{"report_id":"5b642938-b0b2-4fba-9957-ffd77f1eed1a","version":0,"status":"done","tags":[],"date":"2026-07-12T19:04:09Z","url":{"schema":"http","addr":"gragonmoney-bonus.buzz","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"104.21.49.173","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"title":"Бонусы на первый депозит и фриспины","dom":{"size":2093,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"7f98ba6e66538ba1557169bec6849fd1","sha1":"3fc7c12ae2e3cf8d45ac65379ed4c44c8c99edc8","sha256":"44fea65947567aa815695ea42395289e5608f00072a5818504d29320c57348e9","sha512":"33782e189fc9149e9d07c433c2f1de40b7ea6f625acc3db663adca0f4ff79686263dc4b409f355b36adabb66be3deeb314fd03b703c81b37daefaf604b32cdb2","ssdeep":"","tlshash":"9741416204dd6d3f031741cab4a0f76e6adb8d6ced138840a3f763a60bd7d40dd5140a","dom_hash":"domhash31c9d9881a5f3be172897b9a15f4197e","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gragonmoney-bonus.buzz","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"104.21.49.173","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T19:04:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"gragonmoney-bonus.buzz","ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-02","domain_rank":0,"first_seen":"2026-07-11T07:17:12.151107Z","last_seen":"2026-07-11T07:17:12.151107Z","alert_count":14,"request_count":7,"received_data":374187,"sent_data":3443,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"particles.js","description":"Particles.js is a JavaScript library for creating particles.","website":"https://github.com/VincentGarreau/particles.js","common_platform_enumeration":"","icon":"","categories":["JavaScript graphics"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/ajax/libs/particles.js/2.0.0/particles.min.js","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"00debcf6cf0789a19cee2278011afcd4","sha1":"8017f8b1869077db728573f1ca4684a00af69462","sha256":"faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6","sha512":"29e7f9b1cee07d369c47b4d929e95cad1b35e62a5fefeb7e9fb661ea628d25b996fbf4517425bd9f07cb9f8617d2cda73ba2afe58d8286a8086a4682e8f5b4f4","ssdeep":"384:NkfJtGvWjT6uYvqhCz8wSEHESxtVAFPQcYpeib+9rOEKXWd/:NC7T6uYvn8wRxwyryVOEKXW5","tlshash":"61a2934d23f73e77378ab2e09be9d122c774a4d1399b04b0f93c667da52549201ee7a0","size":23364,"data":"","first_seen":"2023-03-07T01:16:44Z","last_seen":"2026-07-14T01:58:08.964763Z","times_seen":5275,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/script.js","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"291d12ce090cc5c48d3a73aad74c5abf","sha1":"9281896e7dec38ea465ffea1006a02290e23ef9f","sha256":"567db8a2d08dea26bb90c146bcabb0ba7f09d1e0792b5b83ecbc4d446a053963","sha512":"070a86d38378fcb50a98aa18332b9992a57211a974db4d0905a69084cf92b04d252a9bd90612c7868e10eaa899516e336d0b7e2c6a45e2069246eb421fd0c33f","ssdeep":"","tlshash":"8001d340b7fc3ebad115480048bc338b548ca832bc1a6ef6f0e4473da25954f538ca5c","size":675,"data":"","first_seen":"2026-07-11T07:17:14.838483Z","last_seen":"2026-07-12T19:04:10.022791Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/script.js","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.470Z","timestamp":1783883021470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\netag: W/\"6a5079de-2a3\"\r\nlast-modified: Fri, 10 Jul 2026 04:49:34 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hXT7e0CI3U41ygfDRDb3dLugLQD0h6%2F%2FZ47y3FYk12CDgncGVtSd0ESBoplYsEmEfnRO0ngCMabajqeal6N6MsEjMxHNZtaFnfYtHiBT0X6ImhIK7wT2yS7%2FjUqAD%2BySk%2B6xDJUF%2Fq3A\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\ncf-ray: a1a24f343f04568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":675,"size_decoded":1083,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"291d12ce090cc5c48d3a73aad74c5abf","sha1":"9281896e7dec38ea465ffea1006a02290e23ef9f","sha256":"567db8a2d08dea26bb90c146bcabb0ba7f09d1e0792b5b83ecbc4d446a053963","sha512":"070a86d38378fcb50a98aa18332b9992a57211a974db4d0905a69084cf92b04d252a9bd90612c7868e10eaa899516e336d0b7e2c6a45e2069246eb421fd0c33f","ssdeep":"","tlshash":"8001d340b7fc3ebad115480048bc338b548ca832bc1a6ef6f0e4473da25954f538ca5c","first_seen":"2026-07-11T07:17:14.838483Z","last_seen":"2026-07-12T19:04:10.022791Z","times_seen":2,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/img/v2bg.webp","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.478Z","timestamp":1783883021478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /img/v2bg.webp HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 10 Jul 2026 04:49:10 GMT\r\npriority: u=5,i\r\netag: \"6a5079c6-4d5fe\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VPE%2BD84iaaUHUO%2BJ22QvleNRaHP23Z4si90Q9muybTiPqurvg11rnrv5Syq1t6jJ09NRO5QNGjeEByk4G5CFMa0YuJi1zz4YrVZ%2BGNBrG4Bz2%2Bw1vItcFVcpo4bVGfj8StwcCsLimz7z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a24f343f06568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 316926\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":316926,"size_decoded":317626,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1160, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f8a9f71dc7c84ce0c3a1c99f9097b393","sha1":"6dfcb6e9834dd8f9ee4287f47189df373dd146df","sha256":"44b3dc6aa1a6f8a905c7f2392d155a5dc973b26d6b35c48fac1eb46075399a1a","sha512":"75361b60dd276e3db357794f869cfc01e4c3c6b1cee8e0c89d56570eaa7925f427fc16180e52567dc5af277b7cd141aa9be407b04c86482c3ddfe91372a8e4d5","ssdeep":"6144:xjFg/GnByqj1CyrZSLCOLy2dfWfO/DaTzLJi6MeIBci0iFNOFCF8aT/pq2finw1g:Lg/QBHXg5ykV/uTzLI6uBcdiFGCF5/pU","tlshash":"0d6423841d8df60edf2a4632bb2dd1c6a8f50eb331a3acd78f2254458619481b7f17a7","first_seen":"2025-08-31T16:58:51.02863Z","last_seen":"2026-07-12T19:04:10.02453Z","times_seen":118,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/img/logo.png","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.481Z","timestamp":1783883021481,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /img/logo.png HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:49:10 GMT\r\nvary: accept-encoding\r\npriority: u=5,i\r\netag: W/\"6a5079c6-5503\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GK2kMJctGFcsMRc9Q%2F9ThirPGg4J9XF9OLNZt%2BwntTf%2FyIQJTgU81c7ngsPs156MHzD0lp11jmQKxMFI8koAyAGSQP4%2B6DC3NKXgPvJfLTNCPPKDl2kCZknMyxrKPJwSZBTuqxCmp%2FHu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a24f344f07568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21763,"size_decoded":22416,"mime_type":"image/png","magic":"PNG image data, 617 x 115, 8-bit/color RGBA, non-interlaced","md5":"e223fab67fdfa85f73d4a53bc8f9196f","sha1":"e6aa145c7137da658bca5b1dbc73fc807c044ba3","sha256":"8123b05ddd0e23fc62793aa8fe44b9ae96798b7db9520aefbb19ddb6207130c2","sha512":"c47c0beabea139ee5f69dccc9def3af198134f0cf5a819cd886b4c990e63eff1f281f267b36dd86c99229cb30ec0823f403fe4a0c4d3d8afd28837c6ff25f4ed","ssdeep":"384:1kCnfusOoAzfvJLe6PSQ2CLFValHhrUUVpRo8LqI/a6UECCfLV9s1lfRJkCw:RnfuW8LSQDFMBpTdLqI/a6zuTr8","tlshash":"62a2d05f01c981e1ef1bfd401532a097b59c5241e9e740de1488b7e4eb0ba3727be256","first_seen":"2026-07-11T07:17:14.840769Z","last_seen":"2026-07-12T19:04:10.025992Z","times_seen":2,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/img/favicon.ico","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.695Z","timestamp":1783883021695,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: image/x-icon\r\netag: W/\"6a5079c6-47e\"\r\nlast-modified: Fri, 10 Jul 2026 04:49:10 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8ndDvQkZ9dD8uJlvH%2BvTLLOzGknFr%2FMpLvh9FIaorfH5x%2FDdS5H6QKYS%2BS56munAg9IOAXdx2I3gOYRjWaWQ5MV3PlfTM%2BCM5ssLGFr%2FGjAEQEC9G9TgpUz%2Fd4YQYGsJPOs6DkSxy90r\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\ncf-ray: a1a24f359f18568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1150,"size_decoded":1363,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"57930abdee98c3dd83a8345c0d74f76b","sha1":"c034bb39e488342b90591a1d72a9c04b7fab4087","sha256":"41d47aee2273da5dc33c94c5f1ae23d4a04b69ed01de0b9c1edf6568e061b504","sha512":"1ebd05ec0bee1bfd7ccc25bcd74872ef2588caaf1c251a95cd30755d239d1ff971f21b781530c1fdf86ae00e4a81097ecda45d0426d7f161823bb82696c67f48","ssdeep":"","tlshash":"f2212000f9c13ec0d430db3880286ef262876e23f59cc6834460ba3d76314b90623d3e","first_seen":"2023-10-21T14:56:03Z","last_seen":"2026-07-13T21:38:28.161387Z","times_seen":97,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T19:03:41.094Z","timestamp":1783883021094,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Fri, 10 Jul 2026 06:50:54 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RnQLM1aFpNzmnbUGM8HX94rJsBqXQz4HZgVsNcJRlKQiYO2NcwWOYtnAVF9thMwSFv56mNc0bvXi0gyd%2BXt5lpjj6sqjw3tEYeMHwo5RxT7SwbgcSHD5JXKEANVf8k6xrtOzH6zJAWea\"}]}\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1a24f321eed568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"particles.js","description":"Particles.js is a JavaScript library for creating particles.","website":"https://github.com/VincentGarreau/particles.js","common_platform_enumeration":"","icon":"","categories":["JavaScript graphics"]}],"data":{"size":1997,"size_decoded":1631,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"190c46449ca85ee18b918a0ebde0c146","sha1":"fdb4e74023545dfe181ce501e96e2f404d97a7fc","sha256":"7c563b2f06644a5a5b07fd9af4f308d22ca58dc5d7f7bf7a70903f54d75ef28a","sha512":"eb06624f2497b119dd0bd3a54a8d70421b77d010ca6bccb23e946e32495bd520177f2e6ec661f991f79707eeeafc25f52800be7d727586ce2a70a669e24682bc","ssdeep":"","tlshash":"7a412d62048d6d3b031786cab4a5e36e69db8d7ced538850a2fb53a60bc3d40dd9100a","first_seen":"2026-07-11T07:17:14.835935Z","last_seen":"2026-07-12T19:04:10.033574Z","times_seen":2,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":22,"connect":16,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/style.css","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.465Z","timestamp":1783883021465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 10 Jul 2026 04:49:34 GMT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\netag: W/\"6a5079de-d58\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Wd0rtMlxOpMtKPjJh%2BalpXq%2BubmikdrBC%2FBiRHRZStk7HRD5scyIH148QtfpeoR2n7KnQcb3I0sjvpPNdEop3dzs6a04EBHugqK%2BIevWi5LciqPPBo6yygMARUHzJXo5S8AoTP3eYQ%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a24f342f02568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3416,"size_decoded":1975,"mime_type":"text/css","magic":"ASCII text","md5":"a076bc97e0dfbc33739efecf3a5661c1","sha1":"82e463b3f563ba1c0a39e4f2c5291b6b34bd5d50","sha256":"675fb97921d3b04315b71f94cfe98240cb61f067c07fe7365fa1457575553767","sha512":"b4b6c7354bd814a7b52e0f23fb3a84e4ffaa88fc8b024e2b1f0d8d92e7ffd679ac6b0bf94bc2a2e5a2450a48e0ee793ad70eb87076b3d280b1071adc1d460118","ssdeep":"","tlshash":"bc6133235f1fb50a907b6a0d7ed286cf313dc00b891b0dad5ea89564c6ce08a5b357b8","first_seen":"2026-07-11T07:17:14.836825Z","last_seen":"2026-07-12T19:04:10.035911Z","times_seen":2,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gragonmoney-bonus.buzz/ajax/libs/particles.js/2.0.0/particles.min.js","fqdn":"gragonmoney-bonus.buzz","domain":"gragonmoney-bonus.buzz","tld":"buzz"},"ip":{"addr":"172.67.191.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gragonmoney-bonus.buzz/","date":"2026-07-12T19:03:41.468Z","timestamp":1783883021468,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gragonmoney-bonus.buzz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 08:34:52 GMT","end":"Mon, 05 Oct 2026 09:33:31 GMT"},"fingerprint":{"sha1":"60:F2:00:4D:D7:3F:19:81:A9:5F:B5:F1:1B:48:12:E8:04:19:21:12","sha256":"59:31:09:3E:11:A9:21:AE:8D:D0:3D:6B:1E:58:95:ED:2A:67:80:61:ED:AE:CD:60:3F:B4:6E:CB:25:D1:9F:4E"}}},"request":{"raw":"GET /ajax/libs/particles.js/2.0.0/particles.min.js HTTP/1.1\r\nHost: gragonmoney-bonus.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gragonmoney-bonus.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 19:03:41 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 10 Jul 2026 04:49:10 GMT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"6a5079c6-5b44\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KlaKA4e2Xhv0OC0kdzBi1jes5qKECOP4%2FIcegA5NLC%2Fb%2BPakxw5VZT2Cs6ilvIxxmynqqeWUVHRvbufMt2rn2a14yEOzrBKSDJVZL2jvhwZ5nrEe5YwE1sniJS6KOrv8kp2HPmNKFm3V\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a24f342f03568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23364,"size_decoded":7686,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (23002)","md5":"00debcf6cf0789a19cee2278011afcd4","sha1":"8017f8b1869077db728573f1ca4684a00af69462","sha256":"faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6","sha512":"29e7f9b1cee07d369c47b4d929e95cad1b35e62a5fefeb7e9fb661ea628d25b996fbf4517425bd9f07cb9f8617d2cda73ba2afe58d8286a8086a4682e8f5b4f4","ssdeep":"384:NkfJtGvWjT6uYvqhCz8wSEHESxtVAFPQcYpeib+9rOEKXWd/:NC7T6uYvn8wRxwyryVOEKXW5","tlshash":"61a2934d23f73e77378ab2e09be9d122c774a4d1399b04b0f93c667da52549201ee7a0","first_seen":"2023-03-07T01:16:44Z","last_seen":"2026-07-14T01:58:08.964763Z","times_seen":5275,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"gragonmoney-bonus.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}