{"report_id":"32d7e49f-c6af-44a3-9c77-60114748be65","version":6,"status":"done","tags":[],"date":"2026-02-08T15:25:14Z","url":{"schema":"http","addr":"nexo-drops.com","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"104.21.84.228","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"nexo-drops.com/","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"title":"Nexo: Your Wealth Platform for Digital Assets","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"nexo-drops.com","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"104.21.84.228","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-15T15:25:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"nexo-drops.com","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-07","domain_rank":0,"first_seen":"2026-02-08T14:59:30.470125Z","last_seen":"2026-02-08T14:59:30.470125Z","alert_count":48,"request_count":24,"received_data":5176036,"sent_data":11133,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"nexo.com","ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1998-08-22","domain_rank":51388,"first_seen":"2015-10-29T19:10:01Z","last_seen":"2026-02-08T14:59:30.974435Z","alert_count":0,"request_count":5,"received_data":570936,"sent_data":2564,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"nexo-drops.com/","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"fa89e001dd5648af147c82fe3e4f0a04","sha1":"c79e48c5c10cde20e3b34a862d1659f97cf9b9df","sha256":"b9d44f47e04fe81fbf4996cdcdb6b83aa2d91837ade46c382560bd180b987b50","sha512":"2b806806cc1e992b9f1563ebc57a4d65672759f170c224bd0738e97f97295dba5855ed99e901453f3f566932df7822e7c19e068793495d8d866b55e47df009c2","ssdeep":"1536:lf67GtWxtWlwl0+8PkQKOLuoJQRx2vRnHCSm:FtWxtWT+8PHKOuCHu","tlshash":"6ca3d8d9190ad0d0ae9624ded473ea06e0240d13cd7ef163aa2cedc0789dfa6d947277","size":99430,"data":"","first_seen":"2026-02-08T14:59:38.270159Z","last_seen":"2026-02-13T20:42:24.441263Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-06-03T14:16:15.147553Z","times_seen":3139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/solid-20.2.2.min.js","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"702ddc402f5b5a38ac4277d96a33f4a5","sha1":"1e865eb9c88cb8e27c0e7c43333267b08b76484b","sha256":"c338585ca32dfda146fab43f06c633a0352e6e2b8aaed26248b93e6156c2a216","sha512":"ab48bc20114872cff84abde26b803bd25036e4c81ff5a282da6aae156abe771117096226cb280f1b3c428cf0062d868233a4bec66df2a13e5fc04713aeacd088","ssdeep":"1536:Sfiv8tWttW9klw+ojWAz6a/rIr+b5pN/QCO0t:OtWttW3+o6AHFt","tlshash":"89a3c6da1946c0d5ae9510ded073e90ae0680953cdaef053eb2cecc9b49efa69447337","size":103570,"data":"","first_seen":"2026-02-08T14:59:38.220322Z","last_seen":"2026-02-13T20:42:24.404371Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nexo-drops.com/","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-08T15:24:49.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cXvyqxrn2nv56tdOXSevo1JN2B2OuMMAxT50UEbTkg5Wb1Udgi7T08TgbJP2LHbJbwR%2FK4UAHPmWtEf9PvjPHyYEK2nNd74EvuPMew%3D%3D\"}]}\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cac22d98e0156bf-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":382649,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (43730)","md5":"ba7396eac538a1de88b1e4b2e81fbe36","sha1":"9a121d8a37c8a3dbf462d305b7f7cc04951cc39e","sha256":"51b81def949dcd957cd2c8935356ecd9807ff3cfc4c4e973ce28f3f6bd887e6d","sha512":"cb7428e516a7bfd07b22c4dfdfccfad2bbd676fedacd6ba0a16989d394ce6cc277b9057f42c8d04efa1fc6ac3b3490a90861dc88f00e57c296ae1cf34b39117e","ssdeep":"3072:etO31XeRSD4MrPHsycKaRyNKaYN3nWbfAFjDK+TcDMOu7U+sjTcuMCOYCQ5hDucS:AhsjTLvpCADuUu","tlshash":"bd84e8b76690232ee2838799e5227b587022e95ffe338ddcf24c437057cdae98d15648","first_seen":"2026-02-08T14:59:38.240192Z","last_seen":"2026-02-08T15:25:16.048716Z","times_seen":4,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":36,"dns":15,"connect":1,"send":0,"wait":29,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/49c334581b960a10.css","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /49c334581b960a10.css HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: W/\"69868e75-1240c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B%2F713lecT3OIXTTaH9eBsk%2BSqE1pSWj1d5PtnE7CFSLgnHd5x3Vo3Q43HO%2FVLpb0drSIMrlBQyqmLCApQn%2BTQ4uNvCc0Uc%2FMca%2BkhCWm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fa40daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74764,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (63243)","md5":"124a291da10a60f9dbf1247cbecd8e46","sha1":"d0fbce5a00e56869d764008e873cf1302dc3e64d","sha256":"090c0b5162b9d1a5799553c10cc42e51146ea5291825479bbcf44e6e70e6502d","sha512":"f52e0d07bb2b6fa4dacbb7502f0e9465dd4e971838edd53908232ede738163221ab99260fa962a2c3f88160c81386f10b60b912dd43177547a100a83dddc9ff5","ssdeep":"1536:GwpfUfOU66z91yhYEeeBq7PBbCJXoR2mp8oZG1Ic:Gw1UfL66z91yhYEeeBq7PB4w2mp8oZGH","tlshash":"9e73739e6f42013f6c6381f6d294ab9ca11bb0c1ef2616fbf99255018fd03f72d66624","first_seen":"2026-02-08T14:59:38.251195Z","last_seen":"2026-02-11T04:03:52.787107Z","times_seen":6,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/bootstrap.min.css","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /bootstrap.min.css HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\netag: W/\"69868e76-2e50\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B7GqxWrxlPkg0usNhc5dIvKulVE8C1iYhVC9lhx957CHBXmuqGzSKwGiWO9hCcBKe83EKB1Vn%2BQpX9d1%2FdgU6tSRom0L6ugvVXiF1xyS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fb10daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11856,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11763)","md5":"abc17162416e88c12c5a3033e53e4ef8","sha1":"36f905ddf0408d067afe32d0b006e0eccdc0ea24","sha256":"734ad0f82c4c4b7ed522616573c56f4ba29938cd2c311d92698145b0de7ddad2","sha512":"b189eba7a26a8174fecce7071dcb05c4d2876399587ef34b5ec456f6554c21b7a1d470eb4b2f5c8f31ed19851e32d41a0e6c304aadb3358ebe3b3c82fd3906ed","ssdeep":"96:e27fizipfmmURN0wbDT1aLVxiTw3T1c1biu1G1j1Gj1G+1+cn21+cEgD1+c1g1+R:e2Gif5Rxx23a5TMwJ1kXG1jw33p96","tlshash":"0c32dfe2832bfc6f9763301bccd2354d363a44759b62bacced8a19d643865e42763391","first_seen":"2025-09-26T18:44:58.800291Z","last_seen":"2026-06-08T04:42:14.359864Z","times_seen":2012,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/modal-exchange-cover-1.jpg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /modal-exchange-cover-1.jpg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 201421\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-312cd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y1NPadjzqGt5kBuSqq5AxVGuHpDQXpVcm37M%2BHrZBV8ngfCdwks8xrrO%2FWDbIpjGTafpNS9RyjDOg6Jr9%2FRa2ywg9574If3ck5O1gRzl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22dd5eca0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":201421,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"988850522737076891de094730defffe","sha1":"cf5169d38e382077c7d4bedddcf1a8abb7f3e146","sha256":"71c4c77512a9f7cfb8fbfaf96c3e66d412578733dc87f6c79e65853fbe5ba18a","sha512":"e92475a94365e81296d080c58066d28abc451b48c085d81a6caece67ca43e537b839583b74387cc7ba00169816e2ba20d194c47717413250791b7b30adaf1e18","ssdeep":"3072:lpvGIaa3ohiAcF1GeIvBRTAxB0CGMGpm30ZdkA1S3kkxO0tAVcEaqTOiTt:lgwog6jjT9M13jTQcDiTt","tlshash":"301412286822720af4dd333649c33738771361b0d3a5e5a5954e242898ebf899f71f5f","first_seen":"2026-02-08T14:59:38.261539Z","last_seen":"2026-03-18T23:37:37.434113Z","times_seen":10,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":8,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/a304e72db1b9eeb1-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/a304e72db1b9eeb1-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac22dd9aea56c1-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:27 GMT\r\netag: W/\"21d08-19c3cc63156\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1544\r\nset-cookie: __cf_bm=Y3kD1USzZ0V_nMM49p7rCIWVgjFajVkPOpaElhv5NQ0-1770564290-1.0.1.1-Y7Xc3PD89oh8F97T9W.9CeFMltpwtwnfBIF.smMR6bDkAC4x8hZsoVz6wryHo_HRKXR_oSD404xIDPTRWwgljIu1LKcc3gnceh7hUm21wqRDE0R1N_mDN4tY63o0NGoo; path=/; expires=Sun, 08-Feb-26 15:54:50 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":138504,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"4b1be56aba8f613af50d404818c0a400","sha1":"ecb0151e96be45e03fd43382c1621431861e3f34","sha256":"0928cfe0f4aa200fe2e2d3f35c5fc7c3c46637bba58fe5c424b517fa5d433072","sha512":"c5ce0ac0e8573d18212d47b668d7a1cb6308c7bc7350c5d55a8e972e11e604bd61be34a6ff8152eebc3c68fe22d2a18c44627b2178085f67b1d49717225d3472","ssdeep":"1536:WIi/iLAYEiiE8lOv5edcO5I+f3puAItHpZWzwP1BXAyCeB/7sfWP0rfqO7lEVGY:WI+idEZOR3+II5uAItH1BXAyB/IfWPoS","tlshash":"3bd34c17fb47c713c496ae399e21e331b77af5357f2b570fe6846620ac861808c6458d","first_seen":"2025-02-18T06:07:21.724693Z","last_seen":"2026-05-26T06:02:58.952484Z","times_seen":34,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/0ddfd6b1e257170f-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/0ddfd6b1e257170f-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac22dd9ae956c1-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:25 GMT\r\netag: W/\"21a8c-19c3cc627ee\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1544\r\nset-cookie: __cf_bm=v1IrK4d.cJLjTV340dR6wra7STU49OhWPUb.Da2y2Cw-1770564290-1.0.1.1-q8h5qsA_orD9fUZS70f1hKK40qcgEWTrjp6tMgBF3_wEVdwetKUv0XaHvSlfcT7Yk3m4XTWyroUFHYDDRy0oSWwLnAzf0Ny0m9cZE3Q7DN7hixadIuLwCV8yYWA1EEaS; path=/; expires=Sun, 08-Feb-26 15:54:50 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":137868,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"a55adfa82ace257bd61c26c2a86b8852","sha1":"f2ce5fdbff510c5fd8e138ab4d2f94d07b007039","sha256":"00c14d4ce441993e3413162f60a006701f53f8245922899f420e0ab32f02aa8f","sha512":"adb0eac7133d8d015fd5a8ffe1f54ad51b2155bac52ea7ac4c28c78b93a0a71a6b682354f71f07e162f9d7abedff97051296fae1a05d31fae41b7b3873b27084","ssdeep":"1536:v3a/iLAuTFylGEj29ggA2QB7gVWh26egbsEFaYVYK2JTIgZO:vWidT9OtgAjXhAgoEFa74","tlshash":"afd34a47f74bc70ad5d6ae358e62e338b775f9387f2f170baa445660ad870948c24388","first_seen":"2025-02-18T06:07:21.695785Z","last_seen":"2026-05-26T06:02:58.919711Z","times_seen":32,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":13,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/lockup-black.png","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /lockup-black.png HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 2529\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-9e1\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MKuU0fRrsyftmHuiqdRiYAad%2FbqGlXtuoVevxhQLw%2FVXnVaoT9sS9RpX%2Fdg6xjxcXqiujabU%2BVcy%2FPKkv82Hfrvlt0rAvdwAr52e5NF8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fb70daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2529,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 64, 8-bit colormap, non-interlaced","md5":"a2e4901710adebed7d73afe1d8d16761","sha1":"99667b4216f79b9c25054bb0837fabda9c79625b","sha256":"60a4170aa0956eb89b5f8beb65f6a93e0e8767588e544e65f01b34f827cece38","sha512":"0d76fe008470fc5dd60c7c860226f1902fdec1cfb6b586d1214b21b41a0924381a6ab4859f49559b991a7648d9ecd9dfb5184bf2bffd639dd6d7c8655bef875a","ssdeep":"","tlshash":"10512db3ed0f8a09c4d132f9a7d60ad26553b16a59a99f130314c95ad8508c8fc2380c","first_seen":"2025-02-18T06:07:21.68996Z","last_seen":"2026-05-26T06:02:58.924334Z","times_seen":35,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/favicon.ico","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=40MUjqZHzbDMLNma5Mew3m3XJt9KSwpAjaAc2R5RDV54a3jogzV1Jpv0810D0sq09Zc%2FwN5qFZlrExgxrwAN%2BiqsRsVZyrDtAhaxyd62\"}]}\r\netag: W/\"69868e76-1536\"\r\ncontent-encoding: br\r\ncf-ray: 9cac22df1bb20daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"ccda8df05e9a37b3131afd4d451b44ec","sha1":"ed9d0f9c4224fbd4c768be237b4b59f27f1b718c","sha256":"92842fc6c2f66b46f69458c14621fc2eca5d6c02d7937f9124fe8a3a9a55bc91","sha512":"a91f53c07b327c35864fe903acfe30afe2de3c26fdce1bdbf65842598b3a7b2fb19e54de27495519bf1e2a2bf7358561da16e931324e5b1112da4fe7efe4bc7e","ssdeep":"48:uZY/S81C1A58ZrvB0Ze/kPm3Cn8GaxOcBXmD:lSRu8ZrvBj/kuXG9","tlshash":"48b18900d99da8d2c0c976f6c655e5b12d2a2d3c6e2002260135ba7fad71e93ff6c1cc","first_seen":"2023-05-01T19:13:19Z","last_seen":"2026-06-08T10:09:18.365725Z","times_seen":3570,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/null?e=jscdn/getFile","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"POST /null?e=jscdn/getFile HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nexo-drops.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"t3crd54291xppjt18yec\"}"}},"response":{"raw":"HTTP/3 405 Method Not Allowed\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4FMx8TvjAIssQmbcUyc1mj5pdVWyPAcRRkPYBqpL1YtxD1iS%2BPzrbnwHCfqsBKRbCgBbxklZvtPLkyiV5PkBSRZC5FW%2F3WFccfDmwlkJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22e07fca0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":166,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"cc1936e6c20f6a866226130b869d9953","sha1":"65d15aaa085d0c6292e27fecd97ce7c90deb4ee6","sha256":"11f4864b57acc22316998d012efc32274ea8c3f3230acab7bc8ee576c594b203","sha512":"29d5ff85814c6470cd6665b01d1f2b4b9f2303605c922f6f685375875ad1aeb23d80d386497164fc8cdc713968557cbe55b55b8c571ae27dff53c55790f382d6","ssdeep":"","tlshash":"7dc08c6e271b3c48c6a321751ac3f4b0c29da2a284f847006844005331c32169acbb51","first_seen":"2023-04-11T14:00:01Z","last_seen":"2026-05-31T21:05:16.725468Z","times_seen":922,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/883ce2b13657fbbf.css","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /883ce2b13657fbbf.css HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: W/\"69868e75-4dcf\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vWv0AiwTm1nQP186JAQvXjdDevTPVPWs0fQuPpVi4P4XmRYRsuWatSBdSHqvxb%2BpZw4X8aEIpFyc3rfaq7Ern%2F92ogZgy0sv2ZxmU8%2F4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fa70daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19919,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19919), with no line terminators","md5":"5150a0ab5632871c7205e57ef92276bb","sha1":"fa4bb38c936b413d40ecbdec86fd3445289fa36b","sha256":"cb09d3c166cb72be4c9a1af9b1c5c88aab10bbe332b722fb5e7df69413352276","sha512":"c76ef579adbf0f98f66a1cf6243658404b30329634716e84d1121cf34bc1ddc54d215ea7b5b10349a1048606566c9c5e24d56eee758203028e3c1d5bf65ec4b6","ssdeep":"384:XgYPEug3xoys3EScVsI1OS76OutbI0pNpEncGYxRC0K5cu3k:XgYPEN3Wys0FsxS76ft00FPRD2c2k","tlshash":"0b9262dce68150321c4390bbd7dda40d952a61f0ee36aef7e5e2128d43c63e22ba3755","first_seen":"2026-01-01T20:02:11.555951Z","last_seen":"2026-03-04T18:41:36.541597Z","times_seen":12,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/042a00f4b3c474b9-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/042a00f4b3c474b9-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac22dd9ae756c1-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:25 GMT\r\netag: W/\"21e34-19c3cc62849\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1544\r\nset-cookie: __cf_bm=5vV68LmM1t8SvtBR5yMeXjq06i6qrUK_gYbgsYOLRqA-1770564290-1.0.1.1-AOlNSSFPffyK60Y2ZE2UwkTVLN1rpUeYL95QN1hVsH.ViPRmUFx0f4w7cz0IQqfxtAJ6Ez7cVMt8U1pGTKQ7Y2JbM_zVMFKprEcw1ZcmVs5OcR7jNlblQRvXlO1Ee1lh; path=/; expires=Sun, 08-Feb-26 15:54:50 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":138804,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"daa1324825c8ed8cc6e66ffa594f14bc","sha1":"9d5d73e867441c769e920fb2b0065d9538028b73","sha256":"624818e1ac54c05dc9ca0b266c020d54f82e7b56597b9890b075524b5f11831a","sha512":"4a1d2dc8ec668826e97726c84593da6bbf0362e28c100bc160d5b65abf50466725089da4473dbd11e53290a09cf6b4eb471b5ac92e5aae1c0f2d21f56fe3b24b","ssdeep":"1536:xzRA/iLAMgPUSDbEaAdKdwYV4Eh2TTiuRDKJRp0mFI/jHGs85JPz/bTe:hRwiebEZdKdwYWtiZSHSFC","tlshash":"b1d34b47f75ac316d1926e758e22e3317f79f834bf2b2b1fba415264ac8a4804c94798","first_seen":"2025-02-18T06:07:21.702351Z","last_seen":"2026-05-26T06:02:58.920547Z","times_seen":33,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":52,"dns":1,"connect":1,"send":0,"wait":32,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/e326cf415f11af9a-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.195Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/e326cf415f11af9a-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac22ddcb0f56c1-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:24 GMT\r\netag: W/\"230b4-19c3cc62557\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1544\r\nset-cookie: __cf_bm=Yl8_AXtvA3L1v_GiCz0llJJNNBnaImSyCslm3W8VrLU-1770564290-1.0.1.1-C1qedJMNtuXBCOQ.Kddo6A.wZveqWFOEBbcyRG6nlTxa5xWb7yVgS5DnFrFrxdK_1NooGc78CtUOgc_AJKKh0r0lFZ.I7K_KN4ry1nTiqpg8GXDMSXJK5.ZvUfpKrD8V; path=/; expires=Sun, 08-Feb-26 15:54:50 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":143540,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"fc57eb0147fd30086e477681a884b785","sha1":"983e237872df7276ae77d4325a4d9e3df60edc93","sha256":"d4fe3dfbfc9bbe84e11451d10862806198c4f68700d958f03b66a786327b5de9","sha512":"fdacba42b8f226245c815109bd8c3a5cefbcf3d2f495803a082eaa0e9018a6ee30e2b4cf9b828384e81c92c9515d24c423039c0641297bc68469b975cd0dfc96","ssdeep":"1536:wO3j/iLADD6G9XZwAQIkOZwuFIKI4rKm5bEAYEyWj4kZVvyGWIBIis1wF:TidG9CkPZEKhrr4kG9Q","tlshash":"14e3185bf797960ada835e759ea1e320bfa6fc31be3e571fb2404668f8c74518c01188","first_seen":"2025-02-18T06:07:21.711469Z","last_seen":"2026-05-26T06:02:58.935976Z","times_seen":34,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/home-atf_full-f1-d-01-02.jpg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /home-atf_full-f1-d-01-02.jpg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 213313\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\netag: \"69868e76-34141\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hzSrrxOoPfCd%2B48oPJRnLhigGeatMK9keZSM7vusitAqNDoYhOTOfG78KK%2BDSsMfaMo25V%2Bm3%2B4NwM2BwN9IRHPsLJIVmxClD6GvJzSq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22deeb120daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":213313,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3808x2128, components 3","md5":"f3b90c7071d461fce6d5c5b61ed3f898","sha1":"5d6923e4b9e2cea25f250d2c23be9df616304bbd","sha256":"8b197df5bc44e780d1ca742f895da0b3ee408acc60a85ae7103f24f20bb987b3","sha512":"73db0856347f8d0add2cb4fef3593d4624c9126309e447fb7d2ceaac0b20cbbd00628ae35d31858834532838835266ffd272dfbb2cfb38afe0d742c23e286f7c","ssdeep":"6144:A5kGQoF7njWlhW9zkhdgN5UWHYSXTYBy6o2VtH6:H7k7nMEzJN5U4pkBy6oSH6","tlshash":"49241263e6b8747ad11ecb35d1570f657bb272a68ebc1787f868c461b0d13ac2ca1680","first_seen":"2026-02-08T14:59:38.254477Z","last_seen":"2026-03-18T23:37:37.449507Z","times_seen":10,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/index_3.html","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-drops.com/index_1.html","date":"2026-02-08T15:24:50.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /index_3.html HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/index_1.html\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pLsUfW2ushLYudX6xFrcxaioLqUYZ4tzXyxEmLE4U24TgKe4OJozapeU5htdd4Ebw1nlDERT9WE6CCrtHDDYKq9XV6nyU49ZElaQ6b3X\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9cac22dfad4e0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":396,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"57302211dfbbe622631cb707b6159ad1","sha1":"53dbc10f8066403d874a604b132583fcef0a0cca","sha256":"957eb9f5943ffa20b1c955af0acfdeb114b28bdef53d8fa8546c4df2739e38c0","sha512":"2f7e051d2db698be106573bc3c0eec5a88052fe3febc937ef3b37f94559b3e4f24602df3100ed22fd7648b28c34d7cb78591554c9516ed12dbf310529e5f7bdd","ssdeep":"","tlshash":"74e0f1938311c807055667c13fd1f208400bff1ef5419c9079f594a8a8ee23ad416984","first_seen":"2026-02-08T14:59:38.255997Z","last_seen":"2026-02-11T04:03:52.772978Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/icon.svg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /icon.svg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VAV5u4xT4Z2DC5oH4nom2l8F1CB7MFoQPQ8qf4S9aXxVYMIgeAHw0mr3mSR3R1Nu1sc2XPL8%2BA5%2FPntXXunpVbiVE8ycQKtiqpOw7EJ1\"}]}\r\netag: W/\"69868e76-a20\"\r\ncontent-encoding: br\r\ncf-ray: 9cac22e15a5d0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2592,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"22e5e7b7216a73890c27e6503b71b045","sha1":"e318ba2412a1f3d583e758c1c3040314074cfa3b","sha256":"fd536f40970a0566ab94c776c83ca843ee2cb3aff9e9da374f99b3b1a672a818","sha512":"bb67c94eefc5fad7962ecd8b7175688d23296b5cc79b6037770bba391f1ddd719bfcf92032e3a4259655f2cc4d393eaf3604e8e9d94382228cde74508493a14f","ssdeep":"","tlshash":"e051a690237a73f8a011fbf8d63258babd2334d476259ca9c3618d14a002029dee88a6","first_seen":"2025-10-10T22:37:16.780392Z","last_seen":"2026-05-26T06:02:58.889666Z","times_seen":31,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/secureproxy?e=jscdn/getFile","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nexo-drops.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://nexo-drops.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"t3crd54291xppjt18yec\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:51 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YbHFqWkgmzb2yLojyXizNXQWSwCbr4kLmhoFWYODBesdXy7%2FSPnskVu5RJHGA1zkiiZwWpFpEfBLjgaipagZctfHGfJXD1wUDN469vu9%2BqjiOQ%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9cac22e24d240daa-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3414522,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"0b5e9d4efacaff3d8e26b68c7903e779","sha1":"9451c431bca12f38fdc4a8af1884ea2d38bc33ec","sha256":"4a78984c7303963658ef7ab7366fec37ffc58bb08d0434bd300a0f37b5b67cf2","sha512":"0e68e280049e7fad3350389a325a760de6c815777118785c4951e49479f474b5968d0bc0be5bdffe907b2522ca54001f2289dde7857d05a6e31a9ddf78e8d779","ssdeep":"24576:QOV8/8Yae0PgGswPpBroS7InwbjtsJshJuEbd2:QO7OwPEZJsw","tlshash":"f82523002d5bfcd94f8c7baab4fb2e0795405f4288cd50dbea25edc0256837542dea5e","first_seen":"2026-02-08T15:24:20.662606Z","last_seen":"2026-02-08T15:25:16.058183Z","times_seen":2,"resource_available":false,"data":null}},"time_used":658,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":296,"receive":362,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/01a4748c34ee3248.css","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /01a4748c34ee3248.css HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: W/\"69868e75-20a2\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5VAcv1XJAdQ0wTiN%2Fr1l%2FsN%2BRMjMYG16qKUTaQ0KlYYZkm5TP%2BKm9qw28gW%2FEqV2ZhqhpnkWbRqy%2Fp5cE9jPjFQWrmdwnOY9Vtz%2B82%2FL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1faa0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8354,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8354), with no line terminators","md5":"282aff559cf7ec6a79420ded0370ec99","sha1":"7134734c7f9c22fdc59f65e4509d2cede45605ec","sha256":"d5b5993255dbfcc3158ca9959808f858c36f87cadfa7c2c9129e9d9d8b744de5","sha512":"00530959fb3455065d7888fcd35bd789985362339fe9a71d1fbca64b1fc2c32d647f76957656015b3dd14a1015dad49bec7f77f70add873a85df4ed817ca1eb6","ssdeep":"192:jCsf6EsfZ0bQ6Z/Qz6xM6xxsfj2ysfq/85sfBUM:jPpJI/OM","tlshash":"6e027114e259903b1c63e0d5e7dd994d903e70c6ff3a3ebabb91018147c12fa2dab649","first_seen":"2026-01-01T20:02:11.552464Z","last_seen":"2026-03-04T18:41:36.502543Z","times_seen":12,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/index_4.html","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /index_4.html HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z651vU64lHIJ2vw6jE9m7bVDHICQc61KjdKJvXYw3F4R3dRZST1uxnArgd1b%2B8yVgxGVUxillfsty5gERCJjMG80vtfjNcj%2BMJCCk%2Baf\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9cac22dc9c4c0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":479,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b8b916caf9508aa0bcb27716bbf83168","sha1":"ccb37900753f6e79ab72b92a97ea4b5d7c583cb4","sha256":"3703f9e7452226474b8ba75cb4759d2a5d76b2f0b5ee52633c91d215f6f2e813","sha512":"8a3ca3a6a146ffec769d7756e59b810ad424ca3605dc6bd1362dace420fc98929b13fa963feeeb11aa1d9f3ef62424b78dcf48db91ce0c9296b2059a0a067ab5","ssdeep":"","tlshash":"85f05ca05114b40a220030c027c7f1de8243fe4ec900eca0f69c8184cfea338c493a94","first_seen":"2026-02-08T14:59:38.21818Z","last_seen":"2026-02-11T04:03:52.76571Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/index_2.html","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.025Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /index_2.html HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F7oHYAsmEEJbnlP7ZwJRfragBxfKbonbYmNjP%2FFxboxcgwwmvqkq7y1Gn%2BI6LKTxq4Km4QfH3FDLTKpy1b3%2BGqWmsE3pDA7Y8jv8a%2Bny\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9cac22dcac9f0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":144,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"c0043baabdf16fca37148f72e8555ae9","sha1":"2ef15aa1adc09bde0d07b36592914e0db26fc7d8","sha256":"fb6571d56760d1c18a9634d89797d272311844e5b92b7fc71c6f8da6743bd392","sha512":"99d092b1f8481246875dfc2c2114e4b437e491f63812b438ee7fbf02a24223fe27223351c2fe05afbdfa95cd4579dfd98e5efb7eb946d08a15250affc52b23cf","ssdeep":"","tlshash":"bfc08c229800480e29009e91cb8ae1c4c402dc2ce8215c00b862a144a9a8121c012548","first_seen":"2024-07-19T02:09:55Z","last_seen":"2026-06-08T08:50:10.173813Z","times_seen":223,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/navbar-private-clients.jpg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /navbar-private-clients.jpg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 26479\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-676f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VbXNc4S9gKWuBjKx2fck3TTV8GBp3%2B4xmzycOkjvsm%2BvwK9fdmINDBF1yZnqRkVIXf8uXdrA4FH881XaBchW4%2Fo1JbneNbBOilAsau4R\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22dd4e990daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26479,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 956x308, components 3","md5":"a608c210953764a9d30549756b15624f","sha1":"5b91f4a34f4fb1acf3648d76dbf2c6f120a59ca9","sha256":"32cc24106d5bf3e4b63a8a14adcdba47e15da61cef03a920404822a759cb12be","sha512":"185512e97406c2196de2f7823648fad32e50a84a996e9e3dec73ba32f5fc4db824469f2a71936ec249c0acfdb62550807ec5686587045fea2b3a8d630c625f8f","ssdeep":"384:dVNwmRW0E1cSbMulUfzzq9mZOKgiQMx2KKwupBDvIwKChnqwJLRkY0D:vWr2SbM1GBKgiJ/ufbKCxqIRT4","tlshash":"64c2e0de62030764fefaac36e55b15125639cbe258f89ccce3116410a3e85f6fe5b411","first_seen":"2026-02-08T14:59:38.259424Z","last_seen":"2026-02-11T04:03:52.771861Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/navbar-personal-loyalty-program.png","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /navbar-personal-loyalty-program.png HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 119525\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-1d2e5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bJ8DgTw1gr%2B9qipbJzAtTMDJzcYbfkhFL9Ad8zzy7%2BZnM5lGoS4TkQ%2FMk77m2ZnZegMyciVyxj7VcZSVFMrUPnmk%2FjalPk%2BiQngcykcQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22dd4e9b0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":119525,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 955 x 306, 8-bit/color RGBA, non-interlaced","md5":"ef9748ee1c83283609f4a788187fa160","sha1":"53e40dc81a1cf93d4cba75125726d68571ec6c4c","sha256":"47d931e6480414a8d5a4e53421364d8185ce2d01f7f2e7ed3726e9015fd8aa98","sha512":"731ffc435fd51b0e0406959896fc14942228360bf6e2bc5212d9b1158ed6c71f48ce3cbbf8106fa09da04bfa550ded1d0dc42abe35da34e294e23e948e6718b2","ssdeep":"3072:CDSJSpwDlaJrNmG9VT2ZL4aWc20WKYGVAi3SNTK:C+4uMJrNmCVSZLLWF0j4+","tlshash":"79c312b4f8803712ccf70193e128fc0a2da727d5ba46b61b7a065fb248a795487117bf","first_seen":"2026-02-08T14:59:38.238077Z","last_seen":"2026-02-11T04:03:52.780977Z","times_seen":6,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/modal-earn-cover-v02.jpg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /modal-earn-cover-v02.jpg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 197682\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-30432\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ro8NULLnxXMQaX70CXrQIXotbPZNoKtaIqYcNGxQm7r0XrDLhAqrhpaZq5720RYFyaTpBa4Q3qEd0O9xuX89eynzCWYss2oqf7q7GdCv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22dd5ec70daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":197682,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"e9a2360d686519b623fc826dc5f48e69","sha1":"1ff8b44303462d639c718778adfe8621df256305","sha256":"26d44df2d0f58a35ecbaa207c1a7ba0d27d77fb8fa9e9ca6198f3adb61428b44","sha512":"dc1b9c469b6dde4a7f43b661244ae7187f5f6695e160317e1908431a01cf54eb4e14a31184468bc2fc9de6a7ca7d49688eede027a59471b9f804faff2853c6e3","ssdeep":"6144:/3jPd3zco1SZQRijyhZzS9BTUWje9USsqGB:fhwo10QI2zzS9BT1K9xu","tlshash":"fd1412f34505f733f86f9bbe2587d2e5725a8cb329e12445933398b19284207ba5d4ce","first_seen":"2026-02-08T14:59:38.228244Z","last_seen":"2026-02-11T04:03:52.772451Z","times_seen":6,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":9,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/modal-card-cover-3.jpg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /modal-card-cover-3.jpg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 287734\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: \"69868e75-463f6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cw4jedcGcV7Pu5jbA4Y6kuhG6omEJBM9LHO5cSjqqK6sgPuVTpt6yB8EmTynteHtTTka6TSd2rc89ryWWGyhsXXBStV28IoRLIFjh%2BuU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22dd5ecd0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":287734,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"fa28c7cbe23457a382757592a9d49bf5","sha1":"44554c5c1c0ea5c1e8fc77147bc19e573ff6db1b","sha256":"2d5d6cfcf8368719b020858b316354357f9aeadf526b538193f5b7375fc9fec8","sha512":"12c04529f44ddbe37066389810d2f45100522d79f9227b0b3268f52af8d0413897b3faeee03ebeed7552474ab54756230306c60d21731b3ddc5b9476dc0acc72","ssdeep":"6144:y1kbUAOErJbqsNJBFikQHcdYoF0mzCzdI3Z2:yybUarUiJHxSH","tlshash":"ab54236da4bfbcccddce7930c56d8f4385a2d197c91c0986e9bbec0654692e1f61201b","first_seen":"2026-02-08T14:59:38.225944Z","last_seen":"2026-02-11T04:03:52.770056Z","times_seen":6,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":13,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/powered_by_logo.svg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /powered_by_logo.svg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 1544\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MkgVMRfpHAmlIwhWj8akdJz4O6Lxt9Pujh%2BydOvMIqRC%2FiT2xbQi5J%2FS4PP65INabTrbSQsZ2m05T9WJMdRrVrghtcAdznzJHP00BrQM\"}]}\r\netag: W/\"69868e75-144a\"\r\ncontent-encoding: br\r\ncf-ray: 9cac22db1fba0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5194,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"63e737d3544164d2b7f4fbca416ac807","sha1":"030370aa38715e4c41589633f69d0bfe8255d46c","sha256":"5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d","sha512":"31ee1bb536c0e50f5568a415ea3308367bfcfd11d2a6f7dff1c8e3a982f7be790c240a603cd4c6e187672824b8e5d07646049a28c6a88a7b001eb9a0142f312b","ssdeep":"96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV","tlshash":"93b1a9f5aa45d29c391e8984ce37a964551fb4eb7bfe83d06192d332e40ede0f900c18","first_seen":"2023-05-04T19:47:29Z","last_seen":"2026-06-08T10:34:02.270873Z","times_seen":119501,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/f1-digital-asset-partner.svg","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /f1-digital-asset-partner.svg HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=usJd20KQibFI6W6P9HlWpw662%2B4YcqEOsgG09cGAKm%2FsqBZhTB1VMagOAmapBuENFMW0%2FE59KeuGjdx9ju%2BbHTCB7%2Ff6KUbjMfK8%2BikR\"}]}\r\netag: W/\"69868e76-7bab\"\r\ncontent-encoding: br\r\ncf-ray: 9cac22deeb0c0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31659,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b84ec9730a3118729a6852f3a46cdfde","sha1":"c64e5edb945294566f9e7dc7fc8936ec088db577","sha256":"63d063f420a38317a54b18eaa8bc7a07c8e79d129db1a57017b3b7dcdf036fc5","sha512":"251d83ef6836cd0a7d322ad80477b2abd9de955508fb7e2c4096571f3cd273a1fb842ab761b3de2de27f7017d405a06295da373c1daac4e39d5a498ca234daeb","ssdeep":"768:JRTP3tWkTQMatysWEttPHztTDNf5GbXWIt:Jd8k09O/","tlshash":"95e295ee2ae45af4e845e2f6be1111dc381658bb7d86cf34c39d9f19389646c8e14cc2","first_seen":"2026-02-08T14:59:38.235836Z","last_seen":"2026-05-26T06:02:58.886243Z","times_seen":15,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/apple-icon.png?4749ef0a6ce1ccdc","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /apple-icon.png?4749ef0a6ce1ccdc HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: image/png\r\ncf-ray: 9cac22e15f0856c1-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\nx-nextjs-cache: HIT\r\ncache-control: public, max-age=31536000, immutable, no-transform\r\nlast-modified: Mon, 19 Jan 2026 16:02:07 GMT\r\ncf-cache-status: HIT\r\nage: 1725763\r\nset-cookie: __cf_bm=.DJ_z4VtW5.tJ.Ub3MIolHnPdkZGUJlEBxINGae0lns-1770564290-1.0.1.1-EQynegcCyI6bZUW83t1TlkUl9ARmY8j66SlNlLQPXgOFAVe9TUO3zyEik0CbQJFWrOGEdij2Zj7QJoS5llyRiyJ8Et5SMRxX9Gi9hg7npbJVEaeReD6K1BwvQp2oHAxE; path=/; expires=Sun, 08-Feb-26 15:54:50 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2000,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit colormap, non-interlaced","md5":"e6ea14fb6c7ae07d69896c0033b397e6","sha1":"888a7e3d4c71873ed4bf823a9688f7e3a7fdf17f","sha256":"0e84447c2c33d8657fa28614db2d73d44c23ab666dcea3fbda0043b605fca630","sha512":"279c25a60f2e447432e75422bfb7ee60e3067d5b7494ff45e1c9ec436ca3e832604801dee6dbbb977655605c3243b36aa9823752146c30fb5042fc68c5a067f2","ssdeep":"","tlshash":"a3412cb50a401e3ec55743b8ac02a90814b3ee504ef6754dfd16518c5be943a85f4d62","first_seen":"2025-10-10T22:37:16.828011Z","last_seen":"2026-05-14T12:58:31.952997Z","times_seen":30,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/684ff108e6721b29.css","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /684ff108e6721b29.css HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: W/\"69868e75-aa8e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sPSjGarCkzyUUJdngrKGDMm%2FmqBP29m5Tq14Zy3NWo0PSozLW8R5jdmsGGaVggGNDODT5%2Fhc5xkpLKYO%2Fh%2B6jtHCdYN%2BBNjB7ugV61A8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fa20daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43662,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (41550)","md5":"5352fa66d7e8b63ef51b4dbec558837d","sha1":"5d8a71a40ce6b72069f65b83cd9e007d0552d20d","sha256":"a56f265c9a5e705d9cc6347faf9c28e4e7d275b79895972673784f17fc3dee43","sha512":"0f2371532b21096229d13b1d2211414cf2a0fb9b10eda0b36684144bccb884489b188f7f2558951ba515f72bf153ae41086a6d68cca69b0fa053fcd4578dcdbe","ssdeep":"768:y1fDnOjQSyfD0YUqhqvpo06iXw29FZoe8jucp:ynX4iv1p","tlshash":"2613555ab140423bfed787b9e056b198b1266cc5fe379bd9e90256b082d93f32cd2344","first_seen":"2026-02-08T14:59:38.241778Z","last_seen":"2026-02-11T04:03:52.762328Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/solid-20.2.2.min.js","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:49.784Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /solid-20.2.2.min.js HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:49 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\netag: W/\"69868e75-19492\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GIgtG6k77PIKrvdw%2B82sLv2HmbPizwIozfnSWlIpxONMjHMNqFSwV8hsGLQ0Zg8kOmMvnICeqsZAcA5NQQRvEXvhpBH4AipWAceUeAxi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac22db1fb50daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":103570,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"702ddc402f5b5a38ac4277d96a33f4a5","sha1":"1e865eb9c88cb8e27c0e7c43333267b08b76484b","sha256":"c338585ca32dfda146fab43f06c633a0352e6e2b8aaed26248b93e6156c2a216","sha512":"ab48bc20114872cff84abde26b803bd25036e4c81ff5a282da6aae156abe771117096226cb280f1b3c428cf0062d868233a4bec66df2a13e5fc04713aeacd088","ssdeep":"1536:Sfiv8tWttW9klw+ojWAz6a/rIr+b5pN/QCO0t:OtWttW3+o6AHFt","tlshash":"89a3c6da1946c0d5ae9510ded073e90ae0680953cdaef053eb2cecc9b49efa69447337","first_seen":"2026-02-08T14:59:38.220322Z","last_seen":"2026-02-13T20:42:24.404371Z","times_seen":6,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-drops.com/index_1.html","fqdn":"nexo-drops.com","domain":"nexo-drops.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-drops.com/","date":"2026-02-08T15:24:50.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-drops.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:01:36 GMT","end":"Fri, 08 May 2026 01:00:20 GMT"},"fingerprint":{"sha1":"FE:C2:8E:D6:97:D0:4E:F4:60:E9:45:60:09:0B:C0:B7:41:86:8C:29","sha256":"C9:70:F9:6A:F0:86:0D:A8:76:FB:A1:6C:BF:C0:A5:A9:AF:71:C9:8B:E2:EF:5B:E7:0D:B3:80:64:01:17:60:B4"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: nexo-drops.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-drops.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 08 Feb 2026 15:24:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 00:59:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1543\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U1s%2BPrWs57xpokwCeNxLnYo2HeFWSuH9HrzkgCR9NtFY7%2BAns5iSV2dlJPUsOKKxFLgqFNSOc8kknHBYOXpNtbodJkzR2n3U0XLIWgy0\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9cac22dcac970daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":244,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"c7c1e01c73f0dfd877bfb32a6294af12","sha1":"0a51375bae31e5f8c47a105d33b67a05baf53c78","sha256":"b2dc1dab75ac996f2a3af7cdb627d970358fd59fb0f91277ac64b81ba690b571","sha512":"e3ba21ed856f2a3a9ab50a13e8ec65f8fa4436748f3d645566a778450f0162d5371329a0a20a5d82bdd57fc762f54c7a26277656ab6ad6db0dd8b03cbb708a75","ssdeep":"","tlshash":"14d09722d105480e98018ad2caeae2c8c443d82cfb106d24bcf23720a66c223842263c","first_seen":"2025-06-28T16:48:34.945511Z","last_seen":"2026-02-11T04:03:52.785057Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-drops.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}