11e051fcf30f0e9abb886f5","ssdeep":"1536:QluJvWQRXzuSBSXbZZAzQvTBFnhQJYhCRYjaVSpEGM6MyxmcJ8jwFKopRfjS/mLF:9Xzutbnr+eZr+9r+X","tlshash":"a225442f167712607e43a13c1bff1284a234d403e94adc6d7ede5684cf9a398bd92789","first_seen":"2026-08-18T02:43:16.179699Z","last_seen":"2026-08-23T18:22:51.295862Z","times_seen":3,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Medium.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/null?e=jscdn/getFile","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.294Z","timestamp":1787509307294,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"POST /null?e=jscdn/getFile HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"i654mfhc04mrhtzahifc\"}"}},"response":{"raw":"HTTP/3 405 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/html\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DODcztQVnOamO%2FOXFPD8cmv5wJgFEl8RhpB7cxkeGOKY6cIK%2BJuLoLNEmuxyI8R0Jm7yT00tVPKQOZktu3UVROi%2BQZcvwta5NNIpITTbgaIiCPE6wa0Xy4zhRMP%2BaA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2fc23929848042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":166,"size_decoded":931,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"d5ce8ba8dcf98117e9329c3419a8298a","sha1":"fde2a01dc50e1858314b5572887549e2bc2b19b7","sha256":"0e3ae3475a519a5c9f23858c084d3bcd133111e4f42234e99bf09652c5fd937f","sha512":"98f2673ba8d2e2afa175cfd09e401dedd0e5bbb09a0c20aa3c7395343a79a605ac6b2d5af83d7e2f46586de4e0444e0fa86c9641edd26d0e75db4292fabc4f3b","ssdeep":"","tlshash":"17c08c6e271b3c48c66321742ac3f4b0c28e92a284f84300a444005331c32269acbb51","first_seen":"2024-04-28T11:50:49Z","last_seen":"2026-08-23T18:22:51.301156Z","times_seen":166,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/secureproxy?e=jscdn/getFile","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.432Z","timestamp":1787509307432,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"i654mfhc04mrhtzahifc\"}"}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R8HR7m%2BfwkwiXcG31csgMy9%2FvgOIr%2Bsz8VsyGIW0RKC5f3vC1dIw2e8iqdtxqMBsc%2FgAIEXj4gPcjqpfOXmCovODgLr8zECgNBHRNQDeorb4dT2WGguFokV8HSKNpwQn%2BIWYrGk%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: a2fc23937863042d-CPH\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3446665,"size_decoded":2660873,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6be1020a4a7502558d9769070ebbbc30","sha1":"fdb3bc78733f193dcdc8a94ea6b83dfea6afeed1","sha256":"c42e7b03e09f8743e12fa3da0b5dcc8a8673dafbfe47207e126c70ec75b9aafa","sha512":"81df8415536cb8165b7f9ff1c44252e309d4f918ddf457be290cbb41a469be7fa24cc04e8118033c827bcb175fc1a7d9d69beb47a786ee7d5cc1fc8425fa5124","ssdeep":"24576:tURrYUV8/8Yae0PgGswPpBroS7InwbjtsJshJuEbdfE:UYU7OwPEZJsK","tlshash":"5a2523d21d93eaa94f4ca6a174fb6e0765805f43448c50ffd962ecc021b877581eda8f","first_seen":"2026-08-23T18:22:51.302726Z","last_seen":"2026-08-23T18:22:51.302726Z","times_seen":1,"resource_available":false,"data":null}},"time_used":958,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":646,"receive":312,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/143-150e409b47eba017.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.061Z","timestamp":1787509307061,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/143-150e409b47eba017.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-17c12b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RWmPhBoU3tLPevIeN8qL2hSn67KUTd23UMph3T0wc%2BB8jjlaaQDxgDt%2F8tra8RXsKHsiT9aOBoxXqftp%2Bka68OWAl6wHjqt8gzcpzn4VU5Vs%2BsGihNAhXLtE8kt%2FcQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff7042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1556779\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/x-logo.svg","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.250Z","timestamp":1787509307250,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/x-logo.svg HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WkKp17PvI%2Bm4a1%2FAYHo%2FR2y5KjNYCiXQ%2FFr%2Bnp9EKGRqAH4pl14PX9GQUHeHB3G6nLv2%2Bp3MT7h%2BEeLdAXx0oHTU9tT5gdfNMkqvk1JLhgnIUZzdaehzEesM6yc89w%3D%3D\"}]}\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a7fc0de-1b5\"\r\ncf-ray: a2fc2392583e042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":437,"size_decoded":1224,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f8f33053730b751de5c3c9be1808e5f8","sha1":"6566898a1f23564fcebc4d60fcfd49861078c6d1","sha256":"39b1ab706e3b0ec0c06232a9095507b00ddb29f7cfdd0987a7b7cf9d30e8bc72","sha512":"a6e623323ab73b767562adc12b84ee70329832bded22406a62c6c264bab5c299dfafb65e73a5bfb6974d2b69c694e6b74410927542ecd33593182cc81bff9bf2","ssdeep":"","tlshash":"2be0ab7b8b9cf6d9ba8c831a7c2e7070145c64e096794185e5a232439496756480fec7","first_seen":"2025-06-30T04:14:47.132371Z","last_seen":"2026-08-23T18:22:51.304272Z","times_seen":165,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/_app-3a50a7c5ec9b0c09.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.057Z","timestamp":1787509307057,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/_app-3a50a7c5ec9b0c09.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-50ef\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1%2BEXk4c34Gk3xrUKTFaMevt%2BEiXTvcsrqi%2BANxyKuQd1u%2BnpJk3x11UvNUOifJORjKV46E9DIgtBVhgrGhm7YXp9MJzaCuY2E3paY5Fa3wHMzykIAnDJTBXjcMNwPw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ff0042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20719\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/fonts/Rubik/static/Rubik-Regular.ttf","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.241Z","timestamp":1787509307241,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Regular.ttf HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/Stake%20_%20Lab_files/83210ab95f315cd2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 03:14:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 634\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=msPPcKdRxR3vVQtTl%2FJfb3aEvhbuhFK%2B0SNxBPFPi3FE9MwUYCMd69KPoJA3urS0EySzyaX1M6D2tT9eAsNzxX68ne0bsJf3n7Y1XbmK0q9CQGrFDBkp3oUjCrzQIw%3D%3D\"}]}\r\ncf-ray: a2fc23924839042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1025989,"size_decoded":77500,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (431)","md5":"be7368d8ee4f92f55f0f6a40f8c84b3a","sha1":"3f0cb18b544a72b47e2faf0f6d13562b22a05635","sha256":"c705968d0434bdbaf06216052ad5c9eaad09571a015ef84b7f1c29f1a30ccc23","sha512":"18c8d9f87e558eae68bba5c5fb3620aa6d08f2f2e7a9799bbd92d1a1a0402940dfeec5c805f7ecbcfa67152e343040039db41d06b11e051fcf30f0e9abb886f5","ssdeep":"1536:QluJvWQRXzuSBSXbZZAzQvTBFnhQJYhCRYjaVSpEGM6MyxmcJ8jwFKopRfjS/mLF:9Xzutbnr+eZr+9r+X","tlshash":"a225442f167712607e43a13c1bff1284a234d403e94adc6d7ede5684cf9a398bd92789","first_seen":"2026-08-18T02:43:16.179699Z","last_seen":"2026-08-23T18:22:51.295862Z","times_seen":3,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Regular.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stake.lab.pro/fonts/Rubik/static/Rubik-Medium.ttf","fqdn":"stake.lab.pro","domain":"lab.pro","tld":"pro"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.048Z","timestamp":1787509307048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stake.lab.pro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 08:38:31 GMT","end":"Fri, 13 Nov 2026 08:38:30 GMT"},"fingerprint":{"sha1":"F4:6D:7E:84:F8:A4:A8:2A:AC:5B:6B:58:F7:28:64:89:8A:01:5A:4A","sha256":"B7:08:69:99:EF:23:E2:EE:BA:87:F1:B1:F7:E2:6E:CB:F3:67:2D:94:46:12:07:8C:2E:E4:60:C4:1F:6B:04:03"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Medium.ttf HTTP/1.1\r\nHost: stake.lab.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 429 \r\ncache-control: private, no-store, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\nserver: Vercel\r\nx-vercel-challenge-token: 2.1787509307.60.Zjg0MjYwOWZhZjFmYjczYjE2YjFkYzEzZmFjMjgxNWU7NjBkNzM1ZDg7ODNlNWI5NWUzZDg3M2VhNmY3MjhiZDQ4YzQwZmNiYTQ2ZWIyNDM1NjszO8CzNrxhtEmTrXnOI8CKuNiayplZr3bKd7r4BkngzmN7I4lZaZ43FckaXBTVv9s=.b8aeda4c0efb52038b7626fa1cd6bef5\r\nx-vercel-id: arn1::1787509307-6SiT40ldxKf68vXoDb9WeNqO2f7Vf0uL\r\nx-vercel-mitigated: challenge\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":33788,"size_decoded":34309,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (23364)","md5":"18213669d98b0a08e65e41a21b624907","sha1":"3c6827b413a5ed308d845bc1b65e34bfefba69b2","sha256":"bb3eb1d4faf3e39d64cf9a63304ce5c8eabe006f1a4fd4636ffb3bb41fd0a579","sha512":"d36bb398bbbd8194b7863178383d7fe36696210c38a7759f48769bbd5b1c930ef459bf31219f87f459811ce6a749770e796eb562bcc34c19451874a9e2e5bfcc","ssdeep":"768:Jt6dGZr+QU13K+U14XDISbBALd5wFWOGorjrXEn7xoESLO8mG7XM:Jt6yrjU13K+U1gzbBALHZOXrH09oESLw","tlshash":"0ae21980d708fc557252498e60fe0c292254f9a37606cba8ff91cdf6fba59806427f5e","first_seen":"2026-08-23T18:22:51.304948Z","last_seen":"2026-08-23T18:22:51.304948Z","times_seen":1,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":48,"connect":3,"send":0,"wait":20,"receive":0,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/83210ab95f315cd2.css","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.052Z","timestamp":1787509307052,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/83210ab95f315cd2.css HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: W/\"6a7fc0dc-8f1e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 634\r\npriority: u=0,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RUSzoAjlCrNy3RU0RY75lSBK2fKxPT2xl8Mr4d%2BOMYIst8rNknp5mFj6M0Qs9yaSRubDvIGswQ6xfIkc%2FSNSwZyYotsCQdyj2x5nAiLMi7cIQWqo%2FoT2tlFeTY2o%2FQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a2fc23911fec042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36638,"size_decoded":10336,"mime_type":"text/css","magic":"ASCII text, with very long lines (33593)","md5":"32e9fe0abf6a454a64b49fc4fde08f07","sha1":"5108a2e6cd04e1e1f79ad1fa1d3610a4cfbebf77","sha256":"e5b4ec9b9f41bb81c63a1107d9fd8acb4e2832718651138321fe4f16fc472fe1","sha512":"8b241032d23b9ec17fca3b15b2eb37d941db143d1b82b40199dbca3e693286b33a467da871e0afa20a101c365c8a944346c92341e722c69c1f99b8df6dd8f565","ssdeep":"384:ZuUbt0nAHWdBjEO03mZbz3eDuQAFoAk6045fqbt8Kx/yxrcYHSf:Zuct0AHs098FE6ye7xraf","tlshash":"88f2d85ce661453b6c3b44f6e298ba6d750bb5c1df394bebf602a51027d23fb18a3600","first_seen":"2026-08-18T02:43:16.200403Z","last_seen":"2026-08-23T18:22:51.30655Z","times_seen":3,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/framework-d02646141e04a9ce.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.055Z","timestamp":1787509307055,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/framework-d02646141e04a9ce.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-2c9fc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5qHEDPoRxSogryyI%2BaR4OEfaGmgmpY72jKhnNT%2B%2BQUZaYPlPIJ9JsKdXWHpTMtdo3x%2BGFV%2Fp8eTGS8cWUQM82c%2Bo%2B9vaehNHM6z%2FNVSuMgOcXDVYIupi7OefyZBdyw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23911fee042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 182780\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/fonts/Rubik/static/Rubik-Bold.ttf","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.244Z","timestamp":1787509307244,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Bold.ttf HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/Stake%20_%20Lab_files/83210ab95f315cd2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 03:14:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 634\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N42UKwpMHZHRtWXZQ3d%2BydjU68ruDBs3K0KrNKgAn4UCbFs83xYT7uuF%2FE3VAn1%2FESgFClYOG%2BdUI6tKTX743mDamCG26pF7eYH09255UXYMfuEPXp2ka6E%2BonN6WA%3D%3D\"}]}\r\ncf-ray: a2fc2392483b042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1025989,"size_decoded":77506,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (431)","md5":"be7368d8ee4f92f55f0f6a40f8c84b3a","sha1":"3f0cb18b544a72b47e2faf0f6d13562b22a05635","sha256":"c705968d0434bdbaf06216052ad5c9eaad09571a015ef84b7f1c29f1a30ccc23","sha512":"18c8d9f87e558eae68bba5c5fb3620aa6d08f2f2e7a9799bbd92d1a1a0402940dfeec5c805f7ecbcfa67152e343040039db41d06b11e051fcf30f0e9abb886f5","ssdeep":"1536:QluJvWQRXzuSBSXbZZAzQvTBFnhQJYhCRYjaVSpEGM6MyxmcJ8jwFKopRfjS/mLF:9Xzutbnr+eZr+9r+X","tlshash":"a225442f167712607e43a13c1bff1284a234d403e94adc6d7ede5684cf9a398bd92789","first_seen":"2026-08-18T02:43:16.179699Z","last_seen":"2026-08-23T18:22:51.295862Z","times_seen":3,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/fonts/Rubik/static/Rubik-Bold.ttf","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/discord.svg","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.251Z","timestamp":1787509307251,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/discord.svg HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bdSsQ6amnEkBSX7bJLC9F5gau%2BctbMyJVRJa9PDjhcSrYZQCNNkszx9EqBCg%2BWiGsmLpt6V1hQXcTD0Yr%2B%2BjoUhoIYzjMK5xP7IaPsQDemJOaOenujgvV0mdIz5HbA%3D%3D\"}]}\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a7fc0de-777\"\r\ncf-ray: a2fc2392583f042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1911,"size_decoded":1778,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"acbc396eea932dcf323a4a7b45d25ca5","sha1":"5892a37e0f8ef9451b5c141827e3726559c290ab","sha256":"65af5459119ebfea0282e65a00d2992e3d3c9f13c592cbcb5ee14da7b3427d72","sha512":"91077c698dbaf05137f579d40a0be0aa4d0c3c510decdf6adfd533ebc4314e1fdaa070b91f5ce15a23925bcb78dc532a38c071fb6567ddde59c2901b58e43a23","ssdeep":"","tlshash":"844112ebe6d9e7c0f0476bb0dd15db6979ae34f89b9acf8086319786d058949c40fc10","first_seen":"2025-06-30T04:14:47.157397Z","last_seen":"2026-08-23T18:22:51.307198Z","times_seen":6,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stake.lab.pro/fonts/Rubik/static/Rubik-Bold.ttf","fqdn":"stake.lab.pro","domain":"lab.pro","tld":"pro"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.051Z","timestamp":1787509307051,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stake.lab.pro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 08:38:31 GMT","end":"Fri, 13 Nov 2026 08:38:30 GMT"},"fingerprint":{"sha1":"F4:6D:7E:84:F8:A4:A8:2A:AC:5B:6B:58:F7:28:64:89:8A:01:5A:4A","sha256":"B7:08:69:99:EF:23:E2:EE:BA:87:F1:B1:F7:E2:6E:CB:F3:67:2D:94:46:12:07:8C:2E:E4:60:C4:1F:6B:04:03"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Bold.ttf HTTP/1.1\r\nHost: stake.lab.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 429 \r\ncache-control: private, no-store, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\nserver: Vercel\r\nx-vercel-challenge-token: 2.1787509307.60.Zjg0MjYwOWZhZjFmYjczYjE2YjFkYzEzZmFjMjgxNWU7ZjhkNmNhY2I7OGVkNmNkNjI5YzY1ZWExNGYwZjk1NTM5Y2I4NzQwMDI3MmE0YWEwODszO8CzNrxhtEmTrXnOI8CKuNiayplZr3bKd7r4BkngzmN7I4lZaZ43FckaXBTVv9s=.1b2de05591909510d982169c4d48a7f8\r\nx-vercel-id: arn1::1787509307-6SiT40ldxKf68vXoDb9WeNqO2f7Vf0uL\r\nx-vercel-mitigated: challenge\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":33788,"size_decoded":34309,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (23364)","md5":"433c119b5cbfb869c3badc809d8a3ce0","sha1":"3e0e14dee00f6e806ea9feb4a1a4fd3312f70062","sha256":"71bd2845dbbcba3749607d07dfcf3efa8d82bfc2bd0d2d93e56ba920b79c9b20","sha512":"0b67981466a3002fb30712e79f57645df2cc05aca3cf6ec83e28617f6acb206a8e3491753d1a0c23c5b4294b0a6ecd2d123266d3542db326c65c0c86827c85a3","ssdeep":"768:Jt6dGZr+QU13K+U14XDISbBALd5wFWOGorjrXEn7xoESLO5XTG7XM:Jt6yrjU13K+U1gzbBALHZOXrH09oESLO","tlshash":"54e20980d708fc157252498e60fe0c292254e9a3b606dba8ff91cdf6ffa59806417f5e","first_seen":"2026-08-23T18:22:51.307896Z","last_seen":"2026-08-23T18:22:51.307896Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":45,"connect":3,"send":0,"wait":15,"receive":0,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/webpack-0cca1d9c376d2754.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.054Z","timestamp":1787509307054,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/webpack-0cca1d9c376d2754.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-10c0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B6D07M8pa19In1XF1qHpPIS6jHhuEdXtea9WQ%2BmvC1ba4lRdt5X8EcXlnlk59wEeYR%2FDgE7jCDQhhjhamguGyg%2FRTmsvHN%2FQoS5DD4OEP%2FNxJa8D8gcGGCcaG2uy9A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23911fed042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4288\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipwho.is/","fqdn":"ipwho.is","domain":"ipwho.is","tld":"is"},"ip":{"addr":"172.66.175.107","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.183Z","timestamp":1787509307183,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipwho.is","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 17:11:12 GMT","end":"Mon, 02 Nov 2026 18:11:07 GMT"},"fingerprint":{"sha1":"5E:E2:C3:89:78:64:9F:D1:72:38:82:CE:9A:64:52:5E:6F:BC:2E:8D","sha256":"84:35:87:FA:FA:70:1B:FD:E9:C4:CE:E2:2B:E4:BB:4E:2A:1E:20:D4:9B:99:4B:F6:FC:3E:CE:8B:56:FD:9F:30"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipwho.is\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/json; charset=utf-8\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a2fc2392396be1bb-RIX\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":638,"size_decoded":718,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9b4377b9e6c0d9740cdc35026f2cc0b7","sha1":"b20c30ff2e74b92c429dda872a0f1b5c03a52e54","sha256":"9792c57511ae767e24192193a3cfa3cf088d3e478d44016bf688bc044ac4dedf","sha512":"95e9694954fe1fb5412932cf8f93e67027828c60e40d152e94abdf6d2b475f4d9fd5daee99ce904e2c668cd86a78635f74d59819b9f3a7848f775a900606bd91","ssdeep":"","tlshash":"cff02d21019c7e0e86af438a20cef90a26bc2017d2c2a18ac8fc5a94c1c42ee708016f","first_seen":"2026-08-02T22:12:00.58064Z","last_seen":"2026-08-23T18:22:51.309108Z","times_seen":490,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":0,"dns":15,"connect":39,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8788999322:AAHuuJMZHa-R6l_FB_M7zPPdOWF8HFDXpD0/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.329Z","timestamp":1787509307329,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8788999322:AAHuuJMZHa-R6l_FB_M7zPPdOWF8HFDXpD0/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":1,"connect":22,"send":0,"wait":23,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stake.lab.pro/fonts/Rubik/static/Rubik-SemiBold.ttf","fqdn":"stake.lab.pro","domain":"lab.pro","tld":"pro"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.049Z","timestamp":1787509307049,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stake.lab.pro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 08:38:31 GMT","end":"Fri, 13 Nov 2026 08:38:30 GMT"},"fingerprint":{"sha1":"F4:6D:7E:84:F8:A4:A8:2A:AC:5B:6B:58:F7:28:64:89:8A:01:5A:4A","sha256":"B7:08:69:99:EF:23:E2:EE:BA:87:F1:B1:F7:E2:6E:CB:F3:67:2D:94:46:12:07:8C:2E:E4:60:C4:1F:6B:04:03"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-SemiBold.ttf HTTP/1.1\r\nHost: stake.lab.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 429 \r\ncache-control: private, no-store, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\nserver: Vercel\r\nx-vercel-challenge-token: 2.1787509307.60.Zjg0MjYwOWZhZjFmYjczYjE2YjFkYzEzZmFjMjgxNWU7NDg0NWFhY2M7NmY0Y2RiNmViMmJkZmNmNjA2YTZkNDFjMDczY2Q0MTBiYjhhNzRiNTszO8CzNrxhtEmTrXnOI8CKuNiayplZr3bKd7r4BkngzmN7I4lZaZ43FckaXBTVv9s=.4239d4291091fd7e51df53d4319269f0\r\nx-vercel-id: arn1::1787509307-6SiT40ldxKf68vXoDb9WeNqO2f7Vf0uL\r\nx-vercel-mitigated: challenge\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":33788,"size_decoded":34309,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (23364)","md5":"215c9c78a39c494c153d3f0a1c0540b4","sha1":"2fe7afd50704a98f795134b1486c732a265085ea","sha256":"fd094f69cd1b011de5b5a746f12bee81bb0cd30f7a19c7deffcee3b146aa3502","sha512":"72268c198ad0ba1d7ad9a5709a77121e7e2d65cc649c942a91b3d33e8d177c88d1b2be91ccdaaadfd23d6a664fc2cdf3fa05cc65586ec263d4baec8b79e458f4","ssdeep":"768:Jt6dGZr+QU13K+U14XDISbBALd5wFWOGorjrXEn7xoESLOt1PG7XM:Jt6yrjU13K+U1gzbBALHZOXrH09oESLE","tlshash":"6de20980d708fc557252498e60fe0c292254f9a37606cba8ff91cdf6fba59806427f5e","first_seen":"2026-08-23T18:22:51.309778Z","last_seen":"2026-08-23T18:22:51.309778Z","times_seen":1,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":47,"connect":3,"send":0,"wait":19,"receive":0,"ssl":234},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/main-fa8fedb3d7029654.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.056Z","timestamp":1787509307056,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/main-fa8fedb3d7029654.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:00 GMT\r\netag: \"6a7fc0dc-1ba28\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hgKegrBXmPyDGPI4VFIbAT0lT7S%2Fdtpr2c9CVwWbdvLiUQlbaMwrK4Gf4teW%2FkgjJPJqYdyLToki8szUUAiu6nC7oZ0DDcV2lokAv4Q%2FyUQ8MY2zdLiyoX4%2FL1zm%2FA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23911fef042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 113192\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/_buildManifest.js.download","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.065Z","timestamp":1787509307065,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/_buildManifest.js.download HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\netag: \"6a7fc0de-1c4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cZ9Eouc4dGxrR89DmWztmGVItWVgrl%2Bgw%2FBUSR2L7yJUt1tl6PhHalGKqaKxKF7p1HwQiV3U5C8eAA4vMjbzXCc4A7VsounhTCuNGOzaB7J7qg%2Fim7X7B0v4fPIVyA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2fc23912ffb042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-23T20:40:39.331699Z","times_seen":18061082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fontsource/dm-sans/files/dm-sans-latin-400-normal.woff2","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.242Z","timestamp":1787509307242,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/@fontsource/dm-sans/files/dm-sans-latin-400-normal.woff2 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: font/woff2\r\nx-jsd-version: 5.2.8\r\nx-jsd-version-type: version\r\netag: W/\"3778-fPihwUbFN/KHGQYBbTcAfGHH/mw\"\r\naccept-ranges: bytes\r\nage: 26641\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\nx-served-by: cache-fra-etou8220112-FRA, cache-bma-essb1270035-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 14200\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14200,"size_decoded":14927,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14200, version 1.0","md5":"a220a32881ae190f4784c437c1e467e0","sha1":"7cf8a1c146c537f2871906016d37007c61c7fe6c","sha256":"4ab51eb2cd7305d177187908d6397474d4520663f6c6e572feb0a64f4fa80006","sha512":"bf6503a157d8bb1c221812e845136fdfc4344e3c67802023647b0ff9be233ef2a1035a0a188e0a3612911b695cc142f5d8a874e27a0ec51da7b2a120f78c8e2e","ssdeep":"384:Po4q0QKjXsVLZ0e3mUS+4to3EXf/S5IXxVlU:Q4bFcVL4Uh4W3AHNBVlU","tlshash":"b852d1cded244eeec1744676038cc21996a9f36326f1b955bd90bf86937a8145f043b3","first_seen":"2025-09-12T00:51:45.933668Z","last_seen":"2026-08-23T20:27:39.904143Z","times_seen":3048,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":3,"connect":9,"send":0,"wait":12,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/Stake%20_%20Lab_files/lab-logo-wl.svg","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.249Z","timestamp":1787509307249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /Stake%20_%20Lab_files/lab-logo-wl.svg HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 15 Aug 2026 01:29:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jD3Cb0M4n6nxmdHvP53nReYo%2Fqn8%2B8xetrJx128LpH1H%2FAlEPrqfTWo8toXwnXgz8GAVV5BZ8K4JRgfTr0NpZW%2Bm7AxYyMPqacjH%2BWUvP8wGL%2BOOQkc2grqSz1%2B%2F7A%3D%3D\"}]}\r\nage: 634\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a7fc0de-3d08\"\r\ncf-ray: a2fc2392583d042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15624,"size_decoded":4754,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a7e48e730cf526afba6a8f6ba2857a47","sha1":"fe9fd3d1a80d867ef79f626a59d41fb77b2785b3","sha256":"e0abf3a8aa6cbfdc1adb9c4040d6d47b4c4eb4529ab3f8f25afe801aac837ae9","sha512":"f09484c8060ef0f6054915d0e1bf515ef8305011e1d8d71da34f3891caaf5ff012159f0949d025bce8fddc106f27d5b66fc695aec47bb116726843f97cf09ce5","ssdeep":"384:pazy+sfcZB/jmvaAcahRnheLh4ahzgh48hzD:pVt0vmX","tlshash":"fe6274fd7b55eced5c81c360ea9948d06b2fe1bab1110109dc0e6bb5a01acc6f61b7d8","first_seen":"2025-10-21T08:15:18.096655Z","last_seen":"2026-08-23T18:22:51.31293Z","times_seen":4,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tokenop.xyz/favicon.ico","fqdn":"tokenop.xyz","domain":"tokenop.xyz","tld":"xyz"},"ip":{"addr":"104.21.55.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.553Z","timestamp":1787509307553,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tokenop.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 17 Aug 2026 00:34:00 GMT","end":"Sun, 15 Nov 2026 01:32:49 GMT"},"fingerprint":{"sha1":"4B:11:76:42:55:34:DF:4C:BF:A2:F8:BF:B3:A3:73:27:BD:2D:59:F3","sha256":"AE:08:42:7E:E5:8A:D0:F0:51:0C:90:E0:96:34:E0:C0:2D:BF:6A:3D:D7:5E:ED:25:85:4C:66:6E:76:68:B5:E1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tokenop.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tokenop.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 15 Aug 2026 03:14:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 634\r\npriority: u=6,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k1XNAJNno1Ry8qnPF%2BwRIuzje6mOZ3eQoQdQiiouyNyWDAlUrhyFLwSnt2PiRBy4KAWcTDpVGismsycIb5cG%2B%2BVkbpCj5eL%2B9NquqCAS4CF3odZx%2BJuh%2FD5lZ2lr7g%3D%3D\"}]}\r\ncf-ray: a2fc2394388b042d-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1025989,"size_decoded":77488,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (431)","md5":"be7368d8ee4f92f55f0f6a40f8c84b3a","sha1":"3f0cb18b544a72b47e2faf0f6d13562b22a05635","sha256":"c705968d0434bdbaf06216052ad5c9eaad09571a015ef84b7f1c29f1a30ccc23","sha512":"18c8d9f87e558eae68bba5c5fb3620aa6d08f2f2e7a9799bbd92d1a1a0402940dfeec5c805f7ecbcfa67152e343040039db41d06b11e051fcf30f0e9abb886f5","ssdeep":"1536:QluJvWQRXzuSBSXbZZAzQvTBFnhQJYhCRYjaVSpEGM6MyxmcJ8jwFKopRfjS/mLF:9Xzutbnr+eZr+9r+X","tlshash":"a225442f167712607e43a13c1bff1284a234d403e94adc6d7ede5684cf9a398bd92789","first_seen":"2026-08-18T02:43:16.179699Z","last_seen":"2026-08-23T18:22:51.295862Z","times_seen":3,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-23","alert":"Detects file containing Telegram Bot API","trigger":"tokenop.xyz/favicon.ico","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-23","alert":"Phishing Block","trigger":"tokenop.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-23","alert":"Sinkholed","trigger":"tokenop.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stake.lab.pro/fonts/Rubik/static/Rubik-Regular.ttf","fqdn":"stake.lab.pro","domain":"lab.pro","tld":"pro"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tokenop.xyz/","date":"2026-08-23T18:21:47.046Z","timestamp":1787509307046,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stake.lab.pro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 08:38:31 GMT","end":"Fri, 13 Nov 2026 08:38:30 GMT"},"fingerprint":{"sha1":"F4:6D:7E:84:F8:A4:A8:2A:AC:5B:6B:58:F7:28:64:89:8A:01:5A:4A","sha256":"B7:08:69:99:EF:23:E2:EE:BA:87:F1:B1:F7:E2:6E:CB:F3:67:2D:94:46:12:07:8C:2E:E4:60:C4:1F:6B:04:03"}}},"request":{"raw":"GET /fonts/Rubik/static/Rubik-Regular.ttf HTTP/1.1\r\nHost: stake.lab.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tokenop.xyz/\r\nOrigin: https://tokenop.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 429 \r\ncache-control: private, no-store, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\nserver: Vercel\r\nx-vercel-challenge-token: 2.1787509307.60.Zjg0MjYwOWZhZjFmYjczYjE2YjFkYzEzZmFjMjgxNWU7NGUzOGNmZWI7M2U3MzA4ZDQ2NWE0NmEzNDExMTQ5MDQ2OWMzYTE2MTIzNDYxZDgwZTszO8CzNrxhtEmTrXnOI8CKuNiayplZr3bKd7r4BkngzmN7I4lZaZ43FckaXBTVv9s=.6ea6b0a457550572172f528baeef647d\r\nx-vercel-id: arn1::1787509307-6SiT40ldxKf68vXoDb9WeNqO2f7Vf0uL\r\nx-vercel-mitigated: challenge\r\ndate: Sun, 23 Aug 2026 18:21:47 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":33788,"size_decoded":34309,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (23364)","md5":"5db74f63db71cd9a11307afa001eb7c8","sha1":"e4b7451b3802fff4c48e3d582e0f1564748b4b56","sha256":"ab29d3e5a43a21bda08af24294ac9d003637ca847834cb67195ae73ac8ce2312","sha512":"768cf68ffca1fca5da141add8ebb18a4070a208c11166edfc20166950491428c3e6bad75e0c531a0bbc54b56a8e195e7292b572640ad8024437fadf173a50602","ssdeep":"768:Jt6dGZr+QU13K+U14XDISbBALd5wFWOGorjrXEn7xoESLOUBG7XM:Jt6yrjU13K+U1gzbBALHZOXrH09oESLV","tlshash":"1ce20980d708fc557252498e60ff0c292254e9a37606cba8ff91cdf6fba59806427f5e","first_seen":"2026-08-23T18:22:51.313664Z","last_seen":"2026-08-23T18:22:51.313664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":50,"connect":1,"send":0,"wait":20,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}