{"report_id":"40e23985-e591-4f52-a112-83c390029587","version":6,"status":"done","tags":["suspicious"],"date":"2025-08-14T20:11:10Z","url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"title":"Biggest CRYPTO giveaway of $150,000,000"},"submit":{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-18T20:11:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":3,"urlquery":2,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.13","port":41932,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)","source":"{\"timestamp\":\"2025-08-14T20:10:51.117240+0000\",\"flow_id\":645100913515308,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":41932,\"dest_ip\":\"34.117.59.81\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2025331,\"rev\":5,\"signature\":\"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Linux\",\"Mac_OSX\",\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2018_02_07\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2024_09_19\"]}},\"tls\":{\"sni\":\"ipinfo.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1606,\"start\":\"2025-08-14T20:10:51.088876+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.13","port":55330,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-14T20:10:51.376917+0000\",\"flow_id\":54826378144033,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":55330,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":918,\"bytes_toclient\":4500,\"start\":\"2025-08-14T20:10:51.338209+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.13","port":55316,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-14T20:10:51.379673+0000\",\"flow_id\":1808317643696236,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":55316,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":789,\"bytes_toclient\":4500,\"start\":\"2025-08-14T20:10:51.338028+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-08-14","alert":"Detects file containing Telegram Bot API","trigger":"trump-reward.com/scripts/visitor-logger.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-08-13T15:26:13.000794Z","alert_count":0,"request_count":1,"received_data":20700,"sent_data":452,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ipinfo.io","ip":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2013-04-23","domain_rank":1327,"first_seen":"2013-12-16T07:25:53Z","last_seen":"2025-08-08T17:49:33.137404Z","alert_count":0,"request_count":1,"received_data":650,"sent_data":433,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2025-08-12T11:56:20.71279Z","alert_count":0,"request_count":2,"received_data":748,"sent_data":1135,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2025-08-13T16:12:30.021605Z","alert_count":0,"request_count":1,"received_data":88169,"sent_data":424,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"cdn.rawgit.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2014-03-20","domain_rank":102096,"first_seen":"2017-01-30T05:42:07Z","last_seen":"2025-08-08T18:22:25.500209Z","alert_count":0,"request_count":1,"received_data":20927,"sent_data":447,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"trump-reward.com","ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"2025-02-06","domain_rank":0,"first_seen":"2025-08-14T20:11:10.299351Z","last_seen":"2025-08-14T20:11:10.299351Z","alert_count":14,"request_count":12,"received_data":254077,"sent_data":5329,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]}]},{"fqdn":"unpkg.com","ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-01-06","domain_rank":1093,"first_seen":"2016-01-07T23:26:01Z","last_seen":"2025-08-13T16:35:58.871998Z","alert_count":0,"request_count":4,"received_data":87845,"sent_data":1722,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.13","port":41932,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)","source":"{\"timestamp\":\"2025-08-14T20:10:51.117240+0000\",\"flow_id\":645100913515308,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":41932,\"dest_ip\":\"34.117.59.81\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2025331,\"rev\":5,\"signature\":\"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Linux\",\"Mac_OSX\",\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2018_02_07\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2024_09_19\"]}},\"tls\":{\"sni\":\"ipinfo.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1606,\"start\":\"2025-08-14T20:10:51.088876+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.13","port":55330,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-14T20:10:51.376917+0000\",\"flow_id\":54826378144033,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":55330,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":918,\"bytes_toclient\":4500,\"start\":\"2025-08-14T20:10:51.338209+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-14T20:10:51Z","timestamp":1755202251,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.13","port":55316,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-14T20:10:51.379673+0000\",\"flow_id\":1808317643696236,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":55316,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":789,\"bytes_toclient\":4500,\"start\":\"2025-08-14T20:10:51.338028+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"7cf8fa5b4a50fa03989533766f4ae199","sha1":"985d129f5e582d0b433099581f79665c72b9fdcb","sha256":"b8b1349e23c66314f308c7504058acb55d316799aff8d2107449376819b9dd18","sha512":"f90379ed3e29a5d8ba2f8b5bef58fb13c080b6d78b99d3a16f3aaeea0b0d99612760fd3d7957e825b2ddaf47fb9c22b5239e2cc3aff8536948417de190d16cec","ssdeep":"","tlshash":"6fd0223faf1219300377a4262b1fe302233600032016d809ba7c06841f84b045422984","size":259,"data":"","first_seen":"2025-08-14T20:11:12.526388Z","last_seen":"2025-08-14T20:11:12.526388Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"7cf8fa5b4a50fa03989533766f4ae199","sha1":"985d129f5e582d0b433099581f79665c72b9fdcb","sha256":"b8b1349e23c66314f308c7504058acb55d316799aff8d2107449376819b9dd18","sha512":"f90379ed3e29a5d8ba2f8b5bef58fb13c080b6d78b99d3a16f3aaeea0b0d99612760fd3d7957e825b2ddaf47fb9c22b5239e2cc3aff8536948417de190d16cec","ssdeep":"","tlshash":"6fd0223faf1219300377a4262b1fe302233600032016d809ba7c06841f84b045422984","size":259,"data":"","first_seen":"2025-08-14T20:11:12.526388Z","last_seen":"2025-08-14T20:11:12.526388Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/scripts/visitor-logger.js","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"66daf652297972e207fbdec8a6467bfc","sha1":"396b9e8e90d27011ff6bdcb7d1addfb24aa4967f","sha256":"32d9c9938ee4944f5c98fe8bbbc07528cc7544fc65550aa318d3972fd410ea0f","sha512":"f0a70504e437ea93f5031c1fbd665c871b32eb7f6b2334c74dc436fc4427f7d22d688f7bfd41ded99d1be10125021e7fc7edf01d2f15ec876a3d912a2cbf9f49","ssdeep":"96:RpTo19Zy9dhgVET+B8mQENxgY+T1CdwvA+BRmqH5Rt21wGR3hTl:RpTb1g2+8VdZhA+nHF21wqdl","tlshash":"cda1345862bb2d35066f628e3f47a110310af01b6c86f866bead47c41f5e7385971bb8","size":4653,"data":"","first_seen":"2025-08-14T20:11:12.510736Z","last_seen":"2025-08-14T20:11:12.510736Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-08-14","alert":"Detects file containing Telegram Bot API","trigger":"trump-reward.com/scripts/visitor-logger.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.7.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-16T16:18:08.828137Z","times_seen":186197,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ab8f61a3c6e3ed40b2975b816f053657","sha1":"c97112fbf66420b1706705cd1d0e4214164809b3","sha256":"7496b0c3ff5102a43cec26bde1b80a21487ce6492cca96f9cbbe85d9bd4c962e","sha512":"dc6c7eb2608a55c06deb0248341d6f01144709a47eea953c1ad978fcfddcc112cbb354376ab55acfa8d3ccb5b5658ca4f3b797c41a1b438b39ab53ac3e445f7e","ssdeep":"","tlshash":"ee01eb2a217a18320a7bb576930fa684792328077081dc4f7f1d8fcd0fc2ac9c8324d6","size":773,"data":"","first_seen":"2025-08-14T20:11:12.527432Z","last_seen":"2025-08-14T20:11:12.527432Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/aos@next/dist/aos.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"aa20b6e0418d20fb86b071e670b2b207","sha1":"e38950c1bce65e9f048e305b3567ff90a0c923e3","sha256":"dd1f9acf13b12f189da475e0f23c7c505767859ab620aac636964974093c281d","sha512":"b6734ce8f3cd3957d9e6c18fc3a853842adc5017aab76995124dc4023f2d0adb8c1ea6ee566e7f1ec65a82bafc5b669a144fbaaca201c86c106c49e6a1dad856","ssdeep":"192:mOaHX24ysbeCVXVyILkYmTpOIytlomlBpOIVtlomlrjm5bovo5FglaZW0fNacZgu:mVpyRSVLL28HVjkFglMfNaEg+l","tlshash":"91520adc7286f166475394bb417f610bf2f154a4684d8040e239c5e73eb989aca33eae","size":13800,"data":"","first_seen":"2023-03-07T01:06:30Z","last_seen":"2026-08-16T10:52:40.396383Z","times_seen":10972,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.rawgit.com/davidshimjs/qrcodejs/gh-pages/qrcode.min.js","fqdn":"cdn.rawgit.com","domain":"rawgit.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","size":19927,"data":"","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-08-16T16:32:55.884001Z","times_seen":66473,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/scripts/main.js","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"35b76749761ff3c3d73ca2a1c81e0cae","sha1":"4da5351a413a40764bd7e3a9ce5c7ae07996e3aa","sha256":"e168b3863db45580415513721d9f9f78da687d641e2af6076e46b8ebeca96b48","sha512":"92d613f86c8fe9f82926fd599c9da19135c03d01be8042c624fdd39c2b528bf6c992c6759136aab65c4f1146ec68cf7d2dcea99f99fe90277b1d4d9a6bca270b","ssdeep":"192:oTHx2IrRzbnRJ2yiasUSMIwaCJgCZilwlZ5ZbqiVmERymaL:uvRzbnL2yiajaCsP","tlshash":"f0d1611435f22071125bf0692bef480579bae81b3d06dd6a7e8cc2520fe58ace4fbd49","size":6446,"data":"","first_seen":"2025-08-14T20:11:12.524098Z","last_seen":"2025-08-14T20:11:12.524098Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"25cd862770acbc8b2dce9b26af2a8468","sha1":"0c751fadaf2d7fe20d175eb62640a342d689e551","sha256":"38cc3078a624d54b5ce9d11606ece4d0e13e9cbf78924bc16b7a10fa081456d9","sha512":"904f3989a91359cc633d5cfbda7cae7372e15a674586668b7aeaa686b90de2dda8ba55390326789ad35c48bfe00e45b0eb9e700aa56808c7ba6c194a7eceb44d","ssdeep":"","tlshash":"ffe0c73a36b380240663dc2a02aa9e083a6e201b0986ca613e2c840c9f91ac2f4d06c2","size":353,"data":"","first_seen":"2025-08-14T20:11:12.52858Z","last_seen":"2025-08-14T20:11:12.52858Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"trump-reward.com/styles/custom-styles.css","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /styles/custom-styles.css HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 28 Jan 2025 05:58:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"67987206-9b56\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39766,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"838080a3e9226b0008971ba947c7dc86","sha1":"e2c2e78db731840115cbf088474724e326f7a2b7","sha256":"b10a2bd12890ff281b9351c632ea35cd637d96dc61d6dcd2fee9cdee127d8406","sha512":"8676d0daca6c084714c48fd64c29c629006defc5e76f17553184d2c5720752b7c44202df7a2d913dd90f3cc24e21688643d41f1f59034a8d924fea7fb520bb96","ssdeep":"768:/v6FQFJQZFVFQFs2Rhg382WKS5IJ9mcW1YyD:X6OA7OFhg382WKS5IJLU","tlshash":"5703225656a31955b81be16caff78709236c9047980fcd6e3b8e32489f4d1ecd163f88","first_seen":"2025-08-14T20:11:12.508333Z","last_seen":"2025-08-14T20:11:12.508333Z","times_seen":1,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/aos@next/dist/aos.css","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Jun 2025 07:12:29 GMT","end":"Thu, 25 Sep 2025 08:12:28 GMT"},"fingerprint":{"sha1":"74:03:6D:4D:8D:B7:AF:5F:95:BA:97:8E:E3:FA:63:4F:20:FD:29:80","sha256":"69:54:C9:A2:F1:AD:43:49:96:12:57:59:D0:D2:97:F9:C2:07:C3:04:1D:97:3B:AD:07:2B:41:AD:FE:E3:99:2F"}}},"request":{"raw":"GET /aos@next/dist/aos.css HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 45\r\ncf-ray: 96f319103d7707e7-ARN\r\nlocation: /aos@3.0.0-beta.6/dist/aos.css\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28765,"size_decoded":0,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T16:31:29.758893Z","times_seen":17920984,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":17,"dns":0,"connect":8,"send":0,"wait":36,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/scripts/visitor-logger.js","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /scripts/visitor-logger.js HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Thu, 03 Apr 2025 13:51:07 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"67ee924b-122d\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4653,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"66daf652297972e207fbdec8a6467bfc","sha1":"396b9e8e90d27011ff6bdcb7d1addfb24aa4967f","sha256":"32d9c9938ee4944f5c98fe8bbbc07528cc7544fc65550aa318d3972fd410ea0f","sha512":"f0a70504e437ea93f5031c1fbd665c871b32eb7f6b2334c74dc436fc4427f7d22d688f7bfd41ded99d1be10125021e7fc7edf01d2f15ec876a3d912a2cbf9f49","ssdeep":"96:RpTo19Zy9dhgVET+B8mQENxgY+T1CdwvA+BRmqH5Rt21wGR3hTl:RpTb1g2+8VdZhA+nHF21wqdl","tlshash":"cda1345862bb2d35066f628e3f47a110310af01b6c86f866bead47c41f5e7385971bb8","first_seen":"2025-08-14T20:11:12.510736Z","last_seen":"2025-08-14T20:11:12.510736Z","times_seen":1,"resource_available":true,"data":null}},"time_used":467,"timings":{"blocked":303,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-08-14","alert":"Detects file containing Telegram Bot API","trigger":"trump-reward.com/scripts/visitor-logger.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"trump-reward.com/images/XRP.svg","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.268Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/XRP.svg HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:51 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Wed, 29 Jan 2025 11:00:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"679a0a40-1d8\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":472,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"639b151a2217fe161ce8042566cacec9","sha1":"64e49a6afb3c8b84342c50821b0db39defad887e","sha256":"7ef9f0d812984cb142e870166076e2221266528206274b080a2f0035ade4224a","sha512":"bf722bc3adaa6bcb2693f989959f36dba411d725b35c0ad08d4cdb96bfbdd67b52b7532d08c9ebfeca2c0559dfb3179cb44fe573aebd462ec0f6ec17dc1a4817","ssdeep":"","tlshash":"b6f0dc7f93459df4f11ac37e6c887680a0b3b0408a9c80dda3c13d232104c626032615","first_seen":"2024-08-20T15:05:04.276138Z","last_seen":"2026-08-16T14:58:11.444829Z","times_seen":752,"resource_available":false,"data":null}},"time_used":3204,"timings":{"blocked":1510,"dns":1189,"connect":165,"send":0,"wait":166,"receive":0,"ssl":172},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/images/SOL.svg","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/SOL.svg HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:51 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Sun, 19 Jan 2025 15:35:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"678d1bb8-843\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2115,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"84838738b1637903933de832872c82d9","sha1":"09169493c23b6495a1e817d44dc4e8e2c450d951","sha256":"9649b6dd24e2fd9c2c58bb9bc8a618f9407e20bf8e6d18b27b01469b27de5fd3","sha512":"33977e95d884f6f02abfd2adb9db399ec5a05b3839d5e921531037dc4b60897ff2072fe30cc6d133510f44fadf629ed1b4693734b821d0d47353ffc92bdab721","ssdeep":"","tlshash":"a641e2189f29f6e9e5c25be0981ae955a55278f33a414471cbd43297c0a32fc9c32ec3","first_seen":"2025-08-14T20:11:12.512628Z","last_seen":"2026-03-12T17:37:37.547479Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3377,"timings":{"blocked":1591,"dns":1190,"connect":207,"send":0,"wait":176,"receive":0,"ssl":210},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/davidshimjs/qrcodejs@gh-pages/qrcode.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /gh/davidshimjs/qrcodejs@gh-pages/qrcode.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://trump-reward.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: gh-pages\r\nx-jsd-version-type: branch\r\netag: W/\"4dd7-LQbB+CPzTBmYHGrgsOsPWGHF4Us\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\nage: 3512\r\nx-served-by: cache-fra-eddf8230091-FRA, cache-hel1410025-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 7413\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19927,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (19927), with no line terminators","md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-08-16T16:32:55.884001Z","times_seen":66473,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":61,"dns":1,"connect":26,"send":0,"wait":28,"receive":1,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/images/ETH.svg","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:52.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/ETH.svg HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:52 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Sun, 19 Jan 2025 15:35:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"678d1bb8-32c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":812,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c3e653b491248f87f7d445414fa05230","sha1":"c5fb7624d63c2c868e787fbd9c429563349fcb4d","sha256":"56d411ae3e56d78fe8ea022824da86f7cc3155533b7909182a507199b401b9f4","sha512":"1cb05dbcdbbee15b21341b72a8aa91b3444ff34d05ddba22f69e27bccc9e790fb68cbdb7e53810aba436adde75e69829c6112272ec3c35b86682c91d94c978ed","ssdeep":"","tlshash":"7e016d50125897f54a04434cda5eb07d987260c9a9f4c0a194cbaf3ff860eab0dd5ecb","first_seen":"2024-08-20T09:13:27.284188Z","last_seen":"2026-05-27T18:55:48.408478Z","times_seen":27,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-14T20:10:48.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 01 Feb 2025 07:15:38 GMT\r\nETag: W/\"40b7-62d0f6d133a80\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]}],"data":{"size":16567,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e8742d18f4e5ac6a89b19ca13fa55249","sha1":"3f3682791436eb8fee5f18f526c01b2ae74fc65b","sha256":"f6209fac2cfa0b5ee60962f4c28e1e64af3a850d7cbbd12e05b93b5e14309351","sha512":"96bd6efb8d49f5b2ebbe7d5ab2f5815d4fe974db7283fb37ccbdd7e1723e3cfc575bcd9a699af961900237edf723c7a08207ca0684bab32184995940dac8964a","ssdeep":"192:aodAOhmcSM5r+y7aChAGn/fgVzdH5lu32RLNqJfEcNCEEUWE0csHU+5Jc++hA5:lAOPnay7aChAGn4zhofnCWWqsWK5","tlshash":"d3721e2065f520370093d1d26b36af1b3fe9e483d54a82447aed0be84fe6edadc23554","first_seen":"2025-08-14T20:11:12.516028Z","last_seen":"2025-08-14T20:11:12.516028Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3788,"timings":{"blocked":1800,"dns":1470,"connect":163,"send":0,"wait":185,"receive":0,"ssl":168},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipinfo.io/json","fqdn":"ipinfo.io","domain":"ipinfo.io","tld":"io"},"ip":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:51.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipinfo.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Jun 2025 04:48:58 GMT","end":"Wed, 17 Sep 2025 04:48:57 GMT"},"fingerprint":{"sha1":"88:A4:4C:CB:13:BE:CA:B3:D3:96:C9:57:6A:11:AC:45:CA:0A:83:02","sha256":"EF:82:82:40:9D:7E:6E:0E:29:F7:26:8C:BE:6F:45:5A:78:DB:02:37:8A:E8:EA:95:39:17:EF:02:A4:05:30:B2"}}},"request":{"raw":"GET /json HTTP/1.1\r\nHost: ipinfo.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://trump-reward.com/\r\nOrigin: https://trump-reward.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: gzip\r\ndate: Thu, 14 Aug 2025 20:10:51 GMT\r\nvary: accept-encoding\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=2592000; includeSubDomains\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":280,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"adf22d9a8ca3a97a9ff78909b8702358","sha1":"f5046826566a7e98d6b5e5c7b0a65677c3bde708","sha256":"756edd1454b049c1370e83c864bc93dfdd82f44d8f9752b3068e5a11867a5de3","sha512":"182391c8c01e54481853a09aa4cf8072496850e45863b198721d0d572e3aa93d8fe11a90bfb24cf97fa64cc132f1594c379474db65db5a1d2207694f770443b9","ssdeep":"","tlshash":"c3d02b6621341b37aeed455c8406960622656e1f1642369f0fe72b0c100c87334f03ae","first_seen":"2023-04-17T17:28:07Z","last_seen":"2026-06-07T07:46:18.554959Z","times_seen":58786,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":53,"dns":14,"connect":12,"send":0,"wait":142,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot7244148256:AAG0CCBwZafqRsomvsZFLst_yLYLkoFqkwA/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:52.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 25 Mar 2025 13:09:41 GMT","end":"Sun, 26 Apr 2026 13:09:41 GMT"},"fingerprint":{"sha1":"8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D","sha256":"80:58:CE:C7:28:68:D2:99:42:91:1E:43:06:54:D2:D6:F0:9C:DD:E2:F7:6F:68:A0:8A:EA:0C:15:FB:DB:8C:CD"}}},"request":{"raw":"POST /bot7244148256:AAG0CCBwZafqRsomvsZFLst_yLYLkoFqkwA/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://trump-reward.com/\r\nContent-Type: application/json\r\nContent-Length: 286\r\nOrigin: https://trump-reward.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 401 Unauthorized\r\nserver: nginx/1.18.0\r\ndate: Thu, 14 Aug 2025 20:10:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 58\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6ae1b54e98226870d93f3305dbe946d4","sha1":"5d4d6a7d7c61697e96f98fd8f40f3cdedfad8ace","sha256":"5b8cd38cfdf83e8d0a46af7c34ecb2962621aa69f6eb8458e7c86ac7a66a2948","sha512":"67c885efe6bf32a953d5dfa4773b0dfdb96716d8ec76ebd6560f1d570e6f3a1da06ba2067d7f8401f70793eabc2d3f37af0e58cf0b9510757c1be316367e71e6","ssdeep":"","tlshash":"07a002080d8c95abb49b02345928941985b782bca51964528d51921951831dd5862905","first_seen":"2023-04-20T18:22:28Z","last_seen":"2026-08-14T13:18:07.36209Z","times_seen":561,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/images/666.avif","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/666.avif HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:51 GMT\r\nContent-Length: 176590\r\nConnection: keep-alive\r\nLast-Modified: Tue, 28 Jan 2025 04:55:46 GMT\r\nETag: \"2b1ce-62cbd0181f880\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":176590,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"bbabf71af2454f675091ff26b89ab233","sha1":"d87a2a66f6837773d65e1f20073b6ec1164f5543","sha256":"7f3a401917e889fc6d8a631793d39cd0a979f3a67f9d5ae8263992d551ea3e47","sha512":"b3addecdde7b65a36a5d4a0dc63cd0ad96cee36a566c480795c0e7b9aefcaece744021b9aac4ed19986a3d3decda6336f18eb33c227cd209d16c2fe40d4e9b91","ssdeep":"3072:Po3A1D79HMAjO7TtgAEa1n9bmZIoplLrgtqaYDRWiQUNzbwd1:PoOD9MAjGgAJKlngtqRMUhwd1","tlshash":"900423dd77aca97ae946c1b822b37e95211f80139864a9bb5d81e94f0fc4102df0b377","first_seen":"2025-08-14T20:11:12.518667Z","last_seen":"2025-08-14T20:11:12.518667Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1463,"timings":{"blocked":792,"dns":0,"connect":0,"send":0,"wait":176,"receive":495,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/images/BTC.svg","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/BTC.svg HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:51 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Sun, 19 Jan 2025 15:35:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"678d1bb8-5ca\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1482,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d1bc01539433112b8258c192aa91baed","sha1":"e26e03f2eba1260c26575bc564c5be8c15ca3aed","sha256":"dd9daf5c8a5ef27b54f2b7ae0094ee0d90d10a5b9f95625d87ce03d99f149c95","sha512":"dd5f467b04b656f88a0234d5ef6213da02a6fddaf0b36e7d346ae7d0fb8f292912051076681d670b912693c42ce0d6fb1b90556dd76b6080a61b3647bc1cf2b4","ssdeep":"","tlshash":"5931429292e6b3bcd109d370912ebc393dd65cf53604c12d06c95692a63249e48efcc7","first_seen":"2024-08-20T09:13:27.28154Z","last_seen":"2026-05-27T18:55:48.392208Z","times_seen":26,"resource_available":false,"data":null}},"time_used":1856,"timings":{"blocked":1517,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":173},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/styles/QRCode-D0GVO_sN.css","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /styles/QRCode-D0GVO_sN.css HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sun, 19 Jan 2025 15:35:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"678d1bb8-237\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":567,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (566)","md5":"b4d51975303d3b1b2be3eaf557eb2405","sha1":"c33208ba6ef912353a16b59faeca2687fafe2f78","sha256":"8b113dd83ef1b2969525e135e58c81c8e695dde5a8ae55d3a20cef35cd7d51a3","sha512":"b8a5c46d65ebe3598e117fe39d1a91b3c14efdb3d2d2175f29e549a4d2ee1afd3744c1744455a8da1a4b3e991fbd330191a008b16196ec593f5da81673db60e4","ssdeep":"","tlshash":"f7f0e1baa200014cdd17ceb830ec8bfd80b2ef20693218baf6c0725e0d5351d5a732d6","first_seen":"2024-08-20T02:56:13.298818Z","last_seen":"2025-08-14T20:11:12.520976Z","times_seen":3,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/styles/inline-styles.css","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /styles/inline-styles.css HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 28 Jan 2025 03:40:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"679851ac-2e0\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":736,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"71cb2892629cb06de0ce11d158bdcf5a","sha1":"a0522d5ead163d3cacd2c61988215a1a6f92e76d","sha256":"9225bb2713fb274e2f286c90169458c067da93e507ccd08b65e741b85d524c6b","sha512":"2735f04849068cb7877c71cc1ec7ae03d6716eeaf6c91799af14904515acb4f5cfa68c6a65f8e780e2c0d82a6fee0ed95f2df34623bb95ae523415d5c64ee002","ssdeep":"","tlshash":"4d0170910a8b2909b95be0941ff10719719ec097d246c86e77c833864f9a288d4b3fd5","first_seen":"2025-08-14T20:11:12.522334Z","last_seen":"2025-08-14T20:11:12.522334Z","times_seen":1,"resource_available":false,"data":null}},"time_used":639,"timings":{"blocked":476,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.7.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.7.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-155ed\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\nage: 2527693\r\nx-served-by: cache-lga21978-LGA, cache-hel1410031-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 27, 262687\r\nx-timer: S1755202250.332140,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30336\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":87533,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-16T16:18:08.828137Z","times_seen":186197,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":53,"dns":0,"connect":26,"send":0,"wait":26,"receive":8,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.rawgit.com/davidshimjs/qrcodejs/gh-pages/qrcode.min.js","fqdn":"cdn.rawgit.com","domain":"rawgit.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.257Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.rawgit.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 Aug 2025 14:12:14 GMT","end":"Sun, 09 Nov 2025 14:12:13 GMT"},"fingerprint":{"sha1":"85:9F:7F:B8:36:46:3C:D4:F1:F1:3A:4E:0C:60:A5:64:0A:61:70:A4","sha256":"26:34:3C:61:EB:6B:C4:62:40:18:52:AF:64:B3:1C:85:A4:DC:40:9C:2E:51:03:48:7A:91:FB:4F:86:7D:48:73"}}},"request":{"raw":"GET /davidshimjs/qrcodejs/gh-pages/qrcode.min.js HTTP/1.1\r\nHost: cdn.rawgit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 105\r\nlocation: https://cdn.jsdelivr.net/gh/davidshimjs/qrcodejs@gh-pages/qrcode.min.js\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 201235\r\ncdn-uid: b1941f61-b576-4f40-80de-5677acb38f74\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\nage: 35172\r\ncache-control: public, max-age=2592000\r\ncdn-cachedat: 08/14/2025 20:10:50\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-served-by: cache-fra-eddf8230029-FRA, cache-chi-kigq8000078-CHI\r\nx-cache: MISS, HIT\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 301\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 830\r\ncdn-status: 301\r\ncdn-requesttime: 0\r\ncdn-requestid: 30127a9ae8211d264edbcb23509825a4\r\ncdn-cache: EXPIRED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":19927,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T16:31:29.758893Z","times_seen":17920984,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":22,"dns":31,"connect":1,"send":0,"wait":155,"receive":0,"ssl":5},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/aos@next/dist/aos.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Jun 2025 07:12:29 GMT","end":"Thu, 25 Sep 2025 08:12:28 GMT"},"fingerprint":{"sha1":"74:03:6D:4D:8D:B7:AF:5F:95:BA:97:8E:E3:FA:63:4F:20:FD:29:80","sha256":"69:54:C9:A2:F1:AD:43:49:96:12:57:59:D0:D2:97:F9:C2:07:C3:04:1D:97:3B:AD:07:2B:41:AD:FE:E3:99:2F"}}},"request":{"raw":"GET /aos@next/dist/aos.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 44\r\ncf-ray: 96f319104d8b07e7-ARN\r\nlocation: /aos@3.0.0-beta.6/dist/aos.js\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13800,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T16:31:29.758893Z","times_seen":17920984,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":19,"dns":0,"connect":10,"send":0,"wait":32,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/scripts/main.js","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /scripts/main.js HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:50 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Sat, 01 Feb 2025 07:17:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"679dca7e-192e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6446,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"35b76749761ff3c3d73ca2a1c81e0cae","sha1":"4da5351a413a40764bd7e3a9ce5c7ae07996e3aa","sha256":"e168b3863db45580415513721d9f9f78da687d641e2af6076e46b8ebeca96b48","sha512":"92d613f86c8fe9f82926fd599c9da19135c03d01be8042c624fdd39c2b528bf6c992c6759136aab65c4f1146ec68cf7d2dcea99f99fe90277b1d4d9a6bca270b","ssdeep":"192:oTHx2IrRzbnRJ2yiasUSMIwaCJgCZilwlZ5ZbqiVmERymaL:uvRzbnL2yiajaCsP","tlshash":"f0d1611435f22071125bf0692bef480579bae81b3d06dd6a7e8cc2520fe58ace4fbd49","first_seen":"2025-08-14T20:11:12.524098Z","last_seen":"2025-08-14T20:11:12.524098Z","times_seen":1,"resource_available":true,"data":null}},"time_used":793,"timings":{"blocked":630,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trump-reward.com/images/ETH.svg","fqdn":"trump-reward.com","domain":"trump-reward.com","tld":"com"},"ip":{"addr":"23.95.67.157","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"trump-reward.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Jun 2025 10:51:45 GMT","end":"Mon, 15 Sep 2025 10:51:44 GMT"},"fingerprint":{"sha1":"B0:3A:02:28:DC:73:F0:36:15:63:45:47:F6:FD:93:CB:E0:B6:EA:A4","sha256":"46:1C:1C:1D:35:4A:5C:85:3A:B1:F8:74:AA:CD:AE:EB:4F:5B:14:B6:11:82:5A:7D:C6:46:A3:09:87:5B:14:C4"}}},"request":{"raw":"GET /images/ETH.svg HTTP/1.1\r\nHost: trump-reward.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trump-reward.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.2\r\nDate: Thu, 14 Aug 2025 20:10:51 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Sun, 19 Jan 2025 15:35:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"678d1bb8-32c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":812,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c3e653b491248f87f7d445414fa05230","sha1":"c5fb7624d63c2c868e787fbd9c429563349fcb4d","sha256":"56d411ae3e56d78fe8ea022824da86f7cc3155533b7909182a507199b401b9f4","sha512":"1cb05dbcdbbee15b21341b72a8aa91b3444ff34d05ddba22f69e27bccc9e790fb68cbdb7e53810aba436adde75e69829c6112272ec3c35b86682c91d94c978ed","ssdeep":"","tlshash":"7e016d50125897f54a04434cda5eb07d987260c9a9f4c0a194cbaf3ff860eab0dd5ecb","first_seen":"2024-08-20T09:13:27.284188Z","last_seen":"2026-05-27T18:55:48.408478Z","times_seen":27,"resource_available":false,"data":null}},"time_used":1881,"timings":{"blocked":1528,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":181},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"trump-reward.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/aos@3.0.0-beta.6/dist/aos.css","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Jun 2025 07:12:29 GMT","end":"Thu, 25 Sep 2025 08:12:28 GMT"},"fingerprint":{"sha1":"74:03:6D:4D:8D:B7:AF:5F:95:BA:97:8E:E3:FA:63:4F:20:FD:29:80","sha256":"69:54:C9:A2:F1:AD:43:49:96:12:57:59:D0:D2:97:F9:C2:07:C3:04:1D:97:3B:AD:07:2B:41:AD:FE:E3:99:2F"}}},"request":{"raw":"GET /aos@3.0.0-beta.6/dist/aos.css HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://trump-reward.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\ncontent-type: text/css\r\ncontent-encoding: gzip\r\ncf-ray: 96f319108df807e7-ARN\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 508036\r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 14 Aug 2026 20:10:50 GMT\r\nlast-modified: Wed, 09 Jul 2025 06:41:12 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncontent-digest: sha256=:hpX1/GTWVZP5djpbKNFLw048+AIxfh/60hJafI/t+v4=:\r\ncross-origin-resource-policy: cross-origin\r\nfly-request-id: 01JZPYNDPVKRVM7MFEZBS5THGS-ord\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}],"data":{"size":28765,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (28765), with no line terminators","md5":"6bb5545318038a2cfb38a19581c581f9","sha1":"9a26a349d21a4b871f45dfd124a43fada4f94b98","sha256":"8695f5fc64d65593f9763a5b28d14bc34e3cf802317e1ffad2125a7c8fedfafe","sha512":"8681a53beef57d21ba9604bad08e1b2afb05541f9b027ad5143625c125e8c8d2e9a43728ba9c0907b29b5aaffade20022a7de07202bd8cc5ddf93f980de56b19","ssdeep":"768:CdJLh9C9ZnOrdFGJtrSb59qVZx1GrdF2JlbiLRdtlVt4lxhKdvJg11NeNP9QNB5h:CdJLh9C9ZnOrdFGJtrSb59qVZvGrdF2H","tlshash":"a4d2c29a794cd100bf431b4762df2a1859347588e530098abe3f35ca1cd2de6b973fa9","first_seen":"2023-04-05T22:57:22Z","last_seen":"2026-08-16T15:55:27.745275Z","times_seen":14179,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/aos@3.0.0-beta.6/dist/aos.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:50.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Jun 2025 07:12:29 GMT","end":"Thu, 25 Sep 2025 08:12:28 GMT"},"fingerprint":{"sha1":"74:03:6D:4D:8D:B7:AF:5F:95:BA:97:8E:E3:FA:63:4F:20:FD:29:80","sha256":"69:54:C9:A2:F1:AD:43:49:96:12:57:59:D0:D2:97:F9:C2:07:C3:04:1D:97:3B:AD:07:2B:41:AD:FE:E3:99:2F"}}},"request":{"raw":"GET /aos@3.0.0-beta.6/dist/aos.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://trump-reward.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 20:10:50 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: gzip\r\ncf-ray: 96f319108e0007e7-ARN\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 665152\r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 14 Aug 2026 20:10:50 GMT\r\nlast-modified: Mon, 23 Jun 2025 21:46:22 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncontent-digest: sha256=:3R+azxOxLxidpHXg8jx8UFdnhZq2IKrGNpZJdAk8KB0=:\r\ncross-origin-resource-policy: cross-origin\r\nfly-request-id: 01JYFC3B4JW82JGERMTHHD4AZD-ord\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}],"data":{"size":13800,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13799)","md5":"aa20b6e0418d20fb86b071e670b2b207","sha1":"e38950c1bce65e9f048e305b3567ff90a0c923e3","sha256":"dd1f9acf13b12f189da475e0f23c7c505767859ab620aac636964974093c281d","sha512":"b6734ce8f3cd3957d9e6c18fc3a853842adc5017aab76995124dc4023f2d0adb8c1ea6ee566e7f1ec65a82bafc5b669a144fbaaca201c86c106c49e6a1dad856","ssdeep":"192:mOaHX24ysbeCVXVyILkYmTpOIytlomlBpOIVtlomlrjm5bovo5FglaZW0fNacZgu:mVpyRSVLL28HVjkFglMfNaEg+l","tlshash":"91520adc7286f166475394bb417f610bf2f154a4684d8040e239c5e73eb989aca33eae","first_seen":"2023-03-07T01:06:30Z","last_seen":"2026-08-16T10:52:40.396383Z","times_seen":10972,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot7244148256:AAG0CCBwZafqRsomvsZFLst_yLYLkoFqkwA/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://trump-reward.com/","date":"2025-08-14T20:10:51.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 25 Mar 2025 13:09:41 GMT","end":"Sun, 26 Apr 2026 13:09:41 GMT"},"fingerprint":{"sha1":"8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D","sha256":"80:58:CE:C7:28:68:D2:99:42:91:1E:43:06:54:D2:D6:F0:9C:DD:E2:F7:6F:68:A0:8A:EA:0C:15:FB:DB:8C:CD"}}},"request":{"raw":"OPTIONS /bot7244148256:AAG0CCBwZafqRsomvsZFLst_yLYLkoFqkwA/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://trump-reward.com/\r\nOrigin: https://trump-reward.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx/1.18.0\r\ndate: Thu, 14 Aug 2025 20:10:52 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T16:31:29.758893Z","times_seen":17920984,"resource_available":true,"data":null}},"time_used":2161,"timings":{"blocked":1072,"dns":24,"connect":18,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}