{"report_id":"337a35bc-c79b-4670-a754-24fb32a25113","version":6,"status":"done","tags":[],"date":"2025-08-09T19:47:34Z","url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.64.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"title":"100,000,000 #XRP AIRDROP"},"submit":{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.64.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-13T19:47:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn-images-1.medium.com","ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1998-05-27","domain_rank":50146,"first_seen":"2015-07-26T08:44:52Z","last_seen":"2025-08-03T02:12:03.325513Z","alert_count":0,"request_count":2,"received_data":12342,"sent_data":1048,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"static.tumblr.com","ip":{"addr":"192.0.77.40","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"2006-06-08","domain_rank":26603,"first_seen":"2013-08-05T11:14:48Z","last_seen":"2025-08-07T05:35:07.44377Z","alert_count":0,"request_count":2,"received_data":588528,"sent_data":900,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"i.imgur.com","ip":{"addr":"199.232.192.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2009-01-09","domain_rank":5110,"first_seen":"2012-05-21T08:09:36Z","last_seen":"2025-08-07T11:09:40.503253Z","alert_count":0,"request_count":1,"received_data":47002,"sent_data":431,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"glyph.medium.com","ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1998-05-27","domain_rank":20082,"first_seen":"2017-08-01T13:23:25Z","last_seen":"2025-08-04T21:12:05.482073Z","alert_count":0,"request_count":2,"received_data":42495,"sent_data":1123,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"ripple.giving","ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-08","domain_rank":0,"first_seen":"2025-08-09T19:47:35.141142Z","last_seen":"2025-08-09T19:47:35.141142Z","alert_count":16,"request_count":16,"received_data":1073811,"sent_data":7047,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"58a2e2b6f62baf4acf398eb491a89a63","sha1":"5cd14eb473e584f624165b1a79480566c30945e2","sha256":"8d0bb4fc66bf2b960a1e305152bda9c92b07a1f57c0fcf378164d02063029aa2","sha512":"c015785f2c0572e98073288bf3def38d929ed6c229971722c843c71cb8eaad0bfa916001f2fe561c413c0ea5d88f2fb8ebd1e5bb9d7c4dadf75973adb1e83563","ssdeep":"","tlshash":"c0e0eb51b9cb986328a312ebe0333eab61a00539007654c80b1aa28caf780e130034bd","size":292,"data":"","first_seen":"2025-08-09T19:47:38.592302Z","last_seen":"2025-08-09T19:47:38.592302Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"822b23a0ca5c4caec80b7ae0a26fe6eb","sha1":"f6ef688a112acc3ad438eac11ecd71b0ac2c66de","sha256":"d03819cce200271218343c8deac7f6c27600deb5648aaf185e43212e3877958f","sha512":"39ec83e2d83df2d7e39c01e3c6b16669e3cb57e76367bb0fceb34e249374c748292213034957b9e881fcb591865b60e2ed6ca44c0221e8c176be81ba85e672b0","ssdeep":"","tlshash":"36b01264e5028af800332eb47dbc83507c3d9480f64a2a02f0fcb402e070c039c42ee0","size":109,"data":"","first_seen":"2025-05-29T12:37:23.557068Z","last_seen":"2025-09-08T04:26:18.726399Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a5758d2bc8833f1e9dca6a8c5aeaead0","sha1":"3967e0d20038a9ab67bf2e0cddf22ae87932dc48","sha256":"701110fee739fff5aa5b2629359cdb6620615584b8079e8eba24fc58f9687011","sha512":"3844f28325d07cc6ec9eaf64c7ec7e0cd809de640ec6118f4d70965b3c3d3a477cf7106f40f37756e2ffb47346e83edce009197df7e71f7d9ebfbed43f084266","ssdeep":"768:G2OEyU38GSyr+1YPzx4gp8PVgzKIZXvP1Cao/BqY:GJEy+81yK1YPWPubvc","tlshash":"08c2cf3ace63b60394bb57827c073986873c2247a83d34dd6eb84e1095c968a5b8757c","size":26983,"data":"","first_seen":"2025-07-26T22:19:45.20413Z","last_seen":"2026-07-20T23:12:24.090773Z","times_seen":2031,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"63822fc1aa7485dc9114b64b21aa6069","sha1":"ff4c15e1c6f07275aea0837ead21b99eb47af6c7","sha256":"1a088c630fefdfc6ef6ba10634e3170d0a3bb967f8432b01676195043265b7f9","sha512":"65c148e142dac456718cbb905253dd9ad8b9c8c6fcd578c340635f35aa4ac9dd84b20aab120c9ec3e30930bd14cda96fd4845cf0b18d0ce977431ee131ca1686","ssdeep":"12288:28iMPDIIY0WfzBJHpyif+XtVQ8q/C885Sp4YPp:rX8IYPLDHpySotVQppFp","tlshash":"18a4aeb63281aee75d2d2f16d9263ac8135926f3cfa5f0941c23bcc601b3b758763694","size":476307,"data":"","first_seen":"2025-08-09T19:47:38.595287Z","last_seen":"2025-08-09T19:47:38.595287Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"b1715833ba93c4393805ea3699bee544","sha1":"c75447b548e0f87ab4302a16910187b3e4dcad5b","sha256":"e443a4d661a95942ecef048944f3b2a62a58d92b04c31341ce45715b97ad202c","sha512":"d9aab6ad3a575c4ace302f30a084361d8d8edfc43b0f99c260b05ea2773fc61eeb306628905ec8b45660f3e2ff145c3be70f76a18d279b2c0be0ac9734e56f2e","ssdeep":"","tlshash":"41f0e2a438c2f163a6fd1583bc092d8d313594f28a8862039fadb48c148c603c6449a8","size":461,"data":"","first_seen":"2025-07-26T22:19:45.160401Z","last_seen":"2026-07-20T23:12:24.088394Z","times_seen":2124,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"d0d936a3e56d5f50dcef38a5e5046284","sha1":"1fb78f846965b288696b9f3bd933a91c3c4f7ef3","sha256":"cd1379b857d0019f7ac736e59872484cdd6cda00d13fbe01e40217d7fbed0971","sha512":"4dc583bbb3f793c64693558172a449a1011ecb8723e4626cf2d7d32d09bd2969913a25d13b9493d3550f295504e24273d67556457e43d8949c52368e4937433f","ssdeep":"","tlshash":"2d9002a9944c1310442619d08056185d8970836113118840008bb9613991034051946c","size":49,"data":"","first_seen":"2025-07-26T22:19:45.151938Z","last_seen":"2026-07-20T23:12:24.093179Z","times_seen":2112,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"43df7a3aff8a45eb50ceedc0d65edbaa","sha1":"30e84bc10b2793151357cd652d2db7dfb3b605a5","sha256":"abb7f8419537e56bad583accc6bac359695f434ea22220d7989940ffc80da4f6","sha512":"664653fccaf2c865f7e77a706ad2e5aab06518f3208af94f18ee0aa2aa8191f196091d313cecb79bdce7ba537d2e8ee19d6867d8430338aca0a44a91f7b602b4","ssdeep":"","tlshash":"0e015efdf453a114a0b728b66be6e8407d030457e68bed25794ca840af94ac2d9816a0","size":767,"data":"","first_seen":"2025-08-09T19:47:38.598552Z","last_seen":"2025-08-09T19:47:38.598552Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"dc255c5d392163ad8215ec8cafa0b025","sha1":"3eb1482fde700de5f958554bd69c16219bcd8fab","sha256":"b828a828f278b2c641030510f77865bafaef57e4bb4945825b307cdfd5e99d6f","sha512":"02074148991fc0ad87f5abfc8846d19d61018f426fe956b0c2a9e175260840740208fff2081a17cc3d44027d03fc0d205c68a2ad961a357dec301383b4e3c186","ssdeep":"384:2ecE1WVsgFkqvQSS/KkfwTvvFDXaDs51ynDpwK0UKDF527AZWFTw5R8:JcE1Dt/KCwt7ynGJlZ5qAZWFTw5R8","tlshash":"06b26ce26192e03187cf77a1923f1c17a2bf1990c50ce5fe92719a9865f21964ed0ac9","size":24273,"data":"","first_seen":"2025-07-26T22:19:45.197843Z","last_seen":"2026-07-20T23:12:24.099878Z","times_seen":2018,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"6baed09e1703a95cc27fc80cee690984","sha1":"9a8384c80103ba17d11027363730357eeb71a756","sha256":"9d51a1b3c15174d2327b2e3e86732be0c036c6e988af8bb57892aefbff6a2ba4","sha512":"0f5da249f9d323b495e451d170c932a4b7032ff06a63b09962878af6c009d4cbacbded395356c96a23cccb87770f8dded541af80991d6204fee88e96a2738757","ssdeep":"12288:48iMPDIIY0WfzBJHpyif+XtVQ8q/C885Sx4YPJ:BX8IYPLDHpySotVQpxFJ","tlshash":"7ca4aeb63281aee75d2d2f16d9263ac8135926f3dfa5f0841c23bcc601b37758763694","size":475926,"data":"","first_seen":"2025-08-09T19:47:38.600564Z","last_seen":"2025-08-09T19:47:38.600564Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"54b06835238eece3e9cd4a024a5302d8","sha1":"9e2e50e43519a5f54d9cf37732171f86f0396768","sha256":"6bba96a05a2417a9fd02a7983b9dca50d9d3e5716d1a05d147d1741dd0f1c6b7","sha512":"829b9eb61985174f7a7e5c20cf17b0b239f01b63497fcb77823a2104c62678ceba597425ebce50e9c91bc283bbf5c3b8d15bd634ebef8e81444f4537d4479c07","ssdeep":"12288:08iMPDIIY0WfzBJHpyif+XtVQ8q/C885Sv:FX8IYPLDHpySotVQpv","tlshash":"63949eb63281aee75d2c2f16da263bc8135926f3cfa5e1841c23bcc601b37758767694","size":446019,"data":"","first_seen":"2025-08-09T19:47:38.60243Z","last_seen":"2025-08-09T19:47:38.60243Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"fae289f346b17494d1f7974148a2b3b8","sha1":"6ba1f95910f831b79fe088608359d97804423607","sha256":"5ccba7eef5fc9c813066b463d337db933274a4c13007023e1f074c37e920d410","sha512":"74bf59474c06c3e6801c5d17b87d9eecbf090167804a4be6105ba64f5a4a0b010aebe5842a393d0cf1afc10fe6016b05e44ec2679f925b6891e45aa8a7801daa","ssdeep":"","tlshash":"352132b70441757afe7b3e1b7a8e788b1aa7eb4471cbe6e5c35675285c22b4004e0278","size":1230,"data":"","first_seen":"2025-07-26T22:19:45.18074Z","last_seen":"2026-07-20T23:12:24.098242Z","times_seen":2113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"5a40d8b8b6c1bf859eed4246b0603030","sha1":"8b9fd581c3e4fe819a82364c85f842e295fc829e","sha256":"15549212ef1a6997cdf59d3315b1a1bcfe2d8ae992b42e95800e37dae0fa65d4","sha512":"ff9ae2b6aa283eeed93e3ce4101c5dd735a56241f05cbdbbeb77f3e58c08186848349ef5588d02d1cfc3785f5d32b9599b6c777f2eda45be982e75a5ca932289","ssdeep":"3072:DPtZuVO1TwwiNvgLODKjuvK+QvZP/CFFaTuuXqRTWEkAJ+QqRC79BI7BfQ7rgA76:TvuVYOgLOjZKCNMvCECZqKvzMHB4el","tlshash":"9b24e863bf00237d0247c6f6a72b32a5f326d5bda3124490d8ad42b46793ca9e53f9c5","size":221866,"data":"","first_seen":"2025-08-09T19:47:38.60452Z","last_seen":"2025-08-09T19:47:38.60452Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff","fqdn":"glyph.medium.com","domain":"medium.com","tld":"com"},"ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medium.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 19 Jul 2025 18:59:27 GMT","end":"Fri, 17 Oct 2025 19:59:23 GMT"},"fingerprint":{"sha1":"02:23:5E:98:7B:89:75:41:2D:B9:6E:49:B5:FB:DE:50:5F:92:21:95","sha256":"E2:04:01:D8:27:80:EE:9D:82:C8:5B:2F:78:A7:4E:04:A8:F8:06:7E:2A:E0:CE:3A:18:48:EB:A1:5B:B4:E8:CC"}}},"request":{"raw":"GET /font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff HTTP/1.1\r\nHost: glyph.medium.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://ripple.giving\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://static.tumblr.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: application/font-woff\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid\r\naccess-control-allow-methods: GET, POST, PUT, DELETE\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 86400\r\ncache-control: public, max-age=31536000\r\netag: v2-78ce731\r\nexpires: Sun, 09 Aug 2026 19:45:52 GMT\r\nx-envoy-upstream-service-time: 39\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nset-cookie: _cfuvid=t6hmaHqXIEmP8Q1RpYNm9Q19FrbBS_i8PSk2TwN4M.k-1754768752627-0.0.1.1-604800000; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\ncf-ray: 96c9c19eaf37568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24999,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 24999, version 1.2","md5":"40998d8ab3c98b1f18022f543c81147b","sha1":"6035f5bd0d153531d1d4bf0a61c72a5c5a2ab4dc","sha256":"e8fed51ae35ba9d9c900b99b774df79551240e4954aa5bdd2289cf32d64c1715","sha512":"b247de67ba3592d3aa695979dbcadc32764eac49b233f471b02edb04551151bad16d5a49e4403df4df8814c63e9c823a6d7d4bbabbcc998c4b5e081371d02835","ssdeep":"384:OWBBRokaQuiNlYFdwOZ8qWD1zixFGm+O7x8yA9jHkaaXv1X7t8+VrGfdc4r+4Ur:zBRFuwc8NDwDGxO7xDAqZtX7tPVrqTUr","tlshash":"ccb2e0b72cf83b6462719c75cbcbf235eb28e21e6522062004d9468a7cfd79807b314d","first_seen":"2024-08-19T21:59:15.826252Z","last_seen":"2026-02-28T11:36:11.137611Z","times_seen":6,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":64,"dns":40,"connect":1,"send":0,"wait":199,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/jack.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/jack.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 33481\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=wPMBoof6p4aKSd7WYAYAaVeRIUbwCOvx7%2FxNJGr6bU2iyuGa27dftRcGYNWjRseyPyJA1WOOeGNRw5oYkwBOP4W%2FtHN4fpan4mYAqEnyG0Jc3QzGnJEvVcnwhU190dBA\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-82c9\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7b7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1033\u0026min_rtt=0\u0026rtt_var=1002\u0026sent=171\u0026recv=282\u0026lost=0\u0026retrans=0\u0026sent_bytes=23637\u0026recv_bytes=18607\u0026delivery_rate=1138359\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=521\u0026inflight_dur=58\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33481,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"fd7b37997a9673f1b8e357b6b8a4be5d","sha1":"fe079718871ee4c2ac8ddd73ec00ccf5a07c3d2e","sha256":"4bce9718d0d37fe90db9f7930816455b16f82596f96c9e7cbc4c7e615def66b6","sha512":"1a69ab12710973493ed96e2e18030dc05c4538df5680427115d9a9317b55ce4d3d8844cdf2a06e8d64cc7ab0d8003c82b2b5fd725a80a505f41ecaa040c74bb9","ssdeep":"768:PkLat34oVYNKqX3EhA/VKDLmdht36N+guL:PkeJRVYwqXUm/ht36VuL","tlshash":"abe201c82e8a7fbdefc83d3120a66549b6156d30ebe20fa90c4ed095173c948de69d51","first_seen":"2025-05-27T11:15:00.590673Z","last_seen":"2026-02-28T11:36:11.158185Z","times_seen":17,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/mm.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/mm.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 10338\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=DL%2F7F69JOqpwc06SJQlH1jjWbXFVWhKd6fzhSIl3K9LM%2BT2YEdMRpezSby47fkJLimBJTjK7j8o9KsyrU3eAMfXp35wHTfHLmIzxVwm6nhHvFyQ8OxmiKpe3wsZynvGl\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-2862\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae827130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1285\u0026min_rtt=0\u0026rtt_var=997\u0026sent=167\u0026recv=280\u0026lost=0\u0026retrans=0\u0026sent_bytes=18037\u0026recv_bytes=18519\u0026delivery_rate=910687\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=514\u0026inflight_dur=54\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10338,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 214x214, components 3","md5":"8d2cd1e1728e065984ee1df0b355b0ad","sha1":"30012b2c81c0fbf78849195edd2ee8f5168f0509","sha256":"da82fef95363c69ba16f28b05ec898618a4f974b35c6e0a7a729ed73e5c135c4","sha512":"e48cc37f030aaaa5ade1bdb64ea4de52e7565a8b7342b1e2f5333e56d34d75d4db57c467f5e0e24a768e8747679f5aca8d8d9eeb2a29eafc07f9573bb5b831a5","ssdeep":"192:soL6pdjh1GGb6G9JTA/3ghr6eSk7GEcf7vEgBQOxSP3JiqigTqQBeZ8C:soLGdTdeG3AI8dEcjEgBQ9PZpiaqQG","tlshash":"4f22bf5c9738278ee70e7e3996c9ab3005e08f61be5047e702d18aed9ffd086c942249","first_seen":"2025-05-27T11:15:00.598973Z","last_seen":"2026-02-28T11:36:11.153778Z","times_seen":17,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/xrpp.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/xrpp.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 19009\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=m6sSg2H2hORXFNqy6aRXrm8JTd3ow73HcyzGAs0mZmu%2B0Jews5bE08jJgeARK%2ByJGWPgW%2BvU17%2FWW0vH%2FVFb7A5V7sjER6n9XYX9kuzdHktorBazFKArZ6%2Fq0OvuGNly\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-4a41\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae847130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=395\u0026min_rtt=0\u0026rtt_var=271\u0026sent=229\u0026recv=303\u0026lost=2\u0026retrans=2\u0026sent_bytes=97814\u0026recv_bytes=19558\u0026delivery_rate=8007769\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=24872\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=537\u0026inflight_dur=73\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19009,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 331x331, components 3","md5":"a68af475ba74ee65329d4eb5da0d6d62","sha1":"65f5eb232db245bb08d632e904fd6e945f66eefd","sha256":"b59aff113fe4070d5dabf11e187fa1e874675766f35a62004a9c653ca133350e","sha512":"1286e3b247317f4a16561774dd24be7866ad7915ad56a64278632cb80546b2d7638fea8075405745dec759efcbfbc878f5f6bf81c29d8f458feca3d0e24e7ece","ssdeep":"384:sv9zUHqhQbMzJTqDCQHHmhGVLwU/vCh0qkjWHsXYYTQBjC+:89F+CGDCQm0NpDWt17","tlshash":"ac82c0364bc51a03f99e19f27d905daaf9219fd3834503abc95f84ee27375c1146232b","first_seen":"2025-05-27T11:15:00.585989Z","last_seen":"2026-02-28T11:36:11.149382Z","times_seen":17,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/dai.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/dai.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 46912\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=eQH9dcObCNOGO2rteB3WXdx4LkKjtm2uwyyEbzp8l5hNZcUCBVcQAVLMH5AAyCUhng0TpRHQ6UyZ3dNRzb4L2olUaro1zPqx255AiehjqVDazKgs0AEyt4PKAU%2BsfME0\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-b740\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7f7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1163\u0026min_rtt=0\u0026rtt_var=992\u0026sent=171\u0026recv=281\u0026lost=0\u0026retrans=0\u0026sent_bytes=23637\u0026recv_bytes=18563\u0026delivery_rate=1138359\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=519\u0026inflight_dur=56\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46912,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"cda99caa862778e890a90788c99ea1aa","sha1":"478984f35bfa845dbf9a8d4a3096685cb1e5109a","sha256":"198f7f8d32f771479af26f52469b8dd04dc50cd187aceb661dd3beeffaa2aebc","sha512":"1417b5527259e03cb9b4d1538db5eafc4369ae9dea831b534a08d9580e725d21f10d00bc01a627559d37310bb4f219ec8da2ed63a22fe3432284ac8f9609a6e1","ssdeep":"768:Orhl6wRtk46H/lwXZ/JFST/Sx4w5byK4VQuMbwZ77WAItE6jxfZWN95LCFes2IUZ:OrhlnzMH6XZTa/SV/4VUbwZ77WAItE6y","tlshash":"1423f2f0a380e274f76e493da4f43210713ba9585aab6b532744b8694f9dcd8e06d3d1","first_seen":"2024-08-21T10:18:06.496416Z","last_seen":"2026-02-28T11:36:11.148546Z","times_seen":23,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/eri.png","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/eri.png HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 114644\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=JgdcLBRHB5ZJCgwbNJ3W2bXjX96aYPiNDrAgu7YVrDSEWPuuWw4yz5JUZ07YRlcKCGNlXpeh1mskXVC3p8IfLkqlqkITzkkSkYMY0zRxQMGuNxUQfm2W5DBHsmhCj980\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-1bfd4\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae817130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=904\u0026min_rtt=0\u0026rtt_var=1010\u0026sent=175\u0026recv=283\u0026lost=0\u0026retrans=0\u0026sent_bytes=29237\u0026recv_bytes=18651\u0026delivery_rate=2107100\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=523\u0026inflight_dur=59\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":114644,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 270 x 270, 8-bit/color RGBA, non-interlaced","md5":"a9e0bfb426473bc5b037a54d57fc921a","sha1":"9993f9db2e5303edb0474bc5113a543ea2fed7bc","sha256":"4e9c938cbadfe141fcd6bcdb9b99007d82b122468fab826be3af5390323ba841","sha512":"103284e4a026b637cb3c96bb5cab0c1ffc266712957b5934be72b7530277123482d3422e335cd527a2e151550167d674a529d9302c16dcad9544b8c3727707fa","ssdeep":"3072:ee9mi174dTGDU2eXZYg5enjEpLyg+VzqVZke1JQug6An:f54dC9eXZl9+c1ql6An","tlshash":"fcb3121ffae956642c30dd1bb037f206d52ca1ac84c3f389731a525415b3badd0b5e6a","first_seen":"2025-05-27T11:15:00.575892Z","last_seen":"2026-02-28T11:36:11.152874Z","times_seen":17,"resource_available":false,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":200,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-images-1.medium.com/v2/resize:fill:136:136/1*8I-HPL0bfoIzGied-dzOvA.png","fqdn":"cdn-images-1.medium.com","domain":"medium.com","tld":"com"},"ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medium.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 19 Jul 2025 18:59:27 GMT","end":"Fri, 17 Oct 2025 19:59:23 GMT"},"fingerprint":{"sha1":"02:23:5E:98:7B:89:75:41:2D:B9:6E:49:B5:FB:DE:50:5F:92:21:95","sha256":"E2:04:01:D8:27:80:EE:9D:82:C8:5B:2F:78:A7:4E:04:A8:F8:06:7E:2A:E0:CE:3A:18:48:EB:A1:5B:B4:E8:CC"}}},"request":{"raw":"GET /v2/resize:fill:136:136/1*8I-HPL0bfoIzGied-dzOvA.png HTTP/1.1\r\nHost: cdn-images-1.medium.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ripple.giving/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: _cfuvid=NRAddE4ZUJGZi3fRxcSDC5UpEQ4ocgEcii6_ev4EOAY-1754768752943-0.0.1.1-604800000\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 5366\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1*8I-HPL0bfoIzGied-dzOvA.png\"\r\ncontent-security-policy: script-src 'none'\r\netag: \"X8vyfwJoSiP97T4SJeCdAu2dzX-ut7dHLbPOnVeUgVY/RImYwOGY4NzNjYmQxYjdlODIzMzFhMjc5ZGY5ZGNjZWJjIg\"\r\nexpires: Sun, 09 Aug 2026 19:45:53 GMT\r\nmedium-fulfilled-by: miro-v2/main-20250708-193400-4f9d2344cf\r\nx-envoy-upstream-service-time: 172\r\nx-request-id: 4689966f-0454-4f4e-a92b-7913c3ea6d3d\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\npriority: u=6,i=?0\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: 96c9c1a1fdcf7130-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5366,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 136 x 136, 8-bit/color RGBA, non-interlaced","md5":"4dd60e7478349b61b7d218fac7b4f3a6","sha1":"95125dd57c36977baaa181bae68ffa13c0262fd8","sha256":"58e9e0720c64e2ebc0af15cea8716d0bae630cc397037631d0ef8cfe90011118","sha512":"ce38c61c7126cb2d5776e1112aa8624fe5f188889f157a93489b566a54fab7bfcf04ecf953815fa6a5a2226e0e156dacf1b0bfc2593616a00a65bf49d539ab2c","ssdeep":"96:8Stkpuq7jej9qWaumNqmmt6nqLpJfssd1lPKCNDGkXOb+0pYq5Jeac:8S6puMo9qqmNqnmyvfsiqCAz/Ppc","tlshash":"c9b18db79ae0fc0557273a08938f4b1fdd50699ee170cbee32eb59ec000fa9655825d8","first_seen":"2023-07-02T20:37:34Z","last_seen":"2025-08-09T19:47:38.570193Z","times_seen":25,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.tumblr.com/bejxdgc/H7hpx23gv/main-branding-base.css","fqdn":"static.tumblr.com","domain":"tumblr.com","tld":"com"},"ip":{"addr":"192.0.77.40","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tumblr.com","organization":""},"issuer":{"commonName":"Sectigo ECC Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 25 Feb 2025 00:00:00 GMT","end":"Thu, 26 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2D:ED:13:34:E5:33:FE:60:8F:86:9C:75:16:32:BD:08:68:F9:A6:14","sha256":"94:0D:5B:51:16:8A:17:28:49:1A:83:D9:4E:7D:DD:27:B3:30:C2:8A:E9:FB:82:65:0F:7B:D5:4D:0D:FF:32:49"}}},"request":{"raw":"GET /bejxdgc/H7hpx23gv/main-branding-base.css HTTP/1.1\r\nHost: static.tumblr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Aug 2019 15:38:57 GMT\r\netag: W/\"0acc5b1299f898a0c3a615c3aab31699\"\r\nx-amz-storage-class: STANDARD_IA\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\naccess-control-allow-methods: GET\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 86400\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 1\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=0.0\r\nstrict-transport-security: max-age=31536000; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":522276,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"0acc5b1299f898a0c3a615c3aab31699","sha1":"7ed52efc7872582e80fe82a7d824230fbd228991","sha256":"be9a62a389ef14e5aa7c9c7ef9f7bec271ecce1f86aa8f0cdcc9a5e3acf7948e","sha512":"b9f7d037b1732318120588881f08dcf90e532773fdaba60c6d6793a6b053597b34cf578a43c8db49102d3f713fc82c16af4828a3cdd15b4af257b45dc2f24744","ssdeep":"1536:IF+FxWhn0x/Mrr87oKy9zIjAMOiCEm1y64JovSgQ325wF+DpABRiFQtkDrMqSsfp:IiWhVtIjnIQtkEZZ2","tlshash":"ffb48677f6c01318a423cd16d2cb3bbc7a3e992763125dfaea4137758b825db139160a","first_seen":"2023-04-18T03:45:43Z","last_seen":"2026-02-28T11:36:11.154633Z","times_seen":21,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":142,"dns":28,"connect":9,"send":0,"wait":8,"receive":0,"ssl":104},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/brett.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/brett.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 16771\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=So3OkfB1V1%2ByYMjABPVDIAQ7DQ4FK2te%2FWFojQhEaetYmjYfOE%2BzsZYKDAD3PC9H%2BKHzaOLYAdNHMeRLXdgiili8wXTotiuinSmLGqAfPKVHnmpMyeV6sMGxuldzL7J1\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-4183\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7c7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1285\u0026min_rtt=0\u0026rtt_var=997\u0026sent=169\u0026recv=280\u0026lost=0\u0026retrans=0\u0026sent_bytes=20837\u0026recv_bytes=18519\u0026delivery_rate=910687\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=516\u0026inflight_dur=54\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16771,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"4f1f228fc4cee46046ec73209ad877d3","sha1":"96dc7a72565576d8fbbc5a2f716872e56ab29037","sha256":"9627488e58631df6d9c486c54c93db4cb1b4e5d6053d2dc781b302aa56f56cd5","sha512":"9f8db2edc5d293e39c97385370fd5a1ef3d6683717d42781ef864b9dd11cd69390d16aeb98d52d9db4aae38728f99c8096979d6f090ce05cc42d1432268a5340","ssdeep":"384:s82BiTxJYacN0dtkROwAE6eFrdcnE0xYu:D8CSslWrinUu","tlshash":"e672c09923341321cd6e7bf35e8012c2b6d19e2e4953ef4bc1554424e79e2b47d8aacf","first_seen":"2025-05-27T11:15:00.591776Z","last_seen":"2026-02-28T11:36:11.150974Z","times_seen":17,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/lord.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/lord.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 31459\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=EofXNdhu5OCK2wytdjGn4kN%2FQPdDlrSexLJcxA3I%2Fx%2B3QD2S%2Fsi2Go68H%2FB7PDNLDhffTCLkvbl%2FwPiIFt8OOtqpxGjp4VblKkEKilzHZmveCHCGFS7r4QGT6XlicdqU\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-7ae3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7d7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=395\u0026min_rtt=0\u0026rtt_var=271\u0026sent=229\u0026recv=303\u0026lost=2\u0026retrans=2\u0026sent_bytes=97814\u0026recv_bytes=19558\u0026delivery_rate=8007769\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=24872\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=537\u0026inflight_dur=73\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31459,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"0643a211ceafb29512708d337af8c0c5","sha1":"ad0b6bc4f0252606debc8b6c67f8f9675d9b876c","sha256":"07b350630f931a7ee17d903b01a7d3441530560fcdc0eb847e1fe6b7572b52e2","sha512":"2d1df466ffd8323c69026bb9f5dfc0851d6e117dfecfb1dedf048759d77c6ffa067a61d8e255826532ab6c51a17df94597847c7582eea926e3d626799490a2cb","ssdeep":"768:r9lMEFkew3ynXdJcccM5OAMbM+CeX9Db8b:lzCccgOl7X9Dbk","tlshash":"1ce2e0cf51c64b05d6fe1fb595624b32ef60b834a7a00dcf41d52561f368e382d978a4","first_seen":"2025-05-27T11:15:00.57714Z","last_seen":"2026-02-28T11:36:11.152094Z","times_seen":17,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/cobb.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/cobb.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 8869\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5WeG3ijizdcHFYUSXMLMntn7lQ1tPe5Ckxt5BlGK3uFkgsdasZIrqKmMLxdWRWOKDvRT14xudZCDeSPbZiytSJT2bYVGRbF4bvUj4TEtTfSsCq7EQQPj3E64Dxa74giw\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-22a5\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7e7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1033\u0026min_rtt=0\u0026rtt_var=1002\u0026sent=173\u0026recv=282\u0026lost=0\u0026retrans=0\u0026sent_bytes=26437\u0026recv_bytes=18607\u0026delivery_rate=1138359\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=521\u0026inflight_dur=58\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8869,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 216x216, components 3","md5":"87d110199244edba86ee9155ee86f48d","sha1":"4be19b6ff7437a5f2d4ab0e288a93c89dcb74c0e","sha256":"a56b4fbb3e4e8907e341adff687e8843a654ae27da7b73540180e6287054a205","sha512":"41155d2557a1d11b0afef7adee3c51f5ec6c02b158c2da5d2de901fdf5ffe8aa1cad51263fa36a7dabcb8f56b4b1bacaa827fc4fe7e30bc503da965c7ee8d4dc","ssdeep":"192:s9tF+XQnQzJJ0ULwo93V/XZ8Ih0ihEkbe+lLBkt1GlUV:sgXQnWJ5Lwo937pasdLypV","tlshash":"4c029eea9f8c5e48f01ccbbd908087fee711ae26d51a6f8681c24f95733dc466ed40a5","first_seen":"2025-05-27T11:15:00.583346Z","last_seen":"2026-02-28T11:36:11.147642Z","times_seen":17,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/proof.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/proof.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 92350\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=EcLcXPtysvBZGEdNTM%2FNzNs7JtLQ59wokV3tyfaSo%2F%2F8Ua2KVyrwtwXpAteRBZwoYD30Mz9HKbqUNnGWrHET4wphWF%2Fsv0B2RhyRS6lmwO0ARoZuS62umEmsiifoHa7H\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-168be\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae837130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1468\u0026min_rtt=572\u0026rtt_var=840\u0026sent=164\u0026recv=279\u0026lost=0\u0026retrans=0\u0026sent_bytes=13837\u0026recv_bytes=18475\u0026delivery_rate=728549\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=511\u0026inflight_dur=52\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92350,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 575x420, components 3","md5":"5167adecce2883a432e49039c147c80e","sha1":"5f1bfa8cf0516d10821f15198bf99506739850d4","sha256":"bfa49ab1e13e2fb1c79edc64c869a52835f724e6d760887f462aa24ca059e70d","sha512":"479ce2ff1863b094b36cd51f0c8f9e34e815dc91016302ca392a1dddbd690e39c5cbae333b074fa4868ab0dd4b20ad73d15db8d918b7ec02cff0bb7e714b09cb","ssdeep":"1536:k4Kk/TuuBzbW62v/MWmC14c3Ug6i9P9V9ofQw2zxqRAEbqADc3pSSoB:koTuSarEijc4woq6wpDefoB","tlshash":"b19302ec06b92863e9f5a591bc58c394fa3491f990df2c27c94d6d3e2c8d2c6b56c310","first_seen":"2023-07-22T18:04:03Z","last_seen":"2026-02-28T11:36:11.155719Z","times_seen":18,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/chad.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/chad.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 25770\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4hPOhAhhMgXZ4jZhOCidZDepnJK7RGakGlHHgk%2FU4XC%2BO1LmHwjpvfWtu3uArtak4eiqruFvIz8DJpeCCE9cEmjs3BIuX6CKEBZWoKSRICIAHHqms%2Fdlp81IlygtU%2BBn\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-64aa\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae867130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=904\u0026min_rtt=0\u0026rtt_var=1010\u0026sent=173\u0026recv=283\u0026lost=0\u0026retrans=0\u0026sent_bytes=26437\u0026recv_bytes=18651\u0026delivery_rate=2107100\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=522\u0026inflight_dur=59\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25770,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 371x371, components 3","md5":"32baa7aebc7af94ebdd684123d52a7c4","sha1":"a2321724aaf4e0fdf6dbcccee9669f5d746c5ab1","sha256":"bcb499ff6fe4aaf2a9965460e519f26e1a66a603b9c89703598c0b8a41330f55","sha512":"8383f70225b35326c16fac435a826ce8a7057199ac7a70a2f047ff55372a028c9be5a8302d57e4c3c48c522d8e180559d76b51088796fdaebe69727184f700df","ssdeep":"384:spxZe6IKriis/d3SWS4gNdCtFV1tvYgI4ZfUrKqFdlZAWUCJp5p46RJIDUwu:GNOiMd3/g8FV8boUu2+WRzdJnF","tlshash":"2dc2e1993b056c56df3e1db4d0cab344d5e4061ab38b8ad3b1341b2e0fa8745d664cf9","first_seen":"2025-05-27T11:15:00.581871Z","last_seen":"2026-02-28T11:36:11.131652Z","times_seen":17,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/brad2.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/brad2.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 27244\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5dPRdKHzCNe3c4SuscMHdH2B6Us8stElNcQiJkqTY7i0txNiV6ScXOUmmYG4hSfQEOyZkpxH8zhmWjQgeGiyqyoOGk%2BOdxeqbBQm4i1ujFUnTf2b8snXcIrxYwnNrMTy\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-6a6c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e777130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=386\u0026min_rtt=0\u0026rtt_var=236\u0026sent=243\u0026recv=305\u0026lost=2\u0026retrans=2\u0026sent_bytes=117228\u0026recv_bytes=19650\u0026delivery_rate=8007769\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=20892\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=538\u0026inflight_dur=75\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27244,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"8f70d0662f3a21611678eb6ecd3fb33f","sha1":"420466a3c0e9d26a4223f3ef4e563ec1c6a46f33","sha256":"23e3ba952e005e5a0ac4f130741d98017a1033ca1fa5a95b2860dda26623f224","sha512":"702a0d244b03d21e62a43a8f0ba51ef649742f73bc911912f7f13c6161f679d56e5401203e1c44d55f41526923127efa77d193d321c2a095c18a58f2b20ec081","ssdeep":"384:s4enqYlw2/AnFO+gXm/2RDtK4eRt9YsA2HKjwifiPZrqmVqRkJ1X2L9xKOzqktLn:SVoI3WO76A2HbiKxrFVe2GLiOzqkREQ","tlshash":"62c2f18366ec8269d71ed8ba85995b3012583024bae39d1ca1a10c8f9bfc0f97d913e4","first_seen":"2023-11-20T18:09:47Z","last_seen":"2026-07-16T04:01:43.321591Z","times_seen":45,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/index_files/1UATD6Vui-5Xa4Vb2QAOtbg_002.png","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /index_files/1UATD6Vui-5Xa4Vb2QAOtbg_002.png HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5pMHzlQx66G%2BmakjiY%2BEXBp3gKODjgN70AkAVHHfJ%2Bg6Lk3ix1%2Blk0o9vSGy4RrnkvbAVMTPwrvjm5ssgUyAKeZ%2B8nygp%2FldxuJQVwzfIeN956%2BNpjdmN5FS9Yq9YSJk\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 96c9c19c9e787130-OSL\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1498\u0026min_rtt=572\u0026rtt_var=1040\u0026sent=162\u0026recv=278\u0026lost=0\u0026retrans=0\u0026sent_bytes=12911\u0026recv_bytes=18431\u0026delivery_rate=728549\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=506\u0026inflight_dur=51\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":275,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"11e93b6b43e5824a2d83550fe7aa0859","sha1":"a62b0290b1673b41001848567e39f8164ea47b54","sha256":"89339bb679bbda0ff7c7608b59791382e32e8534bd2e863f3f46550908e79f95","sha512":"2ff45297516597993c2e59ef1fce9b53a4c1b624ef269ca7001c6dfb68294b977a2b63e1a1608b24b3c4e7a1a8b6e0315d9c1901da5d8d143ff57e2fa5feee35","ssdeep":"","tlshash":"efd02b9f90537387491214a079c615c2274c12fab43a82a82d86d487529897ecd9a9c8","first_seen":"2025-08-09T19:47:38.579909Z","last_seen":"2025-08-09T19:47:38.579909Z","times_seen":1,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/rand.png","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/rand.png HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 5008\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=86BQ1pkYlHXHwv8uknf76UgvYzCKzZtrqdIMuYIhjn9Fz82v3NzEoxNbdQGBRi8nQyJMU0P4aDSGJXLAbO2iB4VgfCaG9yh4xcllSGSVk5Pp5eYBXaNKWlHwM0Kll8hI\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-1390\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e7a7130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=928\u0026min_rtt=0\u0026rtt_var=804\u0026sent=181\u0026recv=284\u0026lost=0\u0026retrans=0\u0026sent_bytes=35735\u0026recv_bytes=18695\u0026delivery_rate=2107100\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=525\u0026inflight_dur=62\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5008,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 240 x 240, 8-bit/color RGB, non-interlaced","md5":"c0fc690c3446abf9097b141eefd9eb72","sha1":"e22be0323418a3d63ba800734d67afef636cef8a","sha256":"4143cfe5f9c15ee1d73d236db0bb348df7eea04c2646ea908d86eb827a8f68f5","sha512":"180f5c4e5dfa2e5d1193faa22d9a8c917ff84ce4475fb2bb58065b4096a2888bb609534624df311f752cd51bc24082f793dcfb0439a885a0e833b301838605e0","ssdeep":"96:hHlOPpozNL0ryqLg4JTKDtWtBHae3udfURvy77RtK1SAy:hHAPSzNLktXdSAB6cud17CSL","tlshash":"8ca15cb4902825145deedad7bc851cb9ad91664274df0f1d380a0dcba64f0c5d8832c4","first_seen":"2025-05-27T11:15:00.594444Z","last_seen":"2026-02-28T11:36:11.14684Z","times_seen":17,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/amonyx.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/amonyx.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 16867\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=J9%2FSE6kro5K6p9vEsdNuolvGgMUvYJ0aQd%2BQ9NrW1H8Od1rzfnQEwBaVwACQlW95VDNWU%2BsGEYcSOTnKZaQtuZelgWcupdKK1tmnmPmdgR6C6KiFZstWs%2FNPM1MjR9il\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-41e3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19cae807130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=904\u0026min_rtt=0\u0026rtt_var=1010\u0026sent=177\u0026recv=283\u0026lost=0\u0026retrans=0\u0026sent_bytes=32037\u0026recv_bytes=18651\u0026delivery_rate=2107100\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=524\u0026inflight_dur=60\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16867,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"33085cfc91b01992332371ed5e4e0711","sha1":"889f599a1cee0e3ac7d5550f0ef020e874444b48","sha256":"bedd7c8f656ccf4a270ace7c616eefcd87a033f7ff3b5e06077d6db06aa1b5b4","sha512":"d0057aa38b5822dc6a7598204056ca2b702395c98663bdc6ec662f94dcef7415e6d3ed97de95697227947c65c60b63ea101695cc41d2bb75be534f1d3059fe64","ssdeep":"384:sflotX+Ui3dE82d7//lGY/Tbjv1spy7rIDJcjO3HfBZL63nA6s01Y4:au+LL2d7/lGY/3T1s43wJc63aQUY4","tlshash":"b772c077ab281065ea0dfe7874d96f813e075e7282f0db9a2302512f8f0a5950dad39c","first_seen":"2025-05-27T11:15:00.597779Z","last_seen":"2026-06-03T10:15:18.836947Z","times_seen":19,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff","fqdn":"glyph.medium.com","domain":"medium.com","tld":"com"},"ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medium.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 19 Jul 2025 18:59:27 GMT","end":"Fri, 17 Oct 2025 19:59:23 GMT"},"fingerprint":{"sha1":"02:23:5E:98:7B:89:75:41:2D:B9:6E:49:B5:FB:DE:50:5F:92:21:95","sha256":"E2:04:01:D8:27:80:EE:9D:82:C8:5B:2F:78:A7:4E:04:A8:F8:06:7E:2A:E0:CE:3A:18:48:EB:A1:5B:B4:E8:CC"}}},"request":{"raw":"GET /font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff HTTP/1.1\r\nHost: glyph.medium.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://ripple.giving\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://static.tumblr.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: application/font-woff\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid\r\naccess-control-allow-methods: GET, POST, PUT, DELETE\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 86400\r\ncache-control: public, max-age=31536000\r\netag: v2-f50d520\r\nexpires: Sun, 09 Aug 2026 19:45:52 GMT\r\nx-envoy-upstream-service-time: 26\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nset-cookie: _cfuvid=zZaJfIQomnXPrIAs3H5tTszFOmUXrkLrYMgEs75evJo-1754768752805-0.0.1.1-604800000; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\ncf-ray: 96c9c19ebf3a568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15484,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 15484, version 0.0","md5":"1c47c7e4fedc60d038f73f406819f19e","sha1":"a448347743e670ed8b102c73788c43ff06e07db4","sha256":"582a04757d62c3d9ad1c9cc5d7e40787a900fd02b3aeace43d41008a7658d071","sha512":"f4620d3be6bd467e0ac43c03f76f32e998a31a3717adf8c276f7e1f440ee67262579225c000dfa7513bab6a1429b801dd6f2ff53b650ffa3895502becfea23ba","ssdeep":"384:1xxdrKKymhRPoOMYclYLm6lfcQhwbWSjYXegngDK:nmpKRPorYa6lfcxXjknv","tlshash":"8862d01187b7b258c2c52f3c44d9e10a5ef678522ab30ff410632f39659f1ad3e79852","first_seen":"2025-05-27T13:54:55.976679Z","last_seen":"2026-06-28T10:17:10.707251Z","times_seen":12,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":57,"dns":31,"connect":4,"send":0,"wait":375,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn-images-1.medium.com/fit/c/136/136/1*8I-HPL0bfoIzGied-dzOvA.png","fqdn":"cdn-images-1.medium.com","domain":"medium.com","tld":"com"},"ip":{"addr":"162.159.152.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medium.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 19 Jul 2025 18:59:27 GMT","end":"Fri, 17 Oct 2025 19:59:23 GMT"},"fingerprint":{"sha1":"02:23:5E:98:7B:89:75:41:2D:B9:6E:49:B5:FB:DE:50:5F:92:21:95","sha256":"E2:04:01:D8:27:80:EE:9D:82:C8:5B:2F:78:A7:4E:04:A8:F8:06:7E:2A:E0:CE:3A:18:48:EB:A1:5B:B4:E8:CC"}}},"request":{"raw":"GET /fit/c/136/136/1*8I-HPL0bfoIzGied-dzOvA.png HTTP/1.1\r\nHost: cdn-images-1.medium.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\nlocation: /v2/resize:fill:136:136/1*8I-HPL0bfoIzGied-dzOvA.png\r\nx-envoy-upstream-service-time: 1\r\ncf-cache-status: EXPIRED\r\nexpires: Sat, 09 Aug 2025 21:45:52 GMT\r\ncache-control: public, max-age=7200\r\npriority: u=6,i=?0\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nset-cookie: _cfuvid=NRAddE4ZUJGZi3fRxcSDC5UpEQ4ocgEcii6_ev4EOAY-1754768752943-0.0.1.1-604800000; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\ncf-ray: 96c9c1a0ec837130-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":5366,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T07:24:25.368683Z","times_seen":17415223,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":33,"connect":1,"send":0,"wait":158,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-09T19:45:51.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:51 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AkPTxHsGvqo4WGNoGvy4jUnlycX51%2FV%2FP5TJgM4EAib9tpx1QWeucHiSK8IJThutSH%2BjW21oUEVQdsCtXDilbpmsmddlWyyjkGTD\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 96c9c197eed85699-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":476916,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64921)","md5":"cf4a46112814e5174d76c1e5bd5127b0","sha1":"09945ccbff74fdc03c2ac93d5e8ba2f8a1ea79f1","sha256":"a4399aef490078ec451b477cf9b3f83a57627cff7ffd3f4307f24baf781e0b96","sha512":"93b523b669747ee6391a0df1be939bcfd76c8cf5ab783b29cfa133d4ac874f71ee84f753f3df97a8607bb77b07b94d982753873d682a3b2d27153e15ba9740be","ssdeep":"12288:R8iMPDIIY0WfzBJHpyif+XtVQ8q/C885Sp4YPQ:SX8IYPLDHpySotVQppFQ","tlshash":"47a4aeb63281aee75d2d2f16d9263ac8135926f3cfa5f0841d23bcc601b3b758763694","first_seen":"2025-08-09T19:47:38.586755Z","last_seen":"2025-08-09T19:47:38.586755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":85,"dns":71,"connect":1,"send":0,"wait":120,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.tumblr.com/bejxdgc/NDhpx23f1/m2.css","fqdn":"static.tumblr.com","domain":"tumblr.com","tld":"com"},"ip":{"addr":"192.0.77.40","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tumblr.com","organization":""},"issuer":{"commonName":"Sectigo ECC Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 25 Feb 2025 00:00:00 GMT","end":"Thu, 26 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2D:ED:13:34:E5:33:FE:60:8F:86:9C:75:16:32:BD:08:68:F9:A6:14","sha256":"94:0D:5B:51:16:8A:17:28:49:1A:83:D9:4E:7D:DD:27:B3:30:C2:8A:E9:FB:82:65:0F:7B:D5:4D:0D:FF:32:49"}}},"request":{"raw":"GET /bejxdgc/NDhpx23f1/m2.css HTTP/1.1\r\nHost: static.tumblr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Aug 2019 15:37:50 GMT\r\netag: W/\"376dd17dad7defb0a0c4f2d99445382f\"\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\naccess-control-allow-methods: GET\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 86400\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 1\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\nstrict-transport-security: max-age=31536000; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65054,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (20468)","md5":"376dd17dad7defb0a0c4f2d99445382f","sha1":"4825eaee66af27a78dfaf734ca123b0e8a3bb483","sha256":"29e89f00341d65ffbab6fdfce78f7e42a1daf4bda2e3615ad9466e2ce47760ef","sha512":"4fb4c78b0383a2404a4f00deaf248a28734d301c63f8c80a9ad304653c06786f363454ada2b657465051ef91ddfad9b0575ca4c4fae10073f758d548f9432023","ssdeep":"1536:M3R8NlTfpC5it0JVIcFSTQDiXvxX9+2C+G:IClTfEtVIySqijm","tlshash":"f453e1722844a6402dd7098a518f3dad0c2ec8777b05e01aaf9f48d0adf1f63637579e","first_seen":"2023-04-18T03:45:43Z","last_seen":"2026-02-28T11:36:11.156967Z","times_seen":32,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":100,"dns":29,"connect":7,"send":0,"wait":8,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ripple.giving/files/br.jpg","fqdn":"ripple.giving","domain":"ripple.giving","tld":"giving"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ripple.giving","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 08 Aug 2025 15:30:05 GMT","end":"Thu, 06 Nov 2025 16:27:14 GMT"},"fingerprint":{"sha1":"66:AA:D0:73:75:5E:C2:D5:82:B2:8F:70:01:52:97:3A:F7:04:7C:52","sha256":"1C:2B:81:32:18:C8:A4:72:F0:97:68:FD:D2:6F:28:EF:27:70:90:56:3F:72:77:51:4F:4A:FC:94:32:0E:17:88"}}},"request":{"raw":"GET /files/br.jpg HTTP/1.1\r\nHost: ripple.giving\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 133296\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=jfVPMJcL4j19C5nQUJlTA6Fi4Kd%2B86%2BJsepKDxlAzuZRkr92ZDkHkH7IHsbImjwbwTvfSsIew8an9adrra9ZHUdR5fqW76pokTI5OUPB%2Fbg83MpOLmucuZis9CTCY3fg\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nlast-modified: Fri, 08 Aug 2025 16:20:43 GMT\r\netag: \"689623db-208b0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 96c9c19c9e797130-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=904\u0026min_rtt=0\u0026rtt_var=1010\u0026sent=175\u0026recv=283\u0026lost=0\u0026retrans=0\u0026sent_bytes=29237\u0026recv_bytes=18651\u0026delivery_rate=2107100\u0026ss_exit_cwnd=14915\u0026ss_exit_reason=2\u0026cwnd=14000\u0026unsent_bytes=0\u0026cid=74f3d80ccbd45b0e\u0026ts=523\u0026inflight_dur=59\u0026x=40\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":133296,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x720, components 3","md5":"e9d09382998441ec1f192d85dcc986bb","sha1":"f7f77f23066ce92be1c06a971c2b7b8097beaa64","sha256":"9436d31d607a226f3aee2d97228ccb1d57e7858a2083a2e28f2dd62bb86e5d39","sha512":"759b11787be3217e869f2a87d4126e3f42308e0135a3bcae0482c620ce11322e5c6cf9dbd510fda9315431a39f05b893afac4f21ef740d11f9274a09e93c1da0","ssdeep":"3072:31w3zmurKnF8qO/ey/xDFjUBBacj2GBOwH2X+tDTCs1hs1DA:Fvk4CjDFjUBLj2GVpDL1hsDA","tlshash":"6dd3125498430a47bedb826459f99c88cf09af7b922ce70bc1da999cd050dce8fc1768","first_seen":"2025-05-27T11:15:00.580637Z","last_seen":"2026-02-28T11:36:11.145132Z","times_seen":15,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":174,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-09","alert":"Sinkholed","trigger":"ripple.giving","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/9qMYEXu.jpeg","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.192.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ripple.giving/","date":"2025-08-09T19:45:52.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /9qMYEXu.jpeg HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ripple.giving/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 09 Jul 2025 10:28:17 GMT\r\netag: \"e3a2d8b40f313dba63ba9e144b3302b0\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: bnvN_bA5lBffkz_xGZKbYSTpuxqkFSBwVPoBgJ5okvAHE0IXcs6WAQ==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 715017\r\ndate: Sat, 09 Aug 2025 19:45:52 GMT\r\nx-served-by: cache-iad-kjyo7100138-IAD, cache-hel1410033-HEL\r\nx-cache: Miss from cloudfront, HIT, MISS\r\nx-cache-hits: 642, 0\r\nx-timer: S1754768752.183392,VS0,VE99\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 46244\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":46244,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"e3a2d8b40f313dba63ba9e144b3302b0","sha1":"c584bce582d8ab802f3fb46ed59818226c02da4b","sha256":"8a498e7dd45d33617adab09836f32512f463bdc2cf737d0e36702c0eb5783e54","sha512":"43ba487666e158b74f48fe9a5c45694eb1356a1b06aa723ccc9af524f04c3767d3430dfd9a66d5a9297b1a52503444c548cd7bc1cfc1bf59bff405613f2c346e","ssdeep":"768:rAMLn6jmjxiyfdknDKWeIGhydbUqOSSnxSlVcygBguu34L15gHNpTSU7u7QyBPl:rAMrgmBXWJGhydFOSSxS1z4LEN1Di5Pl","tlshash":"ae23f154ee555b081182682a66ab260ed16ccfe4ccfeddc0e40f6dc857c27dc8e116ee","first_seen":"2025-07-27T03:00:40.694705Z","last_seen":"2025-12-30T14:00:20.810553Z","times_seen":6,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":65,"dns":33,"connect":13,"send":0,"wait":112,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}