{"report_id":"36a87a37-3c63-4ba9-b6a4-5a59f1a28fbc","version":0,"status":"done","tags":[],"date":"2026-09-13T08:47:32Z","url":{"schema":"https","addr":"connect-wallet.xyz/","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":0,"asn":153568,"as":"NEW DHAKA HARDWARE","country":"Bangladesh","country_code":"BD"},"final":{"url":{"schema":"https","addr":"connect-wallet.xyz/","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"title":"Wallet Connect — Connect Wallet","dom":{"size":61444,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5294)","md5":"28b145048dc30f18545480b9e6bf7abb","sha1":"8a0b73b96f460bb0e8bff09099865baf81fd5bff","sha256":"9139f6f999ea23106683f9979c69953965b4410fe2aa8199cbc3abd2d6409eed","sha512":"9a4b39646c819b87bf31a096623422362e28aa3b04ef02dbeb2f34fa8c83e006d9decbc93c6fdc10c66a63d59a4fb1f032d0dc14dab5ec1686a2872f7ab42bc0","ssdeep":"1536:n6xwSAm1bd0YxIl5H+NoZACuI8FVqlNoYCuI8FV7rhim9MAEw4:aNorWFVqlNoNWFV7rg","tlshash":"34532b57aaa301355663c71aa7eb4b9d7b60d507cc06d8387bed47904f0aac8e9933cc","dom_hash":"domhasha1af0da73d54f1b68abf82a0c02ffe0e","first_seen":"2026-09-13T08:46:30.580774Z","last_seen":"2026-09-13T08:47:32.839869Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"connect-wallet.xyz/","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-18T08:47:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cryptologos.cc","ip":{"addr":"104.21.43.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-04-13","domain_rank":572515,"first_seen":"2019-08-22T11:22:00Z","last_seen":"2026-09-04T14:39:56.567499Z","alert_count":0,"request_count":1,"received_data":55060,"sent_data":566,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"connect-wallet.xyz","ip":{"addr":"163.61.188.5","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-08","domain_rank":0,"first_seen":"2026-09-13T08:46:26.769495Z","last_seen":"2026-09-13T08:46:26.769496Z","alert_count":6,"request_count":3,"received_data":48545,"sent_data":1531,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"walletconnect.com","ip":{"addr":"104.20.35.94","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-12-19","domain_rank":13835,"first_seen":"2021-01-25T00:16:19Z","last_seen":"2026-09-13T08:46:27.382293Z","alert_count":0,"request_count":1,"received_data":5295,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"connect-wallet.xyz/","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f02c3c13cac1be3001b5f8a374b0f4ba","sha1":"a334ea6b227a767f18637229820193fd6dfc42bb","sha256":"740938ca547bd4cd3e53381d61f14392b037f5e824b893b8ad5a5f54223c38c0","sha512":"05527b9cc8af2d1c86aaab39689fb1e319ab35ca6709d7eea5c6d33c04b6f72e6ba08a2f5f06ed15b78e5ba90fa517fbf8d3573e935702cd42afb20c86322ab2","ssdeep":"384:A91NoH8tCuI8lRzBIWHnBT7nr0Ip/KY1MmhbMA/1LzawZ:qNoctCuI8lRtIIBT7r1Vhim9MAEwZ","tlshash":"31b22c27ba76023147b3471a979b5a9a3e309547944194743abccfa04f1aec4f9e33dc","size":24631,"data":"","first_seen":"2026-09-13T08:46:30.593745Z","last_seen":"2026-09-13T08:47:32.844108Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[LOG]map[actor:server1.conn0.watcher17.process7//obj25 class:Object extensible:true frozen:false isError:false ownPropertyLength:4 preview:map[kind:Object ownProperties:map[event:map[configurable:true enumerable:true value:login_page_loaded writable:true] screen:map[configurable:true enumerable:true value:wallet_selection writable:true] timestamp:map[configurable:true enumerable:true value:2026-09-13T08:47:03.081Z writable:true] userAgent:map[configurable:true enumerable:true value:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 writable:true]] ownPropertiesLength:4] sealed:false type:object]","filename":"https://connect-wallet.xyz/","line_number":713,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"cryptologos.cc/logos/bitget-token-new-bgb-logo.png","fqdn":"cryptologos.cc","domain":"cryptologos.cc","tld":"cc"},"ip":{"addr":"104.21.43.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://connect-wallet.xyz/","date":"2026-09-13T08:47:03.286Z","timestamp":1789289223286,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptologos.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 17 Aug 2026 12:11:35 GMT","end":"Sun, 15 Nov 2026 12:11:34 GMT"},"fingerprint":{"sha1":"26:1B:42:2B:F9:4E:01:35:0C:77:C4:38:A0:C9:D1:04:A9:FC:34:A0","sha256":"43:18:F4:45:0C:58:B4:C7:64:AE:55:B9:97:BA:CC:25:FD:02:2E:30:69:0D:2D:E8:A9:D4:E8:AE:B4:B2:33:27"}}},"request":{"raw":"GET /logos/bitget-token-new-bgb-logo.png HTTP/1.1\r\nHost: cryptologos.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://connect-wallet.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 13 Sep 2026 08:47:03 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\npriority: u=4,i\r\naccess-control-allow-origin: *\r\nlast-modified: Wed, 10 Jun 2026 13:50:52 GMT\r\netag: \"d432-653e688256700\"\r\naccept-ranges: bytes\r\nage: 67\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8aVm73FhQYuJOIEN%2Fglm21fMwRusD6ykvhD1K0LOlgOdntqZGm%2BeSSPCWHiJIkAqAxFZA9VquKjkinfrF3bNm0d%2BcOB3MUFgu1svdevysd%2BU5fwSmoM1j8QA6ssmWJ8XBw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3a5e28dbcfdb500-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 54322\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54322,"size_decoded":55060,"mime_type":"image/png","magic":"PNG image data, 2000 x 2000, 8-bit/color RGBA, non-interlaced","md5":"f8649d2de7e84c46e7e6d0425d35523b","sha1":"617b31724dbd7c4cfc6d5f1059351e4334041c3a","sha256":"896216666358542c90d2506cb5f1975d7027bcd7f29c9c5fa4e959067e1182d2","sha512":"51435264c49654efc1d972ec23a1f7e12f458dcf451318b1a2b5888ae247f29b7cd1bc087bc92cc616e8054d08735b3895fd87099cc07af816e96bc13accf767","ssdeep":"1536:FvMk2VSTm5fKJeKVTUPbis2e1qnkL3yEEg73Kj:Fvh2ATmFkeKVwPbbPP3yEN3w","tlshash":"a933bf9553b28767f63c5bb6c8bb4b016b6004001433e702671af61dda76a5cfeaf9c4","first_seen":"2024-12-24T01:05:45.442604Z","last_seen":"2026-09-13T08:47:32.840803Z","times_seen":51,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":5,"connect":20,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect-wallet.xyz/","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-13T08:47:02.496Z","timestamp":1789289222496,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"connect-wallet.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 17:50:29 GMT","end":"Mon, 07 Dec 2026 17:50:28 GMT"},"fingerprint":{"sha1":"0C:E0:C3:CB:17:27:B5:45:85:16:D1:8C:D5:8B:85:A8:B0:C1:8A:B0","sha256":"21:65:26:AA:1B:6C:7D:3C:E7:02:F3:EE:73:DB:09:0C:84:9C:1D:90:8F:8C:CD:BF:E8:7E:E5:6C:30:30:27:3F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: connect-wallet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.1.33\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 14120\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 13 Sep 2026 08:47:02 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":46094,"size_decoded":14523,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5185)","md5":"deaed8e2b4ff56d65355d6bfb56a3ff6","sha1":"e0d51a1a7ff8be143d6d025ff45774a999a6878d","sha256":"5a7ff1819b0f3755a68cb9b11c989a939f4da6116b2472bb24dd8eaf886e6c8d","sha512":"737f9acdcae19cc659020983ff1c76e031c294e91539ea93826c523bb5d904e4f85087e8e777b4e7e3de127535890621e2291b1a45ffab6eb046a04759f44a8a","ssdeep":"768:fk6xwSAm1bd0YxIBH5HRNoctCuI8lRtIIBT7r1Vhim9MAEwW:s6xwSAm1bd0YxIl5HRNoYCuI8FV7rhit","tlshash":"6623f916bea301255a63c659a7eb8b9d77309007c806c8783fdd57908f4aac8e9d73cc","first_seen":"2026-09-13T08:46:30.590184Z","last_seen":"2026-09-13T08:47:32.841531Z","times_seen":2,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":5,"connect":92,"send":0,"wait":185,"receive":0,"ssl":102},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"connect-wallet.xyz/submit.php","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://connect-wallet.xyz/","date":"2026-09-13T08:47:03.279Z","timestamp":1789289223279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"connect-wallet.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 17:50:29 GMT","end":"Mon, 07 Dec 2026 17:50:28 GMT"},"fingerprint":{"sha1":"0C:E0:C3:CB:17:27:B5:45:85:16:D1:8C:D5:8B:85:A8:B0:C1:8A:B0","sha256":"21:65:26:AA:1B:6C:7D:3C:E7:02:F3:EE:73:DB:09:0C:84:9C:1D:90:8F:8C:CD:BF:E8:7E:E5:6C:30:30:27:3F"}}},"request":{"raw":"POST /submit.php HTTP/1.1\r\nHost: connect-wallet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://connect-wallet.xyz/\r\nContent-Type: application/json\r\nContent-Length: 191\r\nOrigin: https://connect-wallet.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":191,"data":"{\"timestamp\":\"2026-09-13T08:47:03.081Z\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"event\":\"login_page_loaded\",\"screen\":\"wallet_selection\"}"}},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: PHP/8.1.33\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: Content-Type\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 20\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 13 Sep 2026 08:47:03 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":16,"size_decoded":593,"mime_type":"application/json","magic":"JSON text data","md5":"7363e85fe9edee6f053a4b319588c086","sha1":"a15e2127145548437173fc17f3e980e3f3dee2d0","sha256":"c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97","sha512":"a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85","ssdeep":"","tlshash":"f0600003000000a2c000220002382e202080002280000008800c20088a20000208300a","first_seen":"2023-04-05T04:17:27Z","last_seen":"2026-09-13T11:28:40.629839Z","times_seen":189103,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletconnect.com/favicon.ico","fqdn":"walletconnect.com","domain":"walletconnect.com","tld":"com"},"ip":{"addr":"104.20.35.94","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://connect-wallet.xyz/","date":"2026-09-13T08:47:03.298Z","timestamp":1789289223298,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletconnect.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 09:59:37 GMT","end":"Thu, 22 Oct 2026 10:59:29 GMT"},"fingerprint":{"sha1":"D6:0B:86:BA:73:E4:E3:B7:45:4D:AA:B4:D8:48:82:53:61:FE:DF:27","sha256":"B9:AB:EE:F7:94:9C:5E:2F:56:39:A1:C2:49:0E:FC:A9:6E:C3:0F:E2:EA:B9:37:65:61:B2:00:EF:11:6F:0D:5F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: walletconnect.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://connect-wallet.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-next-cache-tags: _N_T_/layout,_N_T_/favicon.ico/layout,_N_T_/favicon.ico/route,_N_T_/favicon.ico\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=04RNBbffkQW4UbzqFKr%2BlM4MLrcuvPaHgiCWP1ib%2BuOBuX3jqfd%2B1DzbdeZpYhcu8OMuSfh6DcwwKcfajJ%2BCJlc9%2Bs5korCkHhJjFg2EdDZuOG9%2FlQ4OZDM5V%2FOPTuvMIt0V4w%3D%3D\"}]}\r\ncontent-type: image/x-icon\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-matched-path: /favicon.ico\r\nvary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, accept-encoding\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\netag: W/\"468f85ddc98662ee9efd3b1e7fa4bf0d\"\r\ncontent-encoding: br\r\npriority: u=4,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Sun, 13 Sep 2026 08:47:03 GMT\r\ncf-ray: a3a5e28dcee2120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":1715,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"f3eb9732d279b6b059ae51337eeef1e4","sha1":"c4482861538ffb58f823feb1177245bb653c4c48","sha256":"ef683ea47212404b60534052a6d5af41034765aff0a21b498605ccec049577cf","sha512":"629a12c8e3f2e1b660fe975403c66fc3f5509556bddc5c0e663237bb50dc883ed0f99d3919b0212dfa2c44afdeb5e28cf98071c969ce8b2fdb62ea2858b0d65a","ssdeep":"24:suuz5BDcLafV6uwTN+JbeKD0N8gqQTN9gz44VsqZVWbm6MS:ePQI8TNie3N8kTN9QtZVWdMS","tlshash":"4f910b4fde242462f4e0ae72a41735ae1c04cdacd7dd32271576372e9839c89279eb43","first_seen":"2024-09-19T19:50:46.701132Z","last_seen":"2026-09-13T08:47:32.842875Z","times_seen":88,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":8,"connect":16,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect-wallet.xyz/favicon.ico","fqdn":"connect-wallet.xyz","domain":"connect-wallet.xyz","tld":"xyz"},"ip":{"addr":"163.61.188.5","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://connect-wallet.xyz/","date":"2026-09-13T08:47:03.478Z","timestamp":1789289223478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"connect-wallet.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 17:50:29 GMT","end":"Mon, 07 Dec 2026 17:50:28 GMT"},"fingerprint":{"sha1":"0C:E0:C3:CB:17:27:B5:45:85:16:D1:8C:D5:8B:85:A8:B0:C1:8A:B0","sha256":"21:65:26:AA:1B:6C:7D:3C:E7:02:F3:EE:73:DB:09:0C:84:9C:1D:90:8F:8C:CD:BF:E8:7E:E5:6C:30:30:27:3F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: connect-wallet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://connect-wallet.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Sun, 13 Sep 2026 08:47:03 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-13T10:42:40.653738Z","times_seen":155060,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"connect-wallet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}