{"report_id":"3a524eff-23d3-4dd7-9aa5-6f3a333f69b7","version":6,"status":"done","tags":[],"date":"2025-09-24T16:32:52Z","url":{"schema":"https","addr":"marinads.finance/","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"104.21.90.181","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"marinads.finance/","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"title":"$MNDE airdrop"},"submit":{"url":{"schema":"https","addr":"marinads.finance/","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"104.21.90.181","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-29T16:32:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"coinmarketcop-api.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"marinads.finance","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":68,"request_count":23,"received_data":2228355,"sent_data":11217,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]}]},{"fqdn":"coinmarketcop-api.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-08-22","domain_rank":0,"first_seen":"2025-08-22T20:51:30.781912Z","last_seen":"2025-09-23T05:07:24.677899Z","alert_count":1,"request_count":1,"received_data":0,"sent_data":453,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"marinads.finance/S81jGrO0TlW.js","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d26ecf3c40a8d0e03becf879849c8da7","sha1":"aabd1b97454e84f12620dfc60208619686ba974d","sha256":"3793a98365d21d50d4747ff94a2ec5d5e4e6f5415a6845601989ba392d0146b9","sha512":"12816483517dcd9b60bea4d4f55fc9ed9c5e388afb04c5517f89bab0b0851e2211fda855483ee5b3c6e1060bb5461a6f242125e1608b1435d0baed4ec4effb55","ssdeep":"1536:SHuohfe47k/Ha/7pb2V15a/7pb2VzUa/7pb2VNFa/7pb2Vtv3fTPHjsM/7z73bbQ:dohkCCVTCCVQCCVTCCVRLPHjsMjP3bbQ","tlshash":"f2e350bf15452399ce28a154ac31e8cde8c0ce634ed49463a7e8ddcaee5583790c3767","size":150011,"data":"","first_seen":"2025-09-24T16:32:58.039448Z","last_seen":"2025-09-24T16:32:58.039448Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"4a67de14fa6268242344433afd34c95b","sha1":"ead4106fd1106c1c053aeedddbd15737de651944","sha256":"28f1755f6b777a31aba3407f02d50117ee082f7ff850e92cf8d199b288d1149d","sha512":"c4d193b7b7f369372743506a7aefbba5643f4371dc645152499e54841c2819512637bb3c0f31004665319e380680a99cbf8f5eef8393feef50b22cc25046ce8a","ssdeep":"3072:qie4pQtr4pQte4pQtr4pQt3xxJjIMXP3Fbn:qitQgQHQwQxVXP3Fbn","tlshash":"f3d364bd1a5b67a4ce58f159bc31d6ced8c0ce2342d4a573aaf8e901ee9403790c365b","size":139175,"data":"","first_seen":"2025-09-24T16:32:58.053297Z","last_seen":"2025-09-24T16:32:58.053297Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/S81jGrO0TlW.js","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d26ecf3c40a8d0e03becf879849c8da7","sha1":"aabd1b97454e84f12620dfc60208619686ba974d","sha256":"3793a98365d21d50d4747ff94a2ec5d5e4e6f5415a6845601989ba392d0146b9","sha512":"12816483517dcd9b60bea4d4f55fc9ed9c5e388afb04c5517f89bab0b0851e2211fda855483ee5b3c6e1060bb5461a6f242125e1608b1435d0baed4ec4effb55","ssdeep":"1536:SHuohfe47k/Ha/7pb2V15a/7pb2VzUa/7pb2VNFa/7pb2Vtv3fTPHjsM/7z73bbQ:dohkCCVTCCVQCCVTCCVRLPHjsMjP3bbQ","tlshash":"f2e350bf15452399ce28a154ac31e8cde8c0ce634ed49463a7e8ddcaee5583790c3767","size":150011,"data":"","first_seen":"2025-09-24T16:32:58.039448Z","last_seen":"2025-09-24T16:32:58.039448Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"marinads.finance/6797795dd42fbbe4f18d4cdb_illustration-delegation.svg","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /6797795dd42fbbe4f18d4cdb_illustration-delegation.svg HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Q5XZT4JfqCY4OyMfoHjvQWcZ3koVcDDqUYHQl2PSgRCBQSGggJJ1fzz8zSOvsYj0Cjo9ECmdccb22R4n572O7lJ3YRHS8NspALvBmT3Odw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"34119-63ed752dc9553\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada68c45b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":213273,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e7b91e40fc5d1a54e66eec8ccd08e139","sha1":"ed1d1d3b46e7d8cff13d83037b444be40fd34e4a","sha256":"6be230245625da58725f8c03de0526a46c097be669ac185f3cf020fca983f019","sha512":"d79b952e4c1372efad380978fd5985773ddc36c4d08befbf3c97de152e9fed158a4e08cbb0817888435490c59bb751a6ca21df31b45af4c9e6e85623b283c650","ssdeep":"1536:GjI764tSVX0eV7iquo0rfUNgUzRuPCVDQrhOExcSMeb3851ELDT+:AmYZ","tlshash":"8a24dadf6f91ace68d95d3c5af5201fa321fc07f69934720c298c7347815ca9c8daa92","first_seen":"2025-09-24T16:32:58.012644Z","last_seen":"2025-09-24T16:32:58.012644Z","times_seen":1,"resource_available":false,"data":null}},"time_used":557,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":369,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/adsct-3.gif","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.023Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /adsct-3.gif HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/gif\r\ncontent-length: 43\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"2b-63ed752dde92a\"\r\naccept-ranges: bytes\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f4etfBxOZpKxLBMhFS3CbxbnwR9YlF4vDoV2R4AvppzrzqbzxhtBbM9kSBEPOMdZCriXuVtkBJWlHGzXYv4EWw%2BtyMRQkSG%2Fv8dCLU5Xrm8%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncf-ray: 9843ada1d8593181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"377d257f2d2e294916143c069141c1c5","sha1":"b7cae69682cf31dd670b65088db8395acda6ed3e","sha256":"ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957","sha512":"01211111688dc2007519ff56603fbe345d057337b911c829aaee97b8d02e7d885e7a2c2d51730f54a04aebc1821897c8041f15e216f1c973ed313087fa91a3fb","ssdeep":"","tlshash":"4e900403d3c0c001c151d0300d0cc7441344f0305554030f70fc575ddc3d1550c170c0","first_seen":"2023-04-05T06:54:04Z","last_seen":"2026-07-25T08:11:35.307414Z","times_seen":1366,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/adsct-2.gif","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /adsct-2.gif HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/gif\r\ncontent-length: 43\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"2b-63ed752dde542\"\r\naccept-ranges: bytes\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X1CkVRfVxiKyKqWiZqCjwptCyj3vOGaDi%2BZsoHApcq2WYNWSdMJmnTo0QKiSi0ZQR6I3xJmk8d4GnCip5wFU5QC%2BDn1cFGMGfuwW5thJNCQ%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncf-ray: 9843ada1d85d3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"377d257f2d2e294916143c069141c1c5","sha1":"b7cae69682cf31dd670b65088db8395acda6ed3e","sha256":"ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957","sha512":"01211111688dc2007519ff56603fbe345d057337b911c829aaee97b8d02e7d885e7a2c2d51730f54a04aebc1821897c8041f15e216f1c973ed313087fa91a3fb","ssdeep":"","tlshash":"4e900403d3c0c001c151d0300d0cc7441344f0305554030f70fc575ddc3d1550c170c0","first_seen":"2023-04-05T06:54:04Z","last_seen":"2026-07-25T08:11:35.307414Z","times_seen":1366,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinmarketcop-api.com/@v1/cdn/bundles/front-worker.js?t=29312192","fqdn":"coinmarketcop-api.com","domain":"coinmarketcop-api.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.373Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /@v1/cdn/bundles/front-worker.js?t=29312192 HTTP/1.1\r\nHost: coinmarketcop-api.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T17:42:21.256573Z","times_seen":17532132,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"coinmarketcop-api.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/index_3.html","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://marinads.finance/index_1.html","date":"2025-09-24T16:32:31.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /index_3.html HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/index_1.html\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GGatG%2FwMC8%2F%2BBtWIK%2FG8a8U6orHFK5DYsrBsHdmeRDWbAnK7oYXtNG09rrFmbxAMgV%2BRhq%2FPN1WID7XJ8MzAgU9%2FX80KRpPhlyhEp%2FaBYCc%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncf-ray: 9843ada43e0db1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":321,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"15ea5144e122451cf28886dd6b438c06","sha1":"835abda83a7a3fd36c123f6ceb76caa7bb2b8bee","sha256":"e11de8b57d9974e65b911809f5f4b14d7ab613d18addcdc2848a790f56238e52","sha512":"92481bced404c70eb30220fbadeceb7a5c8a87d3bea155a93a460614a8eb755eca984b11a561ab106ea26dd8c948b5af4838911cb7f721331c6ba5102abc4cc0","ssdeep":"","tlshash":"74e07d939751c50719a08bd15fd2f3044007dc1aa412dd70bdf2a49c64e9237d423684","first_seen":"2025-09-24T16:32:58.018221Z","last_seen":"2025-09-24T16:32:58.018221Z","times_seen":1,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/6797795eeb3cc4d091a4a432_illustration-treasury.svg","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /6797795eeb3cc4d091a4a432_illustration-treasury.svg HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lOcXuOa%2FO3tg8jRXXbDwQ9WYFVbS0FqOJ3cTNxA1%2BvRFZ%2Flq8RZfiaw7F%2FLY30LG8WVf98IYiXzIdPNmXsegCUXfxXntmgpwOlWYn8iVIFw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"475bc-63ed752dcfae3\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada68c46b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":292284,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ba01f6ddecbe48a18a4ba8423183ad99","sha1":"3f50b44e90a3cb524fe9aa5d70553113160e07a1","sha256":"273a1bd7e76f574830b87a6192d3b160cde06c710029e2d0b7a972dc5caa5f6d","sha512":"c7c6aa3241d5d7c65fb6202322c39884b26d02b372899bdf9a19f73c359b0ca9580af973229139982d842c45cad7aa0caa7e36eff71655647e6c0328aed9d0eb","ssdeep":"1536:AcAHDvaC/StOP6hKo/mzZlKlGVM7/IjDYYdhFZXvDRQ8+y1jdE/Bn+c4YxFwVCME:9V","tlshash":"e6543efe6bb21ce5eccad3d7bf4140ac7013917b68958f28c22c9e58398286c9d55dc6","first_seen":"2025-09-24T16:32:58.020284Z","last_seen":"2025-09-24T16:32:58.020284Z","times_seen":1,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":323,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/index_1.html","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.295Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AWC%2BtUsdcw7YVhfydtWCFsZp5%2FxttGjSK6Aaz2haK%2F%2Buy8l316YBE6yPpX5mlU42%2FB%2Bk9GPf9TIxiKEMrLYf1RMOdLR1138AXLLCN5FFRKI%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncf-ray: 9843ada39ca0b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":197,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"3c943f33b9de0ce30d145acfbf7ed842","sha1":"615b2af7f2507834f8f9be0cd04cfa27537eab59","sha256":"ba6b0a2b9ca4fa2cb6ee8b3d8256229105c5fc597c1c9a7f20277ebe87de7809","sha512":"870026992d22e158bbbf413e5ed8b191b07bcc18501db9544581b9bfaa94b0020c095411660fde55fb2d2933f976642f98ae4d6f7a0df25c7b99e4501dd8be77","ssdeep":"","tlshash":"dcd02272d116040ecc019ae18beae2884442d52db3105918adf437609a4d2238422b6c","first_seen":"2025-06-03T15:44:02.558498Z","last_seen":"2026-04-27T02:11:24.073014Z","times_seen":18,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/67fe23251903e5978b63f775_PPMori-SemiBold.otf","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /67fe23251903e5978b63f775_PPMori-SemiBold.otf HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: font/otf\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rDRKJo2exV%2FSC%2BGsDoVcQHyb5n7JTTUjM36vnBBG4303cZYmhA9PnPsr6vYWMMnJdW729pFgZvjVv7Ql%2FiV2sFE0po0sedRlXF6CCe%2F86EQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"10588-63ed752dd6073\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada3cd18b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66952,"size_decoded":0,"mime_type":"font/otf","magic":"OpenType font data","md5":"541788aa59c81a55bd2efe17de922df2","sha1":"afeb8a53467caf3d09be6ce34ff79ba93d5fb476","sha256":"07634962901e2a14b68cd9f8fea869cb97a7ff554fa095a8e785314c5011033b","sha512":"8eff54ae6da285d7e751f02f90c42af013517dddee76ed396a3621d8934ae1c6f86cbca6625c6e571a67bd96f99d5a8bb78273c6b1bbef383374bef5aba837a6","ssdeep":"1536:H0+rJLUtg3C0LOibxpvdNDK72xRr0fulIA4UJD+Q0:VrRkg3C0nVZ0fuebSDK","tlshash":"c663bea1bf1f635cc2cb9e365eb6c73123707b358fa6d213b458aa642dc62940d512cb","first_seen":"2025-06-29T22:31:01.388817Z","last_seen":"2026-06-21T04:26:40.899171Z","times_seen":14,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":216,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/685bee9bc9793383a56a564d_fav-256.ico","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:32.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /685bee9bc9793383a56a564d_fav-256.ico HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:32 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W1udZY7C5M4P1sqET5rTn6fP9IQpC68MuY6pNy6bHByRW5SPJWLKkWVJGvuchTTGwM7TlP9Z6C7U3eVvyZSrPGmj%2Bsze77cdzaodHrSA4Ao%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\netag: W/\"10be-63ed752ddb27a\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada90ae2b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"9056325b9ead8acd2d3728590787c6b5","sha1":"c15cbf9d46e48d46b4476a9a3de200d5329f984c","sha256":"ffbffc5b429fe4ab89d842af924027814b6cfc07c64375b4cea3c8e2752886d5","sha512":"077b9a517b774d41694f4471a33a7d29a7f22d1d1167e4817c37a3386a76160ed70537cbfeeff802f20b42d9ef2e3083e0c897db585e5860beb7190ed8ee1574","ssdeep":"24:suhnSfVwvIVo51u5lXTgQN/xWMTziq94WIJsnI/npycrs9vcLI433S2iGuk2VUoy:vStwvJ18NN9f9YHyINH9bQVVbh5vMTS","tlshash":"8191ddc1807b32cbff94807fd177032ba5d327f897682ad124e469848cc6b2d821d68d","first_seen":"2025-09-24T16:32:58.02507Z","last_seen":"2026-06-21T04:26:40.861951Z","times_seen":5,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/css.css","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /css.css HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/css\r\ncontent-length: 572\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"1ad4-63ed752ddf8ca-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bd6vzBy9HzItJEz1xoIq%2Fwc0Nu4caW%2BRpBVzBtPwxUF1G6YL9lfF%2FlNy1bwIhtFeWh4h1iBp1ad1KdoqC4PuVI1OSEp2dMgCTFLCplgA0II%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9843ada1c8523181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6868,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"c1c8c23504ae7b265e3dfc85a596698e","sha1":"a70ffccfd3a2c245e962a3eb156863690c567230","sha256":"fa281cabab72728fc113c4bae6548dba58624fe574f642cd06e13301d5a53291","sha512":"0e502bd00dff1d0057b46164ae6c8cf833c5d5226b19efb24bd4ce5226ac1ae8b3075aacb365dbe9f9216bf911cdb5a1ea6eee7d246bfb021d0f1bfd1ff49156","ssdeep":"192:Jvy8a+vk/OkBka0kvp/OpBpa0pf/MdaOG/xYaHpk/YkfkaSkc:38OgiG9OTDhX98YG0v","tlshash":"9de19a91086ea400a3932dd177cf3e329e4db2447445ad346bfe1868fc96ea593f1b4d","first_seen":"2025-09-24T16:32:58.026641Z","last_seen":"2025-09-24T16:32:58.026641Z","times_seen":1,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/index_2.html","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /index_2.html HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WnXqxM%2BjeH3vYhKDLxwngRTKkuGq9xXSh9ZI2oHNXqwD8HEmiXsKWFubeQrmACDjEnzOzFTFh0nydkg04gZodbTtBHcChqbCHhYrl%2FqLH3w%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncf-ray: 9843ada3aca9b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"948c3b0b89a440438cb10c44dfb25fba","sha1":"e4d35e5e283c4cfea043a022a3b06f0e85d231eb","sha256":"3de2c358acd98dd93f54af55a7d89ae64cca5757d76fb95ae74db8bd63389bdd","sha512":"fb5a9b43f60c13b8fa0fc50299d4083c2d3d1534753b8dc29871250020448c54f220d9ea2cad18d8515ece5afb532d23486cd870bce845d2b2d3d22630c9b7c0","ssdeep":"","tlshash":"72b01276d811080f6c50afe0cb8ae1c48400d838f0214c047ca5b180dd9c132c013a84","first_seen":"2023-04-07T21:29:48Z","last_seen":"2026-07-22T07:14:14.363103Z","times_seen":1130,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/6797795e335f7e101fb42033_illustration-adjust-pool.svg","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /6797795e335f7e101fb42033_illustration-adjust-pool.svg HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vbm7blyolkn5gdhFOXrmf4KaWxxibuk9MXUyCNURbQWKl2zRissSye4SuiOU%2Fx8o0%2F3lF%2BZZO9wfCuLjA29p0drDrrapKQJm35e5dzCS88M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"32400-63ed752dca8db\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada68c3eb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":205824,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1675c3148b89d942555a9765bd349b61","sha1":"43d71cab51841cb7dfb91179754496bad017804b","sha256":"ac4f25809024baf9c85a9f2cae9d0fd85eb8f8ceaa83a37fd555a9aef021f596","sha512":"e8dfc6a90700120bb18a693f2ad63b0341b0f9218bc3da0cb44eda7a558acc6139a5d28b18b74549cc67e8a567451781b690b0ba44e38bc2dc320db22ef22f50","ssdeep":"1536:M9B9ErWYWZlQYRLvy0RTCNPZfI7etJ7I8dSjcQSdW65g5cDQVw47g9IBNKvFpEUL:glc3D8K6a","tlshash":"3d1424ee2be616e49dede3e7af1141e5390b943f59a7c374ca04ef213412468cc45b8a","first_seen":"2025-09-24T16:32:58.029428Z","last_seen":"2025-09-24T16:32:58.029428Z","times_seen":1,"resource_available":false,"data":null}},"time_used":513,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":337,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/66522a846785e36f90ff4e56_arrow_icon.svg","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /66522a846785e36f90ff4e56_arrow_icon.svg HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fTRyRklkaj5kpx01nE21iUVgB8PmBk4QbGM561qBkDQNAI8Wb5zHrV90C4f9MwWPLAt67iJHnFz7kJSIHKKwklG6%2B2cQ%2BwlDlK1Z%2BCYfGhs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"e8-63ed752dc52ec\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada3cd01b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":232,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8b962357991f64ff6a0b254fb774c190","sha1":"05c4ed2d43ee6141aa6f6308d9cd55dd504d46ae","sha256":"460f22f5fe0bad081381dd0b2b906fc0d5a45bb1bd1df4bb00c178d8d2e2283d","sha512":"caf6d31af085cdc816862b11b40fe57750a6343ba286f028488587d318a24236a523392da22a1dc8b67de6add3871efef2c782fb176019249e1163da68d9ce54","ssdeep":"","tlshash":"8ed0a7997348cc3df2174560d35c723631ad6253814a1095aa611270a56965f6c7f9e8","first_seen":"2025-06-29T22:31:01.383039Z","last_seen":"2026-05-28T17:02:04.352472Z","times_seen":11,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/66bf6512b5385c7131f92cfe_Inter-Regular.woff2","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /66bf6512b5385c7131f92cfe_Inter-Regular.woff2 HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 108488\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"1a7c8-63ed752dc79fc\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OV2migzIehYBfFWsS3V1V8Mt7ZDB%2Bnf0Rte7JxYFRy4Hzr4%2FEOT%2BT%2BQRTyrP7dXn7p1DO0wuvNUYn1OnC%2FYQjJZiwlzcOu5%2FOUN%2Fcy9MN7g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9843ada3cd15b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108488,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 108488, version 4.0","md5":"46a1550a4bbaccd13a8eb46a359a9f89","sha1":"237befb8851c19fe6a0adce50bfe9d155384b5c4","sha256":"b6f9db9e45be20f3c1312c97fbee7ec36b7d8280f8caa4d53c9ba0408cc9997a","sha512":"33b787e9d21b30c9884624b15fd5a3fb95e5f758cc08ba06fea2f097d84e0957d4acecba6c12403a95ccc3009df59e59f7d9edd856437f5688c38fcbeba5dfd1","ssdeep":"3072:tz2KdXZlw+NUGDu0SJfaJF7cKX0sHJlGMzocs01:RRJlw+N/u07JFgwl2VI","tlshash":"a7b312133206529ef8c26b392951fd4a3c539ecbecdfad2109712717693d96613f428e","first_seen":"2023-11-20T05:40:03Z","last_seen":"2026-07-25T15:49:25.778983Z","times_seen":4821,"resource_available":false,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/67fe238c525edf681d837284_PPMori-Bold.ttf","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /67fe238c525edf681d837284_PPMori-Bold.ttf HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: font/ttf\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epy6zHMiSjQ5XxIAUh0rKLLtGubtwk%2F6R54D%2FywYkTaBXcV6%2FrsNNDQC3yUWnYMWcv9LMt54dvO6b1kVXI1ij1GZTNQwESpmmxFbLMGMi60%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"1b8c4-63ed752dd73fb\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada3ed59b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112836,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, digitally signed, 18 tables, 1st \"DSIG\", 27 names, Macintosh, type 1 string, PP MoriBoldPP Mori BoldVersion 1.300PPMori-Boldhttps://pangrampangram.comhttp://inaritype.com/","md5":"b75b1981b2fb7039130c89a466626eaf","sha1":"021d04a887e3874a9ad4d60f938e55381281fb9f","sha256":"aa2af8bb66ff1f9f590e13994086f38a9920ae112abfe09c203d5d9c59f81c87","sha512":"603a1591431cd12ac77582edd20079573d5eec410d30bd8e2cbdc72931e967cee0bfda1bc328cf5d5e46110832e161521c7ffaa790cbcdb5ea3d6e0c9264ba85","ssdeep":"1536:MB4Uq3JLy3Lv3jktWPYm3Yz6enLHpUZnDP8RH/KXKFh5fLy:vTRyzf+6ZSKXgh5jy","tlshash":"26b36d13f765d31eeb161e3806f6a37b63b8f5241b6b438ba4087ba9ecc61c44e521c5","first_seen":"2025-03-27T17:47:04.772982Z","last_seen":"2026-06-21T04:26:40.876847Z","times_seen":16,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":136,"receive":195,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/S81jGrO0TlW.js","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /S81jGrO0TlW.js HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 27086\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"249fb-63ed752de1fda-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0jEq19UUa24uK1%2FRRs7ywPztoIQ8tVo74hvwwQSIoT7vcKvp5gJy10%2Ft0tkPbwQAbBQgTkGqbaFsjIawKKmLL6KnWw5HRmV6Z3cvKTexlZo%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9843ada1c8543181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150011,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (63984)","md5":"d26ecf3c40a8d0e03becf879849c8da7","sha1":"aabd1b97454e84f12620dfc60208619686ba974d","sha256":"3793a98365d21d50d4747ff94a2ec5d5e4e6f5415a6845601989ba392d0146b9","sha512":"12816483517dcd9b60bea4d4f55fc9ed9c5e388afb04c5517f89bab0b0851e2211fda855483ee5b3c6e1060bb5461a6f242125e1608b1435d0baed4ec4effb55","ssdeep":"1536:SHuohfe47k/Ha/7pb2V15a/7pb2VzUa/7pb2VNFa/7pb2Vtv3fTPHjsM/7z73bbQ:dohkCCVTCCVQCCVTCCVRLPHjsMjP3bbQ","tlshash":"f2e350bf15452399ce28a154ac31e8cde8c0ce634ed49463a7e8ddcaee5583790c3767","first_seen":"2025-09-24T16:32:58.039448Z","last_seen":"2025-09-24T16:32:58.039448Z","times_seen":1,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":75,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/adsct.gif","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /adsct.gif HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/gif\r\ncontent-length: 43\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"2b-63ed752dddd72\"\r\naccept-ranges: bytes\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GcYeB4Az1MFb1em3bt8Bm6z6ys5ul4xDjbxAcC6cP6KtmCmcX0uRiQWlH0%2Fj6EvKlpDGmRD%2FOh%2FcT5NCtES6ACSeYY%2BdrcoJx89qiAOde%2B8%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncf-ray: 9843ada1d8613181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"377d257f2d2e294916143c069141c1c5","sha1":"b7cae69682cf31dd670b65088db8395acda6ed3e","sha256":"ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957","sha512":"01211111688dc2007519ff56603fbe345d057337b911c829aaee97b8d02e7d885e7a2c2d51730f54a04aebc1821897c8041f15e216f1c973ed313087fa91a3fb","ssdeep":"","tlshash":"4e900403d3c0c001c151d0300d0cc7441344f0305554030f70fc575ddc3d1550c170c0","first_seen":"2023-04-05T06:54:04Z","last_seen":"2026-07-25T08:11:35.307414Z","times_seen":1366,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/aFTR7PB1QTsUX8KYvumzEYOtbQ.woff2","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /aFTR7PB1QTsUX8KYvumzEYOtbQ.woff2 HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/css.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 14988\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"3a8c-63ed752ddf4e2\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ti7D%2BNCTn1ZugWDqM%2Frn0Fm%2FxjNw1nBT5PByUQZnJJOPuEX7Plst%2B8gOVKLMsGmClgKhxQeFwJBa3MlbuhYTXtLKwM5Ey3x9777BE%2BvHe3w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9843ada3dd2fb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14988,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14988, version 1.0","md5":"c4598219c4b8a5667e824d99b06100b4","sha1":"f425382cda708c7fd291568aa9681537e9596ce3","sha256":"9964608a849396bd00c4bfd7034afe03486469dcf20b4f6b8cbdfdd310369951","sha512":"cd776311d8459b366e0da070c084cfd7e3756e4cd3a35a4aab81510270e5b0c5b432225f1677f243b7f33cc691eb1f9b3fae90fbfd9238d91ca886c2ef76e513","ssdeep":"384:IquHCgBoDey5mnWYndHqLcsJDa00ti/dklCHLs9:IquHS5ITHqha00ti+liLw","tlshash":"3662c011158a8ce8affd98204b85198a70d270d9addff752863042d1ca3879c3f77d87","first_seen":"2025-06-03T07:55:52.413726Z","last_seen":"2026-07-25T16:04:03.92802Z","times_seen":2444,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":126,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-24T16:32:30.444Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:30 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\ncf-cache-status: DYNAMIC\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LO54oJ%2Bxi8yqPthnk5qyK2AJLU0XCEr4zkvFAjQcfGIvvm%2BFXXZNdFfNRZRVcdMLam9Cfz4f0%2Fo%2Bkcx3MPvpqQwzIJ%2Fyqrh3wY5kF6cA%2BCE%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9843ad9fba853181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]}],"data":{"size":181560,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (5920)","md5":"c4310df5d0fc9ea2a4bea50d7f57c9b5","sha1":"4cb550d0c1dd21fe022e40f94e1c937d32a8df63","sha256":"d2ab16d9bd14bef58e9c9ba71e12328ce4cc4e55aebd33d048cf465f68dc8ad1","sha512":"704bdb1d6f905cf9074c1047905b289be5282ae6b28ba385bda6377d143fbb4951d02bc0fa18aa88d72389a366ab0d9e95274c89050d7204ce29d38c2dd12c7b","ssdeep":"3072:G8oH1D8VRzeq05V66ad6aLTjv2W9FfK37GqyT:GvHEjTP","tlshash":"ef04e8f2b2f011e1604387e8de322a5b7f97a47bde474654b2ac5b945f82cc6cc4ad48","first_seen":"2025-09-24T16:32:58.047579Z","last_seen":"2025-09-24T16:32:58.047579Z","times_seen":1,"resource_available":false,"data":null}},"time_used":598,"timings":{"blocked":227,"dns":20,"connect":1,"send":0,"wait":137,"receive":0,"ssl":209},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/adsct-1.gif","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /adsct-1.gif HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/gif\r\ncontent-length: 43\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"2b-63ed752dde15a\"\r\naccept-ranges: bytes\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BTbW87s08CHeUQhXKDrAhKOQybvVrhPxjNWEOixYoKPFzGheA2oHRcPCHeT%2FxJXqv%2BJDhCxMdEK5vOHEjlz73GmtF%2BBXW2YEBUg2yNc2eRs%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncf-ray: 9843ada1d8573181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"377d257f2d2e294916143c069141c1c5","sha1":"b7cae69682cf31dd670b65088db8395acda6ed3e","sha256":"ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957","sha512":"01211111688dc2007519ff56603fbe345d057337b911c829aaee97b8d02e7d885e7a2c2d51730f54a04aebc1821897c8041f15e216f1c973ed313087fa91a3fb","ssdeep":"","tlshash":"4e900403d3c0c001c151d0300d0cc7441344f0305554030f70fc575ddc3d1550c170c0","first_seen":"2023-04-05T06:54:04Z","last_seen":"2026-07-25T08:11:35.307414Z","times_seen":1366,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/67fe238c15d8a99ebf31f85e_PPMori-Regular.ttf","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /67fe238c15d8a99ebf31f85e_PPMori-Regular.ttf HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: font/ttf\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1BOql2D2UiwS%2FZm%2B8Q8ljHuk6FD%2F083IkbOVCaALZRR1shuP6J7yJBg84fZUxJ53nXsuph5V5hRgaF6LbLug%2BBSzZTdmAxVO17bAmdcE0ec%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\netag: W/\"189a0-63ed752dd6c2b\"\r\ncontent-encoding: br\r\ncf-ray: 9843ada3dd34b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100768,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, digitally signed, 18 tables, 1st \"DSIG\", 27 names, Macintosh, type 1 string, PP MoriRegularPP Mori RegularVersion 1.300PPMori-Regularhttps://pangrampangram.comhttp://inarity","md5":"595973f18277cff08485cf584d9bc2e0","sha1":"355c98549a41ddcbe9eaa0a2941a1707674d2a49","sha256":"33c5d2b235f3b3fa9fa5f4f0d81d535b65e03fe7e8b473f2406015c19df76202","sha512":"84154803c4f1d0395e611ecb39be6d7377916087a77e3e8a57c8f2ae5165061d2c88b4af5dead09c91c4268157309ba6ff47cbc30fd195e9fe3985702b8d51d1","ssdeep":"1536:QfjrETJLku3GVikW7M/JT4HzN+xQfwEKE0uzHh67QIH3t5HFl5fLy:nRl3AQioHQ3t5ll5jy","tlshash":"caa36b07f315d75ed60a1e3d06f6a37a53b8f9352a67c34fa4443aaaecc90d40e512ca","first_seen":"2025-03-27T17:47:04.778162Z","last_seen":"2026-06-21T04:26:40.909059Z","times_seen":21,"resource_available":false,"data":null}},"time_used":525,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":310,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/687e49649e2b296b1e3f36c3_ab131a341d70787c1fca7a0eef32586ed6503d9d.webp","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /687e49649e2b296b1e3f36c3_ab131a341d70787c1fca7a0eef32586ed6503d9d.webp HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: image/webp\r\ncontent-length: 272090\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"426da-63ed752ddbe32\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SqsVHFTflPF5Bkzq0Z2JZYQJJJrYzQvF1UwcomMr%2FMxzccBlgufCwyZYJoejxbTLstlmdHGxmfkUMamqKlnJg3KDuwsQoTReqiqxuWmMKXg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9843ada41dccb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":272090,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7827ef51eaf36309d8970d1e19da5349","sha1":"61b17fffbb70bb00fb6fb0536a1c7a1ad4f75aa3","sha256":"fd2212534c25607ad6ddfa7ca4de3a516f1592b97afd85030a53b317698582d1","sha512":"7640c6191d848c61c7d01e37ccad2e92b6c74e874d46cc53a717244e5a020e453f58a6d4a28cce05c3afd1350b25e2510bf55b0b3b2e8360eac6473269d04593","ssdeep":"6144:Ke/Nn6ndBjfZi32kAw1lNkcwJ9yW+85PLgFJvOTrr/9VjLG/hbrkd:XSBjfkAUlNdwmYcnOTH7+Jg","tlshash":"4e4423bed92d696acd953e809a19252fdf624f10e57211cf375ffc1486388268382d4f","first_seen":"2025-09-24T16:32:58.050655Z","last_seen":"2025-09-24T16:32:58.050655Z","times_seen":1,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":130,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/marinade-staging.webflow.shared.69ac92276.min.css","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /marinade-staging.webflow.shared.69ac92276.min.css HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/css\r\ncontent-length: 49794\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"50801-63ed752de180a-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lzVxsAjoCuDZuOBfxBbMGHKmgdwwRSJja0hpFCvP%2FBtleLdgYkvmPyyd6rCrijEDBugbikUcBTjv19aYTkGR%2FezcjA6SX%2FHvihqIZ3ygcsI%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9843ada1c84f3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":329729,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65524), with no line terminators","md5":"f273581449b80ecabc6e7d75b9666a5c","sha1":"4b40a9e3c4e77bce54afd43bedbe0a7a9675e560","sha256":"0ea3bc2ddc323d33475f50dace8e51749c9f88c727e6cba10bf7f49770b9544c","sha512":"f1377b5aabeb7b89da8ea8abf9c67de479a6625379b61170792722123f753788d1deca9215cdba06c625072e4603949158549eac21c950b36ad09f1f64c2632e","ssdeep":"3072:D2QiqEI0CYz0hBiT0w94SjCkTIC+SiusZ7CXQ:It+60hBiT0w94S3TICniusZ7CXQ","tlshash":"0464b71a6f68761db82b8476d5f1bb8c5014904ac65343eef153e5268dcb2c33b73aac","first_seen":"2025-09-24T16:32:58.051919Z","last_seen":"2025-09-24T16:32:58.051919Z","times_seen":1,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marinads.finance/S81jGrO0TlW.js","fqdn":"marinads.finance","domain":"marinads.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://marinads.finance/","date":"2025-09-24T16:32:31.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"marinads.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Sep 2025 22:07:25 GMT","end":"Sat, 13 Dec 2025 22:45:25 GMT"},"fingerprint":{"sha1":"57:76:9B:E8:F6:AB:C9:10:65:00:8D:17:27:44:CF:2F:03:77:87:6D","sha256":"3E:2D:D0:EE:CF:AD:5A:44:A8:52:17:E1:94:27:F6:02:69:E5:5E:77:8C:0F:0C:7A:18:DE:4E:F6:94:DC:0A:21"}}},"request":{"raw":"GET /S81jGrO0TlW.js HTTP/1.1\r\nHost: marinads.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://marinads.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 24 Sep 2025 16:32:31 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 27086\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors 'self' https://YOUR-EMBEDDER.example\r\nlast-modified: Mon, 15 Sep 2025 13:53:09 GMT\r\netag: \"249fb-63ed752de1fda-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bAcHhdXXUj5LgrwxXxtagk3O%2BVUtMAIRIzuoddW2xPoalkD5ayxVYRHxWU%2FLrcUYqL8oFZPbpb4A0B3jbQXJN84x%2But1ySOJVXR11GtV3GI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9843ada36c3bb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150011,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (63984)","md5":"d26ecf3c40a8d0e03becf879849c8da7","sha1":"aabd1b97454e84f12620dfc60208619686ba974d","sha256":"3793a98365d21d50d4747ff94a2ec5d5e4e6f5415a6845601989ba392d0146b9","sha512":"12816483517dcd9b60bea4d4f55fc9ed9c5e388afb04c5517f89bab0b0851e2211fda855483ee5b3c6e1060bb5461a6f242125e1608b1435d0baed4ec4effb55","ssdeep":"1536:SHuohfe47k/Ha/7pb2V15a/7pb2VzUa/7pb2VNFa/7pb2Vtv3fTPHjsM/7z73bbQ:dohkCCVTCCVQCCVTCCVRLPHjsMjP3bbQ","tlshash":"f2e350bf15452399ce28a154ac31e8cde8c0ce634ed49463a7e8ddcaee5583790c3767","first_seen":"2025-09-24T16:32:58.039448Z","last_seen":"2025-09-24T16:32:58.039448Z","times_seen":1,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"marinads.finance","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}