{"report_id":"5babce9e-9d25-4d42-81b4-ae4a2ecfa0aa","version":0,"status":"done","tags":[],"date":"2026-10-09T16:04:02Z","url":{"schema":"http","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"172.67.152.40","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"title":"NovaChange","dom":{"size":70216,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (382)","md5":"9ddf0b340cb5880b441a3ca992a52b16","sha1":"312c35a5193b8d27c752641bc6f012323b5da994","sha256":"58f1f335ebc5192d670816108eb577b3749dd07e5039ead43587129677bf2c9b","sha512":"c8b6110713556da81ba362eeb6164729e7de9833a6216f05cad1222bf8e0f99cdcca879d1b63b57eb9605b5f6e1727228f264d1f00f22bddd72948c00c4997eb","ssdeep":"1536:rZC0yrf5hoo3KvJ4DqtS6duD6Qy46kUAo2i4VSZommHe0Q+k/y9SCy7oYsuPIsA+:rZCWo3Kh4Wt1kD6Qy46kUAo2i4VSZomh","tlshash":"7963bc7156fe549a1102f00bdd04ae0a3dbb40ff7f669716366c2d6e7fe2064ca3a219","dom_hash":"domhash9034c6443ebdcc48ce9b2f631d3d3549","first_seen":"2026-10-09T15:47:59.677389Z","last_seen":"2026-10-09T16:04:10.752589Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"172.67.152.40","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-13T16:04:02Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"novachange.pro","ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-10-09T15:47:54.053152Z","last_seen":"2026-10-09T15:47:54.053153Z","alert_count":7,"request_count":7,"received_data":399207,"sent_data":3270,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.156.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-10-04T23:05:21.462671Z","alert_count":0,"request_count":1,"received_data":525,"sent_data":905,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-10-04T22:47:33.985443Z","alert_count":0,"request_count":1,"received_data":495867,"sent_data":445,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc9688c00d6ee806a382b98e92050e58","sha1":"0267874f2d65331c400994e6ffe1d6de25121fba","sha256":"75c46f86ce0d9ce11a848bf6cf1c28093a1c95360e2bb0da54f57982f6d16396","sha512":"dbd269afb233e9dfcd19e91363494957f09a19a73dffdafe8c1c7d87145c19a30b5f397b596971a40317d5b0c507f5f02d79b0ccba90bd9221d5d6266fea3c5a","ssdeep":"","tlshash":"08d097c922c54cb1a8ae2b430f0b340ca01120a002410df08a60b1482118ee3f109ca1","size":238,"data":"","first_seen":"2026-10-09T15:47:59.722598Z","last_seen":"2026-10-09T16:04:10.797525Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7e73d3fe85ca69a1f151fcf6557a385e","sha1":"8e6d33d7f70e7e06b3184a8eea03b4013769f3e1","sha256":"035c67053522e375b73266c424adeed5c5d6570b31b11a22266bf02613221b35","sha512":"9abc87afa53e9b81d303d4f75a39e2ef5dfa20b468e932fffcf4c948969f314bf9425f7a22dd89702a50045f6ef14080bf6d21be8a461e32c51d0ec6bc586953","ssdeep":"","tlshash":"2d014e0ee3f9087709bb166762da8b9177250083c0858f1d3f7c9a890fc089155e0ac0","size":661,"data":"","first_seen":"2026-10-09T15:45:13.789335Z","last_seen":"2026-10-09T16:04:10.799313Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4550c506aa46dd131081ce243c98cc32","sha1":"bfc5117d859d700f8de6adc201776a36faf72b71","sha256":"a9ef7cb44660152c40c2faea356b28b249df462f08bdc4ea2c9ab25f321e5e76","sha512":"08254210e36503d7b8d50a7b233a928db0ad24a0ebfda676e68c0e65dec8b0441466305bb0826031ceb09a1c6f3aeb225be2209b781bacdda11597d962a57eda","ssdeep":"","tlshash":"73f07d5e52ab4130153b176aa7bb726474623007244af403360c8a852f68e17992bcc4","size":638,"data":"","first_seen":"2026-10-09T15:47:59.731409Z","last_seen":"2026-10-09T16:04:10.801518Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/offer/6bb4cb23f0d2/config.js","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a64c6499b8f2a9ac1c969d6d0bbea3dd","sha1":"e80365e2dfe4ad956c2967052f82cc1407c1eabf","sha256":"7e081d3c54dae159bc4e077f5611d3a0a006ca058bbe76080017b7a8cc5c013e","sha512":"98351310ec217482524dd5af9909e1a1f02e4f2d5daeafcfac57671847fd5c8e71ca8382342388a519920b7e7e1083a3349eb606c49d8d6135186bda49cf3b73","ssdeep":"","tlshash":"faf0e17e0105c64011ff2285628e1911351d41e832e8f2e1b0899b205e3da2714fffc8","size":565,"data":"","first_seen":"2026-10-09T15:47:59.710084Z","last_seen":"2026-10-09T16:04:10.758631Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=AW-18408255189","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd7c1ccd4a0be31d86235934aa3ef87c","sha1":"a73e2532097a51c91557215c542fac4e78416373","sha256":"6e5ed9fa07de064ca08f6fd167f3c82863d1595cd4bd0c0ddb82122bd1a55104","sha512":"0b58122cebebe6c5c19a6396d65f04c4273b86583cbe5e6d989d8ee26cb3569664796aa504543417512265e990e898ef69592182969f6955ed6990099c9e6e42","ssdeep":"6144:KsfCylnlIma7ulkl+cfIb/EfD3cezXmjw2rFp:DemlMmj/j","tlshash":"b2b408cdb3c6746293a2f578903f018b657a29a2b44cc89af189dce42d3469a5173f7c","size":495263,"data":"","first_seen":"2026-10-09T15:47:59.702699Z","last_seen":"2026-10-09T16:04:10.792044Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/novachange/tracker.js","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa1d553574f6f2677a23d4006ac22e16","sha1":"5ba15f2a80d1d6454296b229704295e9cfca90a9","sha256":"3de391c9256fe3697fa2ae275888bff3eb06ade97ec5396be90506db12508070","sha512":"cc77b0c1a7574fd3058c4e921529b9d148c2514acfc2e754d11260b77de4577d3aa17be1fa46cdf4ea469e54aeaebbfa1a9c7442fce3f429e940d765bb6b56b8","ssdeep":"","tlshash":"6511109ae99210f204fb6139071f72053236c19fa5c7ed90391d1e482ff482e41d4bdc","size":934,"data":"","first_seen":"2026-10-09T15:47:59.719609Z","last_seen":"2026-10-09T16:04:10.779986Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"novachange.pro/offer/6bb4cb23f0d2/config.js","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:30.994Z","timestamp":1791561750994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /offer/6bb4cb23f0d2/config.js HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: no-store\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WI7guiivxTTgtzN1fW4pvdpea3XRAyo5d794Y23rlAnTTARyC%2F%2FDcinsDzr5BvkU%2FHrRECIvPdFWnCIW5wVFWi2zEg1w0%2FjfqjwvjhzEKeh3aLTBbgSDw%2FLio3yfCLizHg%3D%3D\"}]}\r\ncontent-encoding: gzip\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https://fonts.gstatic.com;form-action 'self';frame-ancestors 'none';img-src 'self' data: blob: https:;object-src 'none';script-src 'self' 'wasm-unsafe-eval' blob:;script-src-attr 'none';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;upgrade-insecure-requests;media-src 'self' data: blob: https:;connect-src 'self' http: https: ws: wss:;worker-src 'self' blob:\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 09 Oct 2026 16:02:33 GMT\r\netag: W/\"235-6ANl4t/krZVsKWcFL4LMFAfB6r8\"\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: BYPASS\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a47e9c2fbd045687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":565,"size_decoded":1808,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"a64c6499b8f2a9ac1c969d6d0bbea3dd","sha1":"e80365e2dfe4ad956c2967052f82cc1407c1eabf","sha256":"7e081d3c54dae159bc4e077f5611d3a0a006ca058bbe76080017b7a8cc5c013e","sha512":"98351310ec217482524dd5af9909e1a1f02e4f2d5daeafcfac57671847fd5c8e71ca8382342388a519920b7e7e1083a3349eb606c49d8d6135186bda49cf3b73","ssdeep":"","tlshash":"faf0e17e0105c64011ff2285628e1911351d41e832e8f2e1b0899b205e3da2714fffc8","first_seen":"2026-10-09T15:47:59.710084Z","last_seen":"2026-10-09T16:04:10.758631Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2784,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2784,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/novachange/finish/logo.png","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:31.002Z","timestamp":1791561751002,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /novachange/finish/logo.png HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncache-control: no-store\r\nserver-timing: cfExtPri\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https://fonts.gstatic.com;form-action 'self';frame-ancestors 'none';img-src 'self' data: blob: https:;object-src 'none';script-src 'self' 'wasm-unsafe-eval' blob:;script-src-attr 'none';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;upgrade-insecure-requests;media-src 'self' data: blob: https:;connect-src 'self' http: https: ws: wss:;worker-src 'self' blob:\r\ncontent-type: image/png\r\ndate: Fri, 09 Oct 2026 16:02:33 GMT\r\netag: W/\"329c7-1a0d8288395\"\r\nlast-modified: Fri, 25 Sep 2026 10:42:08 GMT\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\npriority: u=4,i\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FztLj%2F4mCqku7os04szU%2FsE8L03eayRPm0Zolgs8mlxJphi1NVJ9sCe4SOx1XpMJEEhurJ%2BFs6av1aXeUiFMfKuQmF4Pzg68PCocu5nX1K%2BVuMZRWc9yZbq36aG2CtfAUQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a47e9c2fcd065687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 207303\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":207303,"size_decoded":208733,"mime_type":"image/png","magic":"PNG image data, 1024 x 766, 8-bit/color RGBA, non-interlaced","md5":"d442f8931316248fda51dfae65cdfd76","sha1":"281913eedb0e80f4c4a6c766a05a546a94e2d64b","sha256":"75977b4522bfc256e80b59d32e06f7cd3f5e7eb013ed9441afba9d86b48e61ae","sha512":"abb09cbe894ab2fd2501799bdc3d620af5b215326a7867a6bb6d480da9c6652e3df233e615afa348b10adbb0fb3a74c01d203871fc053d606866ac8f65a17205","ssdeep":"6144:Brd3Q9sBn0kWOTp9O9phkSqg6MMaWOyB1:B53LlVl968KGWy3","tlshash":"2d1412250032e3994e9fa87e4316ff8b7d9f367623ee7558c961860e3621c9c0e97097","first_seen":"2026-10-09T15:47:59.71567Z","last_seen":"2026-10-09T16:04:10.762424Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3871,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2587,"receive":1284,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/ccm/collect?rcb=6\u0026frm=0\u0026apvc=1\u0026auid=935481806.1791561754\u0026dt=NovaChange\u0026tid=AW-18408255189\u0026en=page_view\u0026dl=https%3A%2F%2Fnovachange.pro%2F\u0026scrsrc=www.googletagmanager.com\u0026rnd=1267276817.1791561754\u0026navt=n\u0026npa=1\u0026gtm=45be6a72v9263050190za208zd9263050190xecxf1\u0026gcd=13l3l3l2l1l1\u0026dma_cps=a\u0026dma=1\u0026tag_exp=115938465~115938468~118012009~118897920~118897930~120213116~120385422~120469145~120469153~121046263~121046271~121246026~121246034\u0026tft=1791561753880\u0026tfd=4735\u0026tids=AW-18408255189\u0026fmt=8","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.156.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:33.884Z","timestamp":1791561753884,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:11 GMT","end":"Fri, 11 Dec 2026 20:00:10 GMT"},"fingerprint":{"sha1":"81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F","sha256":"30:B5:2C:EA:47:6E:0A:AB:5B:94:50:CC:FC:33:CB:F9:57:B2:4B:F1:B4:5D:3D:7D:BB:10:A6:02:81:8E:54:F5"}}},"request":{"raw":"POST /ccm/collect?rcb=6\u0026frm=0\u0026apvc=1\u0026auid=935481806.1791561754\u0026dt=NovaChange\u0026tid=AW-18408255189\u0026en=page_view\u0026dl=https%3A%2F%2Fnovachange.pro%2F\u0026scrsrc=www.googletagmanager.com\u0026rnd=1267276817.1791561754\u0026navt=n\u0026npa=1\u0026gtm=45be6a72v9263050190za208zd9263050190xecxf1\u0026gcd=13l3l3l2l1l1\u0026dma_cps=a\u0026dma=1\u0026tag_exp=115938465~115938468~118012009~118897920~118897930~120213116~120385422~120469145~120469153~121046263~121046271~121246026~121246034\u0026tft=1791561753880\u0026tfd=4735\u0026tids=AW-18408255189\u0026fmt=8 HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: null\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ndate: Fri, 09 Oct 2026 16:02:34 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/plain\r\nvary: Origin, X-Origin, Referer\r\nserver: scaffolding on HTTPServer2\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: null\r\naccess-control-expose-headers: date,vary,vary,vary,server,content-length\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":525,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T19:29:41.793778Z","times_seen":18979539,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":3,"connect":25,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/novachange/finish/verified.png","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:31.003Z","timestamp":1791561751003,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /novachange/finish/verified.png HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncache-control: no-store\r\nserver-timing: cfExtPri\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https://fonts.gstatic.com;form-action 'self';frame-ancestors 'none';img-src 'self' data: blob: https:;object-src 'none';script-src 'self' 'wasm-unsafe-eval' blob:;script-src-attr 'none';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;upgrade-insecure-requests;media-src 'self' data: blob: https:;connect-src 'self' http: https: ws: wss:;worker-src 'self' blob:\r\ncontent-type: image/png\r\ndate: Fri, 09 Oct 2026 16:02:33 GMT\r\netag: W/\"186e6-1a0d8289e51\"\r\nlast-modified: Fri, 25 Sep 2026 10:42:15 GMT\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\npriority: u=4,i\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kd%2B2Fo%2Bo9SK2JTV0fJtLxGxfOxGRDR7WrlpBiSzkyVlBsCstIHfzBvNaF3Nb%2FOyXNVTTCVHUhqQL1arLKIs%2Bei%2F0DRIaKckjvYodn4xPYU%2FviVC3bbzNhtniJQ7IqDREGw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a47e9c2fcd085687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 100070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100070,"size_decoded":101504,"mime_type":"image/png","magic":"PNG image data, 600 x 600, 8-bit/color RGBA, non-interlaced","md5":"026d73bb85760fece59e6a3c383fa8fc","sha1":"0d1ef407abcdd6797f800caec4aa4e62eb92d585","sha256":"eb273430de19700784c5faac766169c5fd61a23217ac45dfe759cc8fa216d329","sha512":"c767e0e6ad1049f61b062037f496bfa9ac778ea593e8881d319f22ce84af7d6c4d9039ca5565bd6affd4f379ad2c1ec96a522e72218227f434521f55d5b7d544","ssdeep":"1536:v0elhZxBqKrv5/5yuN6HNbmeJIfUb/PgSSeb9dWsO3qSvCdQ:celzq+pgBRmeuA/P9Seb9dEf","tlshash":"03a301220729809fdf6ca4f4bca3cb14bd01b28d565f08bb57b9488862b5e2f65f15e1","first_seen":"2026-10-09T15:47:59.692618Z","last_seen":"2026-10-09T16:04:10.76885Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2520,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2411,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/novachange/finish/usdc.svg","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:31.005Z","timestamp":1791561751005,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /novachange/finish/usdc.svg HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: no-store\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f7cJzSXYioYePL9gVt%2FR6uPHuBXE7NETd7EOn1tM6obZ5wdn4Nh22M3ehZgdi1o%2BdYMXrYyhhbcA709LnR%2FxT7Cmwx191%2BUgs7k7DER1simL6hx5UiERvksqAbn2tIDstQ%3D%3D\"}]}\r\ncontent-encoding: gzip\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https://fonts.gstatic.com;form-action 'self';frame-ancestors 'none';img-src 'self' data: blob: https:;object-src 'none';script-src 'self' 'wasm-unsafe-eval' blob:;script-src-attr 'none';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;upgrade-insecure-requests;media-src 'self' data: blob: https:;connect-src 'self' http: https: ws: wss:;worker-src 'self' blob:\r\ncontent-type: image/svg+xml\r\ndate: Fri, 09 Oct 2026 16:02:33 GMT\r\netag: W/\"24b-1a0d8288ecd\"\r\nlast-modified: Fri, 25 Sep 2026 10:42:11 GMT\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: BYPASS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a47e9c2fcd095687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":587,"size_decoded":1785,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"59f33e5de30e7913216e7286981a8328","sha1":"4851d9998aeedcc5bcad141f8412d809c8afd6a7","sha256":"961d59513399e42b692aeacef8000dfab224d582b3fae78a7e249d23042f7c5a","sha512":"4a6ff9a412e9c274532a5712b45c2083f3c94ba3a0d581f80cbbea2df521b557b146cb4fe64f5c1eeca9d9fe5b20e9e29d235aa5c6732cf3f3b045baaeecd9b7","ssdeep":"","tlshash":"73f08119d25c493df7548104eb04b434516890d38289a131f5acef7817384dea87bbdc","first_seen":"2026-10-09T15:47:59.717177Z","last_seen":"2026-10-09T16:04:10.775564Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2750,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2750,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/novachange/tracker.js","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:33.786Z","timestamp":1791561753786,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /novachange/tracker.js HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: no-store\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KktE4HgByEGK6xMZpmkr%2FVKf2BQBNkU611ie2GwZHo8ns3iIEgSPL3w9QJCay3svL%2BOWULOOK%2FEGjpcw6GsXbzDiJmr1sUoYSoGnhsUsTpytnQjGrxZfYMjIYlLIhCH0vw%3D%3D\"}]}\r\ncontent-encoding: gzip\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https://fonts.gstatic.com;form-action 'self';frame-ancestors 'none';img-src 'self' data: blob: https:;object-src 'none';script-src 'self' 'wasm-unsafe-eval' blob:;script-src-attr 'none';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;upgrade-insecure-requests;media-src 'self' data: blob: https:;connect-src 'self' http: https: ws: wss:;worker-src 'self' blob:\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 09 Oct 2026 16:02:35 GMT\r\netag: W/\"3a6-W6FfKoDR1kVClrIpcEKV6c/KkKk\"\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: BYPASS\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a47e9c41289e5687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":934,"size_decoded":2007,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"fa1d553574f6f2677a23d4006ac22e16","sha1":"5ba15f2a80d1d6454296b229704295e9cfca90a9","sha256":"3de391c9256fe3697fa2ae275888bff3eb06ade97ec5396be90506db12508070","sha512":"cc77b0c1a7574fd3058c4e921529b9d148c2514acfc2e754d11260b77de4577d3aa17be1fa46cdf4ea469e54aeaebbfa1a9c7442fce3f429e940d765bb6b56b8","ssdeep":"","tlshash":"6511109ae99210f204fb6139071f72053236c19fa5c7ed90391d1e482ff482e41d4bdc","first_seen":"2026-10-09T15:47:59.719609Z","last_seen":"2026-10-09T16:04:10.779986Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1504,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1503,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/favicon.ico","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:34.090Z","timestamp":1791561754090,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: _gcl_au=1.1.935481806.1791561754\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"_gcl_au","value":"1.1.935481806.1791561754"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hSUMQ%2Fyci5nQucrDn11VWS0FqYj%2FSLMlMRDK1mrSlgNocerIaYR4R5TwwmFkEO1BK9377Pj9vAocnGwNGAiFUYlocDbL0aKRKLa0q5wctod0iVBQNkCn2fP9JtsjMKLBFQ%3D%3D\"}]}\r\ncontent-type: text/html\r\ndate: Fri, 09 Oct 2026 16:02:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 28 Sep 2026 06:50:39 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: cloudflare\r\nx-content-type-options: nosniff\r\nage: 917\r\npriority: u=6,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a47e9c4309075687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10322,"size_decoded":3759,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (314)","md5":"24f516e449d988482c9345a282ad32c4","sha1":"bf46741a1a5b16ec47421761576001d9ab747273","sha256":"0f120aaf3af68defae27fd915fc3f146f3165e10c4109877e8bc88821186ede9","sha512":"0ca09578dc2b920cbf55004b1953bde83084009acca616c967840c3b25a1142d80e1d8db3e3238de63f82100b945cbadc8eec5ae03493b452c52e3d3f152bb28","ssdeep":"96:iMc4ixe3R34iZGi9q5YiIXD4i0C4iOa95Mt1iDFD0jGj5pTgyFFf0I8mc4i1yCr4:iMpiziz5X0iIid8jrqfGmpioCxm","tlshash":"f5228361a0f81f93026a80c5b5e2b6393e95f293da491144b0be5bd90fe3c50f95f1bd","first_seen":"2026-10-09T15:47:59.688149Z","last_seen":"2026-10-09T16:04:10.785117Z","times_seen":2,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"novachange.pro/","fqdn":"novachange.pro","domain":"novachange.pro","tld":"pro"},"ip":{"addr":"104.21.1.38","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T16:02:29.177Z","timestamp":1791561749177,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"novachange.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 08:44:35 GMT","end":"Wed, 23 Dec 2026 08:44:34 GMT"},"fingerprint":{"sha1":"BE:E0:FD:DA:F3:06:E0:89:A2:12:84:A7:85:64:CC:7B:1F:73:A5:AB","sha256":"40:54:2C:58:FA:FD:05:DD:76:FE:81:D3:07:A6:B0:1F:C1:5F:7B:AB:EF:E6:20:35:96:1E:21:50:5A:CA:6B:A4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: novachange.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: no-store\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hllUUySgnTq4SPrWv7ayQ%2FnJls0lln1ckEEZAGbEXdpqfmGo4JGHt5c6Awn69yhpXmQ1m6kmPt7IdKW0ZjBv8RXnJ1Pfb5Sz1y4rGMLSlu7RoEp9q01qjjn3VDwjoYDAHg%3D%3D\"}]}\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https:; connect-src 'self' https: https://www.google-analytics.com https://analytics.google.com https://www.googletagmanager.com\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 09 Oct 2026 16:02:30 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: no-referrer\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a47e9c24db575687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70078,"size_decoded":19950,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (382)","md5":"054c9dc831780cfb8163db85429f9109","sha1":"8a431609b4f88c0ed3b3a9dbdc8a096d021e51f3","sha256":"8a5c7ed93862e13617d1cbbbdb5f81ef5b4e47167160c8c7877f2dc1f02d8a28","sha512":"d78293b6e571bfa2770ba4219d71bef66209ebe0ba6ebfa87b953c39197ec78ed6dfb5198e6bf981c57f6d9cf98286fecb58bc38e6b2af8f06f1d80ee4bbe263","ssdeep":"1536:WqC0yrf5hoo3KvJ4DqtS6duD6Qy46kgAoCi4VSZommHe0Q+k/y9SCy7oYsuPIsAH:WqCWo3Kh4Wt1kD6Qy46kgAoCi4VSZomA","tlshash":"bb63bc6155fe549e1102f00bdd04ae0a3db740ff7f6a9716366c2d6e7fe2064ca3a219","first_seen":"2026-10-09T15:47:59.700216Z","last_seen":"2026-10-09T16:04:10.788661Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1422,"timings":{"blocked":-1,"dns":54,"connect":25,"send":0,"wait":1145,"receive":198,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"novachange.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=AW-18408255189","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://novachange.pro/","date":"2026-10-09T16:02:30.989Z","timestamp":1791561750989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:18 GMT","end":"Fri, 11 Dec 2026 20:00:17 GMT"},"fingerprint":{"sha1":"28:B6:EA:A0:82:D0:48:3A:13:C3:DC:38:88:85:51:9B:B3:CB:89:B4","sha256":"80:50:66:22:4E:D0:C3:BC:40:94:CA:B1:AA:D1:DB:13:A9:E5:74:53:AA:EB:19:DE:D1:A8:AC:C9:B7:18:01:EF"}}},"request":{"raw":"GET /gtag/js?id=AW-18408255189 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Fri, 09 Oct 2026 16:02:31 GMT\r\nexpires: Fri, 09 Oct 2026 16:02:31 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 167985\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":495263,"size_decoded":168589,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6696)","md5":"cd7c1ccd4a0be31d86235934aa3ef87c","sha1":"a73e2532097a51c91557215c542fac4e78416373","sha256":"6e5ed9fa07de064ca08f6fd167f3c82863d1595cd4bd0c0ddb82122bd1a55104","sha512":"0b58122cebebe6c5c19a6396d65f04c4273b86583cbe5e6d989d8ee26cb3569664796aa504543417512265e990e898ef69592182969f6955ed6990099c9e6e42","ssdeep":"6144:KsfCylnlIma7ulkl+cfIb/EfD3cezXmjw2rFp:DemlMmj/j","tlshash":"b2b408cdb3c6746293a2f578903f018b657a29a2b44cc89af189dce42d3469a5173f7c","first_seen":"2026-10-09T15:47:59.702699Z","last_seen":"2026-10-09T16:04:10.792044Z","times_seen":2,"resource_available":true,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":38,"receive":49,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}