{"report_id":"58f9ebdd-353d-4fdc-ac7d-6476e56fc209","version":0,"status":"done","tags":[],"date":"2026-08-22T06:30:10Z","url":{"schema":"http","addr":"allnewtwcard.click/","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"allnewtwcard.click/","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"title":"Spend your crypto anywhere · UltraCard","dom":{"size":41313,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28745)","md5":"3869cdd5431c98a3e769c954a0a3784f","sha1":"3924ad2c98694e8f2c875108253a87c7964e885b","sha256":"55484c61cc385e1a745726061200d82e85b1610d037d8d14936ba3352ddd1245","sha512":"9c80cf2b20f9a32c196afd9ee15b74805cf50fe042146d1454c48ab7bfdc54315dc2176dd29e48684f4ac8d8d7624636f3ba62871a630101fd8aa4f534151a38","ssdeep":"768:TQX4TL9Og5Soj3NSN3ggx94cXO0QffuJLwJHjQaQ7ncBq33NBMDY08J:TvDNSN3Tx94ceHfuJ09jbOnOq33NBMLS","tlshash":"e8035161b175253e33330bc961977766a0bad30cdbca2494a7b847b44eeac53ba1710f","dom_hash":"domhash09d1c40b21045876d9067808073ce6da","first_seen":"2026-08-22T06:28:07.93128Z","last_seen":"2026-08-22T06:30:16.490549Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"allnewtwcard.click/","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-26T06:30:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"allnewtwcard.click","ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-22T06:27:52.083423Z","last_seen":"2026-08-22T06:27:52.083423Z","alert_count":32,"request_count":16,"received_data":1415446,"sent_data":7902,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.allnewtwcard.click","ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-22T06:30:11.813832Z","last_seen":"2026-08-22T06:30:11.813832Z","alert_count":8,"request_count":4,"received_data":4750,"sent_data":2053,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"allnewtwcard.click/assets/rolldown-runtime-C_JxhDyB.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"b2bd778e0b6e0e86da72d5f23d98cf50","sha1":"53b6ecb5f482b2c1cca8af56f19dc42c0305ced6","sha256":"2e53498fbfc06bd1406482f18384288e9eb2123f1c2a754cf783414fda150bc6","sha512":"8d428919988ee150e1995071b13e814d1ee965815f41e7d4f124ab391e833db487e7f763b15d1dae8a249dd1179126310ca6e2e8f70be92d299bf481da780f4b","ssdeep":"","tlshash":"2d1110ef6990f6f30346a786da380081e674687da97c70d4f7a88df2b4810c110d4e76","size":936,"data":"","first_seen":"2026-07-03T05:21:16.144734Z","last_seen":"2026-08-22T06:30:16.493579Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/walletPresentation-mV7qJY60.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"08a98b5dda4ff4483878d80dfcbae8c8","sha1":"6e9711f12bd5e7eae96394fda5f8732cf01139cc","sha256":"1112526acd1f5a4647b3fcfcc08164dafe83169c598ab1314e22c6203a95ce32","sha512":"71146ada2dd712612da5206e990ccb463167c5c599bcd58e2c62049b57522ca1ca80b8a925bc93f0b4c91d356fc09695545a1c03a2b0bdf5b96cce05bb3aa4df","ssdeep":"","tlshash":"c8012b249614221167c307a85c13c4f9d3e960e1cb9459f88bc1c1b89b2a3e2e9effc7","size":665,"data":"","first_seen":"2026-08-07T08:42:51.345719Z","last_seen":"2026-08-22T06:30:16.502334Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/supportedNetworks-fy0bpwSr.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"34669190b9e8e8c9009a0bea8ffb18fb","sha1":"306bcc36bf5e41252c88241228f9fff969d4189d","sha256":"b394b01abe049d18ffbc8e49eb9e836f8efbd6b920e58d56f5649566e97b4d7a","sha512":"a18189b600cafc59ec54c1f90f413a34e78f3ede6838a9f781648d368dcc3d4594707a082213b6bfaa18f03b9a5e6eca00c1b021c8c6b22d7db12f3fb26e3879","ssdeep":"","tlshash":"582111e7b0c7f4fc123b50c584eeb4aff32ea205d4680018d94959a956761fb9355ecc","size":1301,"data":"","first_seen":"2026-08-07T08:42:51.35688Z","last_seen":"2026-08-22T06:30:16.49879Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/walletConnectDiagnostics-L566ODtX.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ff30793c17981c04e9a8b5bcd62ae44","sha1":"d0b2e127d7263dbfe56059a1237afbe80ac6ffc8","sha256":"e76a02a04b229ab876e271d56d228c00919549de34ed9a51a32abf9111966951","sha512":"38a0cb9475334a694425f4aef14ce7b55ef48c1335b6c3f92778ecd38c54bb58200825a51e01ca23c0feb6f4ef9160ee2109a672b97542f925105f20fb53d43d","ssdeep":"96:wd+sn4fXkzf7Od87Ole4DIOSVvl+l8wnohbRL9+Tlpslts14YHAr0aCI9iXkOE+w:o4fX0fsWCVohaJznEm/A4DQKnwAr4Z","tlshash":"6ff1b6c57be030695367c22a52ab1208d336d4922d0f5048f37458b93b78b5ecba7f8e","size":8082,"data":"","first_seen":"2026-08-22T06:28:07.937484Z","last_seen":"2026-08-22T06:30:16.494198Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/routes-DeiECMSM.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"072f5755e53554863cef4cdece2f118f","sha1":"92758b02ffaf37c1c2f29e2661539663521cbd8e","sha256":"8ed019e0072df7a1cab5131bff5d6c26cdd20919e6d07cd181f303c7d0b626df","sha512":"1448cb540c9f2e35cd92da06bb78ab26d7621ddd155ab005bd1a07d47371206fc3fa6abee723dd0a3ba564b2c41ff5e63a43b1eb202b0ed2caf1478fddc999b1","ssdeep":"1536:Y1CnKs4NJ6dK1m8wTC4BP0bLqQFjCdeB3Y1ixN7mtzCPg61Z:XaNJ6dK1m8wTHGLFjCdeB3Y1ixYtzCvZ","tlshash":"d3531ad9b2c5b1ed835b46a9002f801af37e9494780e4538f66de8f539718c4e367fa8","size":66524,"data":"","first_seen":"2026-08-22T06:28:07.936042Z","last_seen":"2026-08-22T06:30:16.497706Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/wallet-DLow2bHX.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b91a95c378676651d599861ec417fd5","sha1":"4439a21f5b163e1c466603e9e43176a272c87b94","sha256":"bf67b452169c8d7ceec56ac52113eb9b84551e56aab4c5515867000edaf7dc23","sha512":"3999247613e6cb56554061bfc387e62fd31b333caa24f7ae85cf518b6ca786a585eec96b8b1bccfb458b3d6fd0bbeb8b188ab24fc508e7fc35f008b0a52ea492","ssdeep":"1536:JPFNg46xwXFuT5b1ulXb/6VIoo8E/tIkFD4JYZBk2:JP/gdMy5FfEF0JYZS2","tlshash":"6e33fad573e0f661e72b0258106b441df33d4ca0881e0534f6f1e99a3a30a79abb7f5a","size":53334,"data":"","first_seen":"2026-08-22T06:28:07.942614Z","last_seen":"2026-08-22T06:30:16.50465Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/index-WlSG8-cY.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"419e6d88eb411253e3299037c5d0720a","sha1":"40faabcdaa30c35f4233fb4ba36eaaf9db83e76b","sha256":"b783b4095686145c3801ae650c1e4013789011c39f950b337c15e251f5d40595","sha512":"e8f8339ae10b62441bb14bde0cd33f2455f867e58a2c8b51dd7199dd363562106eb0ccd6b29d81902ca1e413103c943428e3a05b654a95a3380bb12eb817bad2","ssdeep":"12288:YQrMi8CFwFFFgFD+Wx+qrvXwKA0khLswWILM:DrTraX6kWx+qDwKDLVILM","tlshash":"9fa44ae5b2a47674a663066a006b411f723e5411cc1e08b4fab0fddd26748c4ba77fee","size":481519,"data":"","first_seen":"2026-08-22T06:28:07.940313Z","last_seen":"2026-08-22T06:30:16.501727Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"allnewtwcard.click/favicon.svg","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:43.159Z","timestamp":1787380183159,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 499\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-1f3\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: no-cache\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":499,"size_decoded":1562,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ea979479f46a264bd3260a897c41aa05","sha1":"2d0b6c1fdb0da886e216c1cf90c51b872557cca9","sha256":"f75997ea0857757f5e4c72f2a11c877b4590c0322b85aab796f8c2cb4e918e7f","sha512":"913ee44ccd3f399eb097cb6b71968a3c85696520df002f4e4e60242ab693f229f4e9049e846e3c20ea97ab596411018fae019025530f85e48d9e3fcc059dd077","ssdeep":"","tlshash":"9ff02e15eb184daca67d0966df1d7064001bb253078e1105b53fd0715b145cd783e6ec","first_seen":"2026-08-22T06:28:07.934111Z","last_seen":"2026-08-22T06:30:16.491822Z","times_seen":2,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T06:29:42.113Z","timestamp":1787380182113,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-1056\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4182,"size_decoded":2544,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"4c42bfb253ec8d47342db38fdbb21b21","sha1":"e4133671dfb70553808503ce12569fb4444d046c","sha256":"1ffbe681abae3200900a0caa5de2af2ca26a7d3c7ff756a62cf70feec991bd1a","sha512":"00c49545cd43a8cc55ec485dcd2b7b23daa0c82531bd3d5a073f11b7e25b0defa19ad32da9a04e6f134f8fca875c9a0ad4fca16eddf626a4e1dd387974a28396","ssdeep":"48:0DXkal+oTPw32Rzzmw5LJLXdJX6IIldJo6WL4dJoeL0HbMXrdMqmeQrdMq2eovJ7:GQmPpp55lzQo/uoeZMlMxjwg","tlshash":"cc811f0363a08a682330432569d6f0b5cd62e4974789b998f2dd21bd1fc1fd586f37e6","first_seen":"2026-08-22T06:28:07.948997Z","last_seen":"2026-08-22T06:30:16.492584Z","times_seen":2,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":3,"connect":25,"send":0,"wait":27,"receive":0,"ssl":44},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/rolldown-runtime-C_JxhDyB.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.459Z","timestamp":1787380182459,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/rolldown-runtime-C_JxhDyB.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 936\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\netag: \"6a88b44e-3a8\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":936,"size_decoded":2093,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (936), with no line terminators","md5":"b2bd778e0b6e0e86da72d5f23d98cf50","sha1":"53b6ecb5f482b2c1cca8af56f19dc42c0305ced6","sha256":"2e53498fbfc06bd1406482f18384288e9eb2123f1c2a754cf783414fda150bc6","sha512":"8d428919988ee150e1995071b13e814d1ee965815f41e7d4f124ab391e833db487e7f763b15d1dae8a249dd1179126310ca6e2e8f70be92d299bf481da780f4b","ssdeep":"","tlshash":"2d1110ef6990f6f30346a786da380081e674687da97c70d4f7a88df2b4810c110d4e76","first_seen":"2026-07-03T05:21:16.144734Z","last_seen":"2026-08-22T06:30:16.493579Z","times_seen":32,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/walletConnectDiagnostics-L566ODtX.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.463Z","timestamp":1787380182463,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/walletConnectDiagnostics-L566ODtX.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-1f92\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8082,"size_decoded":4395,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5147)","md5":"1ff30793c17981c04e9a8b5bcd62ae44","sha1":"d0b2e127d7263dbfe56059a1237afbe80ac6ffc8","sha256":"e76a02a04b229ab876e271d56d228c00919549de34ed9a51a32abf9111966951","sha512":"38a0cb9475334a694425f4aef14ce7b55ef48c1335b6c3f92778ecd38c54bb58200825a51e01ca23c0feb6f4ef9160ee2109a672b97542f925105f20fb53d43d","ssdeep":"96:wd+sn4fXkzf7Od87Ole4DIOSVvl+l8wnohbRL9+Tlpslts14YHAr0aCI9iXkOE+w:o4fX0fsWCVohaJznEm/A4DQKnwAr4Z","tlshash":"6ff1b6c57be030695367c22a52ab1208d336d4922d0f5048f37458b93b78b5ecba7f8e","first_seen":"2026-08-22T06:28:07.937484Z","last_seen":"2026-08-22T06:30:16.494198Z","times_seen":2,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.allnewtwcard.click/analytics/events","fqdn":"api.allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.927Z","timestamp":1787380182927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.allnewtwcard.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:36:21 GMT","end":"Tue, 10 Nov 2026 11:36:20 GMT"},"fingerprint":{"sha1":"8F:04:23:9C:FF:C5:C9:6F:BD:85:01:FA:BC:23:F1:5F:9D:8E:FE:0C","sha256":"BF:C3:3A:B9:43:A0:31:CF:ED:6A:8D:B2:B2:BE:25:05:16:17:D7:63:79:0D:F4:C1:BB:CF:7D:55:1B:FF:BC:23"}}},"request":{"raw":"POST /analytics/events HTTP/1.1\r\nHost: api.allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nReferer: https://allnewtwcard.click/\r\nContent-Length: 285\r\nOrigin: https://allnewtwcard.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":285,"data":"{\"attribution\":{\"capturedAt\":\"2026-08-22T06:29:42.664Z\",\"landingUrl\":\"https://allnewtwcard.click/\"},\"customData\":{},\"eventId\":\"page_view:cdf7ab2e-1f14-495f-8737-cf336603407e\",\"eventName\":\"page_view\",\"eventSourceUrl\":\"https://allnewtwcard.click/\",\"eventTime\":\"2026-08-22T06:29:42.664Z\"}"}},"response":{"raw":"HTTP/2 202 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 94\r\nx-request-id: 84ce9408-2908-4ccb-bd9f-71d4b7dd9bb0\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\r\ncross-origin-resource-policy: same-origin\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\naccess-control-allow-origin: https://allnewtwcard.click\r\naccess-control-allow-methods: GET,POST,PUT,PATCH,DELETE,OPTIONS\r\naccess-control-allow-headers: Authorization,Content-Type,X-Request-Id,Idempotency-Key\r\naccess-control-max-age: 600\r\nvary: Origin\r\netag: W/\"5e-MQIAQ5hXxClQBbqkaCdqjkCArE8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94,"size_decoded":893,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d617d2df69d47dc199085d134dfc48eb","sha1":"310200439857c4295005baa468276a8e4080ac4f","sha256":"4b7fb1b1c530dc26e8b0139bd7fac6e8308d4d2fa11b82d35d084032512ba3e2","sha512":"3e0ca75c12b7c2e62d86f9f3e0de4b5ae233a9f5edcba6d27ec1962d6d973c2df72a70073144ebb46fdb2d7712ba3992c289ad71d6b70867f93bee29869c67a5","ssdeep":"","tlshash":"e9b01247761844df809c3150714c03b1c912b715f11c7447c1c91d001053dc70035453","first_seen":"2026-08-22T06:30:16.494876Z","last_seen":"2026-08-22T06:30:16.494876Z","times_seen":1,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/images/hero-card-stack-720.png","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.987Z","timestamp":1787380182987,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /images/hero-card-stack-720.png HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 300305\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-49511\"\r\nexpires: Mon, 21 Sep 2026 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=2592000, public, max-age=2592000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":300305,"size_decoded":301441,"mime_type":"image/png","magic":"PNG image data, 720 x 712, 8-bit/color RGBA, non-interlaced","md5":"6495d9aa5a0668f8e0226b37dd616bbb","sha1":"689a2fafc44bf90144df7e659dcbd3e503b21457","sha256":"dbeb79945cf418ce3fb7146b318c02593d876de63be817b034681dc0972cbfb4","sha512":"6d0b5dfa45ee66f94f9e29ffc2f3ac0ef91731ca8e47f7bf3b41e0fa1b713f1c3f844a79b976ad975fcb1701aab50d0123bb8bc8b98ac1e0b2d4ef5b1bf41dbc","ssdeep":"6144:xS054mGJOoc2w4RRodtV7vR1UfZh0e5r9snGhd1OpQtb:xp54m6H/mV7vjUfZh0isnGh/Opmb","tlshash":"f95423959e71df2c74a6ba4e014c1a759203c58ec59cb0b18bfc3111924fee9df26e2e","first_seen":"2026-08-07T08:42:51.347053Z","last_seen":"2026-08-22T06:30:16.496035Z","times_seen":6,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/fonts/trust-wallet/wix-madefor-display-latin.woff2","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.455Z","timestamp":1787380182455,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /fonts/trust-wallet/wix-madefor-display-latin.woff2 HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 20144\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-4eb0\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20144,"size_decoded":21292,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20144, version 1.0","md5":"9b9969b222383443533022faa1a8dc15","sha1":"960bfc7f598d95e5e1f183f66f0b9570c59be7f5","sha256":"fd4c8e65080adbaf0cc819eb67b08ed9300e9274dd0069b382d286b93b9544a0","sha512":"dca295932532388d01fc0130671252a3bf707bd9a2e5608d69b2ad0ee9134a9349e2c45734ca8bc223ea4090e918420166c6944395852a108ef7d25a360fd2f0","ssdeep":"384:bDDIoOYd5DFolWnW7Hy2ljK3VB87feqOMtmna2213/p:bwYdFFolz7HyMjK/87vOaPvp","tlshash":"4c92e067de6d3916fcd415f04619ec1ea1b12f617c2206fb0cc8c946906da8d6aaed88","first_seen":"2025-11-23T10:03:25.17893Z","last_seen":"2026-08-22T09:03:28.044593Z","times_seen":210,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/routes-DeiECMSM.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.461Z","timestamp":1787380182461,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/routes-DeiECMSM.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-103dc\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66524,"size_decoded":24598,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (30803)","md5":"072f5755e53554863cef4cdece2f118f","sha1":"92758b02ffaf37c1c2f29e2661539663521cbd8e","sha256":"8ed019e0072df7a1cab5131bff5d6c26cdd20919e6d07cd181f303c7d0b626df","sha512":"1448cb540c9f2e35cd92da06bb78ab26d7621ddd155ab005bd1a07d47371206fc3fa6abee723dd0a3ba564b2c41ff5e63a43b1eb202b0ed2caf1478fddc999b1","ssdeep":"1536:Y1CnKs4NJ6dK1m8wTC4BP0bLqQFjCdeB3Y1ixN7mtzCPg61Z:XaNJ6dK1m8wTHGLFjCdeB3Y1ixYtzCvZ","tlshash":"d3531ad9b2c5b1ed835b46a9002f801af37e9494780e4538f66de8f539718c4e367fa8","first_seen":"2026-08-22T06:28:07.936042Z","last_seen":"2026-08-22T06:30:16.497706Z","times_seen":2,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/supportedNetworks-fy0bpwSr.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.466Z","timestamp":1787380182466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/supportedNetworks-fy0bpwSr.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-515\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1301,"size_decoded":1802,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (1301), with no line terminators","md5":"34669190b9e8e8c9009a0bea8ffb18fb","sha1":"306bcc36bf5e41252c88241228f9fff969d4189d","sha256":"b394b01abe049d18ffbc8e49eb9e836f8efbd6b920e58d56f5649566e97b4d7a","sha512":"a18189b600cafc59ec54c1f90f413a34e78f3ede6838a9f781648d368dcc3d4594707a082213b6bfaa18f03b9a5e6eca00c1b021c8c6b22d7db12f3fb26e3879","ssdeep":"","tlshash":"582111e7b0c7f4fc123b50c584eeb4aff32ea205d4680018d94959a956761fb9355ecc","first_seen":"2026-08-07T08:42:51.35688Z","last_seen":"2026-08-22T06:30:16.49879Z","times_seen":6,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/index-DQrDNLc6.css","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.469Z","timestamp":1787380182469,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/index-DQrDNLc6.css HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-5c7fd\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":378877,"size_decoded":60751,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ef930241aa3fc27ffb3211213ef7604c","sha1":"089fcf1f8857350ba104f4a9904c1acc674f8d30","sha256":"9395346666ef2902757b71cf7e2088f8ce96776a6a9336a00bf60460a98b7a9d","sha512":"e32097d7ef6319020a1a2b2bf57f29df92711f6895078a8b04db34868349fade056ff92f8e11d42422d04618d2e9609f3d8a5b783fd24ccdadbe3ff4842b9565","ssdeep":"6144:Wal9XRlToSheC4YBSDKbd+qU3w6fzYKDnj2NKs1vjhGfGzgiTuz2abXn6DOKUGJ7:plToShDHBSwd+qYEKDnj2ss1vjhGfGzr","tlshash":"4b8464a9fed0ee3dbc37e5756788ebbd6040e865982306e8f944bd1048c3af3192165d","first_seen":"2026-08-22T06:28:07.943629Z","last_seen":"2026-08-22T06:30:16.499409Z","times_seen":2,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.allnewtwcard.click/analytics/events","fqdn":"api.allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.929Z","timestamp":1787380182929,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.allnewtwcard.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:36:21 GMT","end":"Tue, 10 Nov 2026 11:36:20 GMT"},"fingerprint":{"sha1":"8F:04:23:9C:FF:C5:C9:6F:BD:85:01:FA:BC:23:F1:5F:9D:8E:FE:0C","sha256":"BF:C3:3A:B9:43:A0:31:CF:ED:6A:8D:B2:B2:BE:25:05:16:17:D7:63:79:0D:F4:C1:BB:CF:7D:55:1B:FF:BC:23"}}},"request":{"raw":"OPTIONS /analytics/events HTTP/1.1\r\nHost: api.allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://allnewtwcard.click/\r\nOrigin: https://allnewtwcard.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\nx-request-id: ce88d7dd-b3b8-46e5-bc4d-35cf1028abf0\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\r\ncross-origin-resource-policy: same-origin\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\naccess-control-allow-origin: https://allnewtwcard.click\r\naccess-control-allow-methods: GET,POST,PUT,PATCH,DELETE,OPTIONS\r\naccess-control-allow-headers: Authorization,Content-Type,X-Request-Id,Idempotency-Key\r\naccess-control-max-age: 600\r\nvary: Origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T09:26:44.124205Z","times_seen":18031929,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":3,"connect":27,"send":0,"wait":31,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.allnewtwcard.click/analytics/product-events","fqdn":"api.allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:43.978Z","timestamp":1787380183978,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.allnewtwcard.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:36:21 GMT","end":"Tue, 10 Nov 2026 11:36:20 GMT"},"fingerprint":{"sha1":"8F:04:23:9C:FF:C5:C9:6F:BD:85:01:FA:BC:23:F1:5F:9D:8E:FE:0C","sha256":"BF:C3:3A:B9:43:A0:31:CF:ED:6A:8D:B2:B2:BE:25:05:16:17:D7:63:79:0D:F4:C1:BB:CF:7D:55:1B:FF:BC:23"}}},"request":{"raw":"OPTIONS /analytics/product-events HTTP/1.1\r\nHost: api.allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://allnewtwcard.click/\r\nOrigin: https://allnewtwcard.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\nx-request-id: ae3d7bbb-a37a-4de3-9193-2b3b38694645\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\r\ncross-origin-resource-policy: same-origin\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\naccess-control-allow-origin: https://allnewtwcard.click\r\naccess-control-allow-methods: GET,POST,PUT,PATCH,DELETE,OPTIONS\r\naccess-control-allow-headers: Authorization,Content-Type,X-Request-Id,Idempotency-Key\r\naccess-control-max-age: 600\r\nvary: Origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T09:26:44.124205Z","times_seen":18031929,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/fonts/trust-wallet/inter-latin.woff2","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.449Z","timestamp":1787380182449,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /fonts/trust-wallet/inter-latin.woff2 HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48432\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-bd30\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48432,"size_decoded":49580,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48432, version 1.0","md5":"65850a373e258f1c897a2b3d75eb74de","sha1":"1dc044f4824fd5af6bfed67fee48be70fa069f3f","sha256":"c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4","sha512":"df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b","ssdeep":"768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA","tlshash":"56230251f5f8624a7fc3003fbc317bd862909fe5996ee5d91288f30225611dd29ee017","first_seen":"2025-05-30T12:57:00.85385Z","last_seen":"2026-08-22T09:24:49.790496Z","times_seen":93442,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/index-WlSG8-cY.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.457Z","timestamp":1787380182457,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/index-WlSG8-cY.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-758ef\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":481519,"size_decoded":140003,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (49827)","md5":"419e6d88eb411253e3299037c5d0720a","sha1":"40faabcdaa30c35f4233fb4ba36eaaf9db83e76b","sha256":"b783b4095686145c3801ae650c1e4013789011c39f950b337c15e251f5d40595","sha512":"e8f8339ae10b62441bb14bde0cd33f2455f867e58a2c8b51dd7199dd363562106eb0ccd6b29d81902ca1e413103c943428e3a05b654a95a3380bb12eb817bad2","ssdeep":"12288:YQrMi8CFwFFFgFD+Wx+qrvXwKA0khLswWILM:DrTraX6kWx+qDwKDLVILM","tlshash":"9fa44ae5b2a47674a663066a006b411f723e5411cc1e08b4fab0fddd26748c4ba77fee","first_seen":"2026-08-22T06:28:07.940313Z","last_seen":"2026-08-22T06:30:16.501727Z","times_seen":2,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/walletPresentation-mV7qJY60.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.465Z","timestamp":1787380182465,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/walletPresentation-mV7qJY60.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 665\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\netag: \"6a88b44e-299\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":665,"size_decoded":1822,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (665), with no line terminators","md5":"08a98b5dda4ff4483878d80dfcbae8c8","sha1":"6e9711f12bd5e7eae96394fda5f8732cf01139cc","sha256":"1112526acd1f5a4647b3fcfcc08164dafe83169c598ab1314e22c6203a95ce32","sha512":"71146ada2dd712612da5206e990ccb463167c5c599bcd58e2c62049b57522ca1ca80b8a925bc93f0b4c91d356fc09695545a1c03a2b0bdf5b96cce05bb3aa4df","ssdeep":"","tlshash":"c8012b249614221167c307a85c13c4f9d3e960e1cb9459f88bc1c1b89b2a3e2e9effc7","first_seen":"2026-08-07T08:42:51.345719Z","last_seen":"2026-08-22T06:30:16.502334Z","times_seen":6,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.allnewtwcard.click/ready","fqdn":"api.allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.984Z","timestamp":1787380182984,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.allnewtwcard.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:36:21 GMT","end":"Tue, 10 Nov 2026 11:36:20 GMT"},"fingerprint":{"sha1":"8F:04:23:9C:FF:C5:C9:6F:BD:85:01:FA:BC:23:F1:5F:9D:8E:FE:0C","sha256":"BF:C3:3A:B9:43:A0:31:CF:ED:6A:8D:B2:B2:BE:25:05:16:17:D7:63:79:0D:F4:C1:BB:CF:7D:55:1B:FF:BC:23"}}},"request":{"raw":"GET /ready HTTP/1.1\r\nHost: api.allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nOrigin: https://allnewtwcard.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\nx-request-id: 9f3dc172-c128-41aa-b690-c813942876fc\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\r\ncross-origin-resource-policy: same-origin\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\naccess-control-allow-origin: https://allnewtwcard.click\r\naccess-control-allow-methods: GET,POST,PUT,PATCH,DELETE,OPTIONS\r\naccess-control-allow-headers: Authorization,Content-Type,X-Request-Id,Idempotency-Key\r\naccess-control-max-age: 600\r\nvary: Accept-Encoding, Origin\r\netag: W/\"678-d71E9bwJkS0mMljquPJz8MwD0iw\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1656,"size_decoded":1347,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7b03f098ef78c790d52ed071b7a75e0f","sha1":"77bd44f5bc09912d263258eab8f273f0cc03d22c","sha256":"9c0983f5b4f4daa0c2b6adc6f2f66a6a57811c3bcb1afbc758373465a4f71799","sha512":"f547c9b65e81e7835736a30dbd33d66ea64158439028d10c36c8664894f568216718a456565b61fdd07122e90ce716c12860a6b9f59be3203f42fda1b06598d7","ssdeep":"","tlshash":"2a31484947432cffac8ecf18662537a75525a57320c78e68159ccdbc509fc26d30aa2f","first_seen":"2026-08-22T06:30:16.502944Z","last_seen":"2026-08-22T06:30:16.502944Z","times_seen":1,"resource_available":false,"data":null}},"time_used":687,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":674,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"api.allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/images/privacy-main-shield.png","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.992Z","timestamp":1787380182992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /images/privacy-main-shield.png HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 31109\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-7985\"\r\nexpires: Mon, 21 Sep 2026 06:29:43 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=2592000, public, max-age=2592000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31109,"size_decoded":32243,"mime_type":"image/png","magic":"PNG image data, 193 x 225, 8-bit/color RGBA, non-interlaced","md5":"dae21fc9715c22fe608455e92083fe12","sha1":"7d15feb311b97cb42590fc31ebe1ee5adf8ada74","sha256":"d9881b1fc8f698695f6cd83a0e9243a59666bfc64b787f980d282dd2934cb60f","sha512":"f35b1dbf5dc95e559da8be5348a6690e1d2cbf2d2fd79df8fe14f3e980d550e115016ceb6b99a7b295478652b9ab63b0cc105fb7534523d28bc158ec0704a021","ssdeep":"768:gmsrbvj2jxpEygHVFLwTBMKYFoYFn6vyFtRdJB9iUtxr14kRY:d3NybHE2KYJQyhd3ztoyY","tlshash":"8ed2f1c14d14da5af4170f3b0aa77910a79ed846bc612e3ee0f86b43dc69a25cd9882c","first_seen":"2026-08-07T08:42:51.341352Z","last_seen":"2026-08-22T06:30:16.504016Z","times_seen":6,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/favicon.svg","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:43.160Z","timestamp":1787380183160,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:43 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 499\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-1f3\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: no-cache\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":499,"size_decoded":1562,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ea979479f46a264bd3260a897c41aa05","sha1":"2d0b6c1fdb0da886e216c1cf90c51b872557cca9","sha256":"f75997ea0857757f5e4c72f2a11c877b4590c0322b85aab796f8c2cb4e918e7f","sha512":"913ee44ccd3f399eb097cb6b71968a3c85696520df002f4e4e60242ab693f229f4e9049e846e3c20ea97ab596411018fae019025530f85e48d9e3fcc059dd077","ssdeep":"","tlshash":"9ff02e15eb184daca67d0966df1d7064001bb253078e1105b53fd0715b145cd783e6ec","first_seen":"2026-08-22T06:28:07.934111Z","last_seen":"2026-08-22T06:30:16.491822Z","times_seen":2,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/assets/wallet-DLow2bHX.js","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.467Z","timestamp":1787380182467,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /assets/wallet-DLow2bHX.js HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Aug 2026 20:25:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a88b44e-d058\"\r\nexpires: Sun, 22 Aug 2027 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=31536000, public, max-age=31536000, immutable\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53336,"size_decoded":17699,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32016)","md5":"2b91a95c378676651d599861ec417fd5","sha1":"4439a21f5b163e1c466603e9e43176a272c87b94","sha256":"bf67b452169c8d7ceec56ac52113eb9b84551e56aab4c5515867000edaf7dc23","sha512":"3999247613e6cb56554061bfc387e62fd31b333caa24f7ae85cf518b6ca786a585eec96b8b1bccfb458b3d6fd0bbeb8b188ab24fc508e7fc35f008b0a52ea492","ssdeep":"1536:JPFNg46xwXFuT5b1ulXb/6VIoo8E/tIkFD4JYZBk2:JP/gdMy5FfEF0JYZS2","tlshash":"6e33fad573e0f661e72b0258106b441df33d4ca0881e0534f6f1e99a3a30a79abb7f5a","first_seen":"2026-08-22T06:28:07.942614Z","last_seen":"2026-08-22T06:30:16.50465Z","times_seen":2,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allnewtwcard.click/images/svg/trust-wallet-mark.svg","fqdn":"allnewtwcard.click","domain":"allnewtwcard.click","tld":"click"},"ip":{"addr":"91.92.35.233","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://allnewtwcard.click/","date":"2026-08-22T06:29:42.986Z","timestamp":1787380182986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allnewtwcard.click","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 11:40:15 GMT","end":"Sat, 07 Nov 2026 11:40:14 GMT"},"fingerprint":{"sha1":"20:57:3B:0E:70:05:43:06:2F:E0:C8:9C:02:2F:83:F7:E1:0A:20:4A","sha256":"B7:D8:8C:1D:E9:26:55:A7:DF:4B:46:8F:39:10:12:A7:D4:44:04:3B:18:B9:F1:F6:F5:86:C1:E6:DA:A6:94:7F"}}},"request":{"raw":"GET /images/svg/trust-wallet-mark.svg HTTP/1.1\r\nHost: allnewtwcard.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://allnewtwcard.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 06:29:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 857\r\nlast-modified: Fri, 21 Aug 2026 20:25:49 GMT\r\netag: \"6a88b44d-359\"\r\nexpires: Mon, 21 Sep 2026 06:29:42 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://connect.facebook.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss://relay.walletconnect.org wss://relay.walletconnect.com wss://*.walletconnect.com; frame-src https://verify.walletconnect.com https://verify.walletconnect.org https://secure.walletconnect.com https://secure.walletconnect.org; manifest-src 'self'; worker-src 'self' blob:\r\ncache-control: max-age=2592000, public, max-age=2592000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":857,"size_decoded":1992,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5436fd9e66fd7376b39414b7c185100d","sha1":"bf7ec22d26a5e8fc28f278e46c14248bcdcd0cad","sha256":"7c1fb4bef3f89e2baecc08275d147def5d9d37013436ed5f6d2bb66077bba313","sha512":"872bfa0629e3734b6f56c26a9f88dcea456b7230785bbc694d3adffda26c9e1ea58ce1a46994a38818c9f0558aca4dbac873cc46d7acb15179b7d0f626b87da5","ssdeep":"","tlshash":"72116b2bda5df76ae489876ee05491b23a5550c3b7c5c2a0b26e8fce0f040420d4fbd1","first_seen":"2026-08-08T12:10:33.196579Z","last_seen":"2026-08-22T06:30:16.505636Z","times_seen":4,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"allnewtwcard.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}