{"report_id":"338cef44-fed7-45a1-b0f6-052f10ba6e8a","version":6,"status":"done","tags":[],"date":"2026-02-03T16:35:45Z","url":{"schema":"https","addr":"airdrop-fogo.com/","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"172.67.180.105","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"airdrop-fogo.com/","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"title":"You were meant to find this","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T12:45:59.323679Z","times_seen":17902907,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"airdrop-fogo.com/","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"172.67.180.105","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-10T16:35:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-03","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"airdrop-fogo.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-03","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"airdrop-fogo.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"airdrop-fogo.com","ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-16","domain_rank":0,"first_seen":"2026-02-03T16:35:45.773433Z","last_seen":"2026-02-03T16:35:45.773433Z","alert_count":11,"request_count":10,"received_data":3699885,"sent_data":4504,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"airdrop-fogo.com/c9d1f1a3-6039-46db-9c01-2cf790c94fa9","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f11bcdc7b7757c117a8de0db3a4c25b8","sha1":"962e4d08a960106c829d0f9d492d7b891927adab","sha256":"b60b89c0c92cf57329c8590a2c5540cece4def64e4e7bf04f2d39b8ffa3b2748","sha512":"7461553dadb09db423bda8c47a58f8cdade82aa710a0f4415cde912e7a88cd4471ea86aa58a2e5097c90e2cb45ac410104019c56a04c35955e827f0bb0796040","ssdeep":"6144:vkWGL6BSn5NGCk3zi0mCw8wLPNU2HZjGfty3:cjkSnv1k20mCwFnHRGfty3","tlshash":"1044810609ac4f7986ec22e015f72cc401794e0ad9dc3cbfb9ada1579e25bd6e0c279d","size":259964,"data":"","first_seen":"2025-07-13T03:04:16.940864Z","last_seen":"2026-08-13T18:03:54.375268Z","times_seen":5113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"e7cedee5f4aabfe0f0a25596641b0073","sha1":"9e90df4076abbd3350295826c5ad3ec1856ffd56","sha256":"c2e60dc68f09c70895f8cb98a4a88e16cf3c691d5a96b9c93c3aab931eafc258","sha512":"17dc0e86fcd7af709d5ffb50d255169d2300566d30c2da4345505703e6a6ebf303df263db9561688753bc03af86b134ccfa9f763966f8612ef554be796d6c025","ssdeep":"1536:jQe6pw4biVcuVXdWAgB1PusH2DY7sX3lX56oH:Me6KBVcuVtWAgR2Do2X6oH","tlshash":"7fa340d59a4bd0e08e5a11edd077ed0ae0281aa3cdacf193b92cded1355df22c84753a","size":104467,"data":"","first_seen":"2026-01-07T13:23:26.460119Z","last_seen":"2026-02-14T09:07:38.76649Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-03","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"airdrop-fogo.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/orion.js","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","size":107989,"data":"","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-03","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"airdrop-fogo.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"airdrop-fogo.com/","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T16:35:22.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JSqMV%2F3382%2BPwi%2B3oyzxkz4MvFXfbZAtW9tgVQQNnl7lnp%2FOmCX3xsLoSLGee%2FvR3pj%2BOkeHG4X9MooThvlONOK8i9XW6FHu2u3bYNmcX50%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c83574f6cc11525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7450,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (7020)","md5":"3b2b086fabdc6910fac9e70fc71abfa4","sha1":"ece4633e2c1dc841f2ae91ac05f620cc35bdf44c","sha256":"9b37affbc0a70d7f1adf50ad2bccd5cce50d2f12008ca4e153500ce684666584","sha512":"08694ef0e20c636e8c0960b829d8e61bbb5dc7339bc2c97a79074d36e12d63cc75773985c096d59d23de7f879e57fd7065d588621cec8ef0573033c875279c32","ssdeep":"96:HZQsRLK7LBYwycU84jLe55VNZuyIxEwIx15LxG3qtkUCinIjFG:HZQsRLK7lRtqI1I0xj8cyG","tlshash":"31e1c6f25120496e6313c7e9eb73214c726bb56eef513c40f15d81b562e3de8e8234a4","first_seen":"2026-02-03T16:35:49.653578Z","last_seen":"2026-02-03T16:35:49.653578Z","times_seen":1,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":54,"dns":40,"connect":1,"send":0,"wait":127,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/11c3c0bfe727847d.css","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /11c3c0bfe727847d.css HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-324a\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ncT3xq%2Bqd8tYLOBqqcUgJ5Oie7aackXMj2Cu5yIIq3f%2BxIO1yt4d1gzDWVLd916hAGpKSwy0MEKu%2FWHU9RbwXVsenFKtURMliYmDL60Ym7Q%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357513cb34e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12874,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (12874), with no line terminators","md5":"9fba79dbb615be78d67028db5511ae79","sha1":"5d6668ebbe65875e6de5534941d2c07a219d4410","sha256":"08e4f5f5a21972023105fcf301ac92d3fa0b8ae2533f579e169ad174496cebe2","sha512":"db592feec2d0a6029d8e6a5a8efe04f39a4a6d1c378ac328ab0e6e92a66c59a18aab3789e1da406c572524e458bc0f4da9e73b3c3e3799120f5de8deeb2e48ac","ssdeep":"192:jzsZuZFZONEfmcqoMN2DRWJb7SGLZr7cKbcZ6fsT/1:WyOcABmKbK6UR","tlshash":"6b42d7d5264c363c732bd343568ff9482065a0528926396d366755bbcbce283236b78f","first_seen":"2026-02-03T16:35:49.654729Z","last_seen":"2026-02-03T16:35:49.654729Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/icon1.svg","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:23.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /icon1.svg HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:23 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-1cd\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=63EpBqkLzyCaFYkr9TmqJd3WG%2FENNo9o7vfOuvKyolOZVSaWi2t%2Be7%2BZvrsgXQjN4r3uSUL3NohX96r8HmLU3EzKURQQ3TuMWuPlD5l%2BWao%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-ray: 9c835754cd6b4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":461,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ca7e525e7dfb16eb7a1e3162335e1bed","sha1":"fec15a6a2d38e049fc30fc9652148dfa2fcc73f8","sha256":"2cd9a79d1eee88a745f2512e6ff049cf6de5fc22ac5d905b96204820868974da","sha512":"ff8e94e3cbe180c34f6c6630124071f9c5f80bb9b9e6e9c5595823e2a1b5e04a283e1f82808bc41971eaf115e606d8335a08295d9077ed21b214f4cd3063b09a","ssdeep":"","tlshash":"cef0a3a9e958985c654c866a1f15d2c4132f03bb30e00658ccde8b70510b501cf83caf","first_seen":"2026-01-13T21:01:18.464146Z","last_seen":"2026-02-05T13:20:29.820388Z","times_seen":9,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/icon2.png","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:23.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /icon2.png HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 34459\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\netag: \"696a864b-869b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n%2BDRfZ%2FN62AdQQN7OSIoVPO7mAYFt2uuBDHxqxsgXcA4pnfKnaWStE5tvI1dVaZpxo7rEZlglcpjXrBuKAtI0sYdcdF7Lh0GJpA7%2F9v3Ov8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c835754cd694e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34459,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"06f825007aab06d486b6aa92088e5ec1","sha1":"265ffd7b70c1ee88a68606c05224692be4c7e04f","sha256":"ba6c45b2cb8d1d2df44154c5b23dcf8a75c8439a3ccde236a843bf5c19f42948","sha512":"c82290e3c9761e8d51a336b528f6592c27b4ea585de6f85bc4f2400b061575d79c7d8c68846c4d0ee156c35340567f2c712f9b24561cf9442979fa715ccebf08","ssdeep":"768:VrVK6cnrk+H/oro5UtvhdiVy13RbGIChVA8:VZOrUt57RbGpA8","tlshash":"c1f2e07c3b3ccb9098251c9c94fe910a8aa009ff681e30a7a5e5dfb35d9530a81dcd9d","first_seen":"2026-01-13T21:01:18.442022Z","last_seen":"2026-02-05T13:20:29.81747Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1104,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/css2.css","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:25.804Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/e5b027d5189e80ab.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:25 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-38d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BCtgLfVExkEX15dyCRNrZLhJjyJacinFNqJ2EgavSJYnSC%2FmXYOETrP8r%2F4CB3PXjKF1IdhiRiZqRTJuKV61gkS%2FyTk%2FYO5F98%2FgWP2Y6ig%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357664fa54e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":909,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"4e9cf141a03680ce3bbba29d884b3605","sha1":"edb765b7ddf4a26d997e46c6afb55af05fd00840","sha256":"d345f56700f99dd389c8a3457697b6d9173ad426870fe6c1db06356a40294a73","sha512":"36a4be40b59aca4452a6599dae5a909cddb0f854f1213c6a495e9c87d25aa9d0dff6c6dc0106cdc1dbe36d1e3a40952def56604045e32a2d4d5287cada2471e0","ssdeep":"","tlshash":"d511dc91085b9500d6d34cc123ce3f32de2e7261a845a975aefd168cbc6bd15a252b0d","first_seen":"2026-02-03T16:35:49.657619Z","last_seen":"2026-02-03T16:35:49.657619Z","times_seen":1,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/orion.js","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.430Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /orion.js HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-1a5d5\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9xkvA4Fx9MEriO2gnSka9elP8SSJYiEgkh7oDDMjxe6WTvdVCCcWffqZu%2BDSrCoSIlxByQiIi%2FE4IrW7HWKucl%2FTxSyPmUei3cADE0pWALk%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357512caf4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":107989,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-03","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"airdrop-fogo.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/660af704509d69b7.css","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.431Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /660af704509d69b7.css HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-f87\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y9AduHTpIcwggHU7wEUvu4HZA6WBTyk695ljF%2B7kZpNEs1kWziW9XOgw3Cxku%2FNUVEa8ZWUQSDQJcMwPSp44yseHYIPjkO4ybaEfwQp63H8%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357512cb04e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3975,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2675)","md5":"a4fcb81e86d4bd4a716f1effffbea7f1","sha1":"8093372340bf72aada623b6e442b28c1255c18e2","sha256":"11ad49c917009553a67193f277990e5a659b13c3c4b19530bafe6169962819d1","sha512":"3c5afea14897956d371cc8c630a6de83ba60fc984367047acd2cd2e659aad338878763c387494a2a68ef6ace7b5d48dabf1e568b1945b87f8f871e5c028b51da","ssdeep":"","tlshash":"d08114358915942de672fd8332ca7f13752c541589d06923fe289eb8ced787a23a0b88","first_seen":"2026-02-03T16:35:49.65946Z","last_seen":"2026-02-03T16:35:49.65946Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/e7150ffe4218c86c.css","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /e7150ffe4218c86c.css HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-12a02\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P7qYDoyFDBloyE%2BGbPv0bCRFvWRQ03%2BrVsnC87bKqC9ZufCkL7unO0N6p7dE0PspliZdRNPDB8Qlx6SQ3mE%2FKswzdPEhCbBO43dzdyb99wI%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357513cb14e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":76290,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (27621)","md5":"ef7f52e2bfc4cdebdab458df1cd57510","sha1":"756dd0dc63f5c42048792e0d32ce66d23237655d","sha256":"147a135387eb26ca16ca8b20206715c687eb0890e5586da4553a00ebf18f888c","sha512":"ae5c62cc674b94a971a538a8e0d67f26af26fe5b9a04d311bd791e26b6d95fd06a5a06b1a0c20a5ddc030c7d4f05d05ca56c128431e45761e615fd1123d325ac","ssdeep":"384:A6xBTNFSdVJ8L6gHMZIJ/H0NaqPxeZpMAxAsL+4zKO+2tIFf1Aac+KQQkzipB7gc:/SdVyMm1H0mDAski6I4QkMXP","tlshash":"e473a59035fd5e7cca6fca0e6877d924173856e472a1adb0b03b15c24fda9433a2261f","first_seen":"2026-01-14T15:34:41.499059Z","last_seen":"2026-02-03T16:35:49.660219Z","times_seen":2,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/e5b027d5189e80ab.css","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"GET /e5b027d5189e80ab.css HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-fogo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:23 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 16 Jan 2026 18:41:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"696a864b-8bdb\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2FsBzHtngMJ94kJMUfnJqr%2FA9zied0L2Yhh7XCZiAM6Of5QyleshQsmCPkhsurm%2BZgOWsd81B2l%2F%2BRp07mgvRy4BCC%2Fde07JEJpHf9jhdYA%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9c8357513cb24e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35803,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (35803), with no line terminators","md5":"1954cd4d7910ff3b831c6541139bd8ab","sha1":"1421048e8c0551838d6373343cf1e3f60b5a7f40","sha256":"9e6de753caf3b63afcf902802810c184cf1ff77f0e3f6e4eb7b3e68e17c90933","sha512":"defdc72d9e95b24f9cbcd7d4c77214fbcfbd072648f481ed29285ebcb7a075e0d876670e02d09ccffb6ed5a836c55bcb57765dab92f10fc05df86832a040850d","ssdeep":"384:hRqLoIFgcR6Qg1iXZPU6x4/GX74uE47HhaDgiqX8XFXgXcXPXdpbFAr6QSedy83z:AMXQSYRrAgzyAco8PFEw4","tlshash":"3bf240497e2d3f28b967a32450c084dc620b774fee7d83a7ac91235d9d8e384366c679","first_seen":"2026-01-14T15:34:41.499985Z","last_seen":"2026-02-03T16:35:49.66117Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1119,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-fogo.com/secureproxy?e=jscdn/getFile","fqdn":"airdrop-fogo.com","domain":"airdrop-fogo.com","tld":"com"},"ip":{"addr":"104.21.18.52","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://airdrop-fogo.com/","date":"2026-02-03T16:35:22.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-fogo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 16 Jan 2026 17:43:50 GMT","end":"Thu, 16 Apr 2026 18:42:15 GMT"},"fingerprint":{"sha1":"53:81:D2:E1:33:16:89:96:46:69:68:BC:26:46:0D:C6:69:F9:B4:ED","sha256":"46:C5:72:FD:D1:8B:1C:C7:74:CB:E0:30:0F:16:88:14:03:8D:D0:9C:93:09:7C:5C:55:73:55:11:4D:35:D3:01"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: airdrop-fogo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://airdrop-fogo.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://airdrop-fogo.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eo2upuit3j1bi7kc0oxl\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 03 Feb 2026 16:35:22 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JCV04tLsLakK3V8MfUVACUcGKkMes8mWg4umjLlXjhtBQLZXfApxKZ%2BHbAkezusR68PXTvHJcx50Nm3rKGP2nYIIBc692sA3xz9QD%2F6VdknPKw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncf-ray: 9c8357537d334e4c-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3410712,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"db3a6b494f9fe5243372d07e504ac9d7","sha1":"2639f37354d5ab7d6a616d663fd672b6605e1944","sha256":"0f7c94c5c750a8c8ff1b53711534b5b7efe0ca7671ab48986ef0429f7aebf406","sha512":"721f3f5573a622c7e613c6a7d81c2ba7ed2b06f144fea91cac0dc80711469133e2cf2e93c5ea75fc1a3ee1d945893631ca7b82198926a3a6dc6c742aae405f01","ssdeep":"24576:Tpb/YWmLkwsOukzMSPbg+lsVo5/Cr0OSzcfUjel7M0RGiu2U:TlGkwdNZngkO5E","tlshash":"4e2522d1bf574035cf5c1ae980ab5c0f94554e2344c9a6aee949ec4232ecfb081eb96f","first_seen":"2026-02-03T16:35:49.661955Z","last_seen":"2026-02-03T16:35:49.661955Z","times_seen":1,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":365,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"airdrop-fogo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}