{"report_id":"6008fd48-71cd-46dd-a257-c9dbaa5e1166","version":6,"status":"done","tags":[],"date":"2026-02-14T09:07:37Z","url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"title":"OpenClaw — Personal AI Assistant","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-21T09:07:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"opensclaw.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"opensclaw.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"openclaw.ai","ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-30T05:34:56.583129Z","last_seen":"2026-02-13T16:06:01.735282Z","alert_count":0,"request_count":1,"received_data":6443,"sent_data":439,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"opensclaw.com","ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-30","domain_rank":0,"first_seen":"2026-02-13T11:40:40.337928Z","last_seen":"2026-02-13T11:40:40.337929Z","alert_count":34,"request_count":11,"received_data":4267430,"sent_data":4874,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.molt.bot","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-27T08:49:52.986482Z","last_seen":"2026-02-12T21:05:59.740305Z","alert_count":0,"request_count":1,"received_data":6457,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"8de04e3dc63af7585af0e827672eb149","sha1":"02ee5e4b4e73e430d629744c4b7a3e38c36ed06d","sha256":"123e2a4c9c65ad62ea2b0992b1f80073e18a341a810f9ba40d1c4cdc31f1e759","sha512":"a42fcbfd4fc45305b75c0093524abafcf73f7d10f3bbe8cf573f3ea87803f672ae7fd293a116e7c24aeb0ef9fb24b9ea32e48200a56243187d5b550407631184","ssdeep":"","tlshash":"a911cce0aa6c599781c2095034894b02b13cb020203d9fd0bf75f0ce7c7c7ec96d262a","size":1000,"data":"","first_seen":"2025-12-20T20:03:49.143914Z","last_seen":"2026-06-07T00:08:21.702938Z","times_seen":1701,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3433c9d3e9b7e8e5b34ed72e309db572","sha1":"d53d7df082088749c1df6b08330ee9b9e4076932","sha256":"1d96fa9904e3743570bccd5be90e83fd91975299f374093cc6f723673d582dd1","sha512":"ffd0e047331871f21738643968b7eb7fa045ee0e45346a9ea986c4b8a3e745dd310542c6b2734f6d244408bba6548ec66f5cd7662c69485b5e59e3b9432cdff2","ssdeep":"","tlshash":"06f04245bd825a24d35670ddc41f978cc53690dd91491c4cbb64ece1de94c2cdfc6534","size":585,"data":"","first_seen":"2025-08-01T04:16:24.219641Z","last_seen":"2026-08-01T15:57:23.060381Z","times_seen":3448,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"59a13eef9e5e0ec7844e58e8b47d54a0","sha1":"0fb2b2059a878b87f8524284d448dd46a4351953","sha256":"c890c150b008d069bfddb86ee2c2e3fe979515939053b4c53fd6853b68e4fe35","sha512":"7fcdb614d30b1141e9a1e134a98e2888007f786f866c24e6383106d3e003f094e72901aa295e7d3450fccf5a249b25b436401a5b9439205da6b0eec8d72cfc80","ssdeep":"","tlshash":"33f0beaf336126ca23ae6ad20796c01d1e72e4ab3002163c575a36ca0cb6f52521b07e","size":494,"data":"","first_seen":"2025-08-01T04:17:54.874483Z","last_seen":"2026-08-01T15:57:23.056766Z","times_seen":3196,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e1ee9f442371606d9a13b41a0dbeaff","sha1":"a05c25c8ad9127fe7d45319ce13e8b4a485d2e01","sha256":"713285cbc0cb910dfd2e7a86c604d191a27789ae50964ab1c674507ff4a20c45","sha512":"1dbac9fa1e0b338e780a3600f1a3da140a6c83a961a1d0c6c80fe3dc5a9041c346c471d264a07ccc87457cdccc2a28b768d02283512ba9cee0fc2e2b7124e42d","ssdeep":"","tlshash":"0221fedeb2826488526794d742cd8dceb8e617a919008c20452ef299225c3e8fb6ad54","size":1177,"data":"","first_seen":"2025-08-01T04:16:24.218288Z","last_seen":"2026-08-01T15:57:23.061079Z","times_seen":3304,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/orion.js","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","size":107989,"data":"","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"opensclaw.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"e7cedee5f4aabfe0f0a25596641b0073","sha1":"9e90df4076abbd3350295826c5ad3ec1856ffd56","sha256":"c2e60dc68f09c70895f8cb98a4a88e16cf3c691d5a96b9c93c3aab931eafc258","sha512":"17dc0e86fcd7af709d5ffb50d255169d2300566d30c2da4345505703e6a6ebf303df263db9561688753bc03af86b134ccfa9f763966f8612ef554be796d6c025","ssdeep":"1536:jQe6pw4biVcuVXdWAgB1PusH2DY7sX3lX56oH:Me6KBVcuVtWAgR2Do2X6oH","tlshash":"7fa340d59a4bd0e08e5a11edd077ed0ae0281aa3cdacf193b92cded1355df22c84753a","size":104467,"data":"","first_seen":"2026-01-07T13:23:26.460119Z","last_seen":"2026-02-14T09:07:38.76649Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"opensclaw.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f278e1582a6b32d6a9a05328bba73b0f","sha1":"02780b645a044990e49787663d3dba06626b1e3d","sha256":"07317dc90130ec69ed8e07a8362168074f9067473354101f361449cff37110aa","sha512":"08463b63ba1654bf203117d8f0c0a2ce4b5d92914ffba7c8ac3d942ff1a812c86cc61d9e840e5f3422c2b22d1b71b1a06b9a6d40d4e4259b32fd8cd40cc8357f","ssdeep":"","tlshash":"55319948a43216904242e8f1c676abeeabe774080574446d349cbec7eff8447e521678","size":1529,"data":"","first_seen":"2025-08-01T04:16:24.221852Z","last_seen":"2026-08-01T15:57:23.059565Z","times_seen":3410,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1e21743cd2ee2004cd56bfc5c29e3609","sha1":"bf516634ffbcfd3186b71dafc0ecdcc47894c439","sha256":"0e428980439e794b176e0ee3cd84e4878510b1d52c1efc1c00f4af9729a17029","sha512":"4264e5ce5b4f3acb24046582388132a5915398c9266c18c6349d75fb94bd74bac990dc6ebd12e1e118a3a24752a3e4badae2faabd69b9827d1f223a0750da4c2","ssdeep":"48:atoyTqSsM+c69M+c69M+c69M+c60778KK7NaaM//M+A:atlDNDNDNDl778KKw//M+A","tlshash":"25913f32165427da63ce8fd45a85751d01d2c89a383e60bdff3279eded3a683c031612","size":4506,"data":"","first_seen":"2025-08-01T04:16:24.215618Z","last_seen":"2026-08-01T15:57:23.055248Z","times_seen":3364,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2380d391cf784bce2f77e0e16fa2268b","sha1":"2b88cb08e3d7f56772d46fe1a10d84774e8728d5","sha256":"e65fcff70fe965f3d1878fe515a7ebcd265dfe61b15461521450c882e8d081d7","sha512":"0f3264af3a045928be20d2ee1ef3af905571d07e3fc25eaeda22199baca89b8c9bff94d90d81124ff45b16c5e40df291c2f49d9464ba901d2d961f6fd1196f1f","ssdeep":"","tlshash":"e6411b1e00aa0aa31ba3054333ce846d0956c2cedcc73534d3b27f8134c67832a93bea","size":2254,"data":"","first_seen":"2025-08-01T04:17:54.882582Z","last_seen":"2026-08-01T15:57:23.056043Z","times_seen":3234,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"opensclaw.com/","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-14T09:07:13.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 14 Feb 2026 09:07:13 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GqWMDn3086Fke3vNLKyMnqKMqKpikVwOG1gH8TSLJdDsX1juO89GOkYEUlNV%2BB%2B3yZ63kPYH8WbTyOPxWiPHHobHs%2B7Zab48SSq1r%2Fg%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cdb69f8fa9f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":228382,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5913)","md5":"d5b5e48b6c936606d0c90a7557476cd7","sha1":"a5089af6e11aaca01c2cf95fdfc0736f53a8e6d0","sha256":"512237898cfd893eb9bb86dcb53a4ec9be63d6702df80f0d7cc73bca4ce66ee9","sha512":"b0f6664bbd2ecafbe23347645602f69a17cf143b2c27dacdd7fa443d272ddd5bb28174ffc592bf88d2c527a07adf5ffc837386a42dfac588bbe0e8df5210cc8e","ssdeep":"3072:gHujl3kujl3dlNSlNEveoizBwbCnUmEz+u4voiyXPMFOesb1jCFUnYyJbXIa+Lwi:gOxVxl09oizBwbCnUmEz+u4voi5","tlshash":"ae24002913a504abc16370e6c1a9e234a742e64fce114ac9399d6ff9af59f74f83304d","first_seen":"2026-02-13T11:40:43.420073Z","last_seen":"2026-02-14T09:07:38.755256Z","times_seen":2,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":41,"dns":26,"connect":1,"send":0,"wait":251,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/css.css","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:13.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /css.css HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-4f9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GA91tAkUnY1rhSlSToqEEVjirUC%2FT7O0KIC9t8IZXVs0rUn2PtaplfxmHd%2BTkMsy3fpbZ9NBmCck0wrjf3OZ6dBAoMnDlDqH%2BTG0FBk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdb69fb7924b7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1273,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f36b5c9ce62f86dafb80b20e73aa914e","sha1":"2c54e886da040ff77b9f97f391d57ed9cadb62d8","sha256":"aa415a134960a1a48d85cb93c61530b80d233c1c71a6b874e61eb0349f6e4843","sha512":"d71f2e0f3da0095da9763d164c162211b9c1b7de3ea1423351d0631624e84d66230b8973951ecb7fa7ff5e3c16f7fd80150e4a181067062da6b5d53b0d06ea4e","ssdeep":"","tlshash":"d4217fa04459e412e4123c6c33dfbf5a1d4db4261446ad6e3a7d58589fafe6883d0f1c","first_seen":"2026-02-12T21:05:34.324518Z","last_seen":"2026-02-14T09:07:38.756697Z","times_seen":4,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/index.CcT2Xj7B.css","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:13.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /index.CcT2Xj7B.css HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-5cec\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h09hQNjNZqrXu1%2Fh8yc6wUTDyuugv56TL9laeNe36gVF87R7Qful9%2FwIDOaSBo4iYQo5OmKooPnNzOOViCdMdA2ILX0CUzylaeIST%2Fg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdb69fb7925b7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23788,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (23787)","md5":"fd8be35bc5bce433b031604ea334c7ec","sha1":"ab571f249dd5f0e627ef50b328e2e9fd89cbeadd","sha256":"af8952b7d8f2b09d4fa09c38f2e2cb55da1b5049e6c6f88e19a3fd6c980836a2","sha512":"41b20e80565c24558d302808520c4e72bd22163921d382810e84de34ee2e8e0f9c400b568228a7bb540a669e0674cdbf2702d33dac9e55633bb28935c684e702","ssdeep":"192:bxAgGooNVdwPlM7AYQuUMf8uGlkNjZ2MA+sAMUcFwna1YcpF0MI86YyyUx2+BUdE:+dw4AMNJA+Cdh1ZpF0n8EBxRBONBF6Fh","tlshash":"0cb2df51731c5829e037b86be2cca1781214b602c63387dcb95f6feda5c63e2a9b154f","first_seen":"2026-02-12T21:05:34.327468Z","last_seen":"2026-02-14T09:07:38.757766Z","times_seen":4,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/orion.js","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:13.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /orion.js HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-1a5d5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2By99krJATwX7caTq%2FmmVgoQZdLwb49ZI04eypbNSZ8Hou6oexi%2BNH7bjSXIFf9wSylq9Kgm76z9Tauji5AuPZU%2FJO6XNS7lRLGXfFgE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdb69fb7926b7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":107989,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"opensclaw.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/jonahships_.jpg","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.456Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /jonahships_.jpg HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 21074\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-5252\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ubXiDIZmJ1weSXQ2kxjfW%2BGqLwK3I26uE1tZXJlnn14lx3GjBLwoQlkFUuKoykhVz%2F2M98XsGiFYZJeDsPXBdGFklX6SUzhogm4Sqas%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff599bb7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21074,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"af448e9be3f0fdea105d8ed41bfce705","sha1":"c4fa452b86785ee3e1ab10b5ce395d9690933cdc","sha256":"979f49866b67a42f32d9de3c95194c434ac865992ec2dae641534ce01be694b0","sha512":"0d95c9cf7c433f0076c3717ba0fa759c6c5b2115628ffb1fb2477481b672e21ea8ca06386ff60710d6dff5bbba8f99eecfb7bea5ac5cf93168ab28e754c49899","ssdeep":"384:s1ZMrgadIdKNSLs+qHptSimsypaY72qFyZCgl8Bouisy:Ck9KfLoHpwFsUfUCg6oRsy","tlshash":"2992d1ac13068715e47e53fa114f8b6f96b67011a18ccde2254a18c27bde6e22fb21d3","first_seen":"2026-01-28T14:03:52.352632Z","last_seen":"2026-02-14T09:07:38.759Z","times_seen":22,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/oneishaansharma.jpg","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /oneishaansharma.jpg HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 27944\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-6d28\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bm%2FsRculvbr27KyXnt3W%2BGCs21QSoVO8J0HQDMdR1jQXvo%2FpETuxMu2wG5m9cWeg1W2ekzqpsUguQmVfBwU%2B%2FyCjFKE8B8IpLvve3cE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff69a0b7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27944,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"848ff096bcf232915a55dee9959443f6","sha1":"003aa7300d8d1b0ca2c8f208e2b2230271112df4","sha256":"85da40c33f07eaa0b6db9b130f92175d5bd7f54b5f8010adbe5c9682af053915","sha512":"b94aea6e0c9d1230a13d6912a84734e77426889c2034d61d79897eaf548bd9b06afb116e279ae7bfa590087f3e4267ee137cbf0cdf049d5ef4abeb659059574a","ssdeep":"384:sBAS1tNyYBQy3k9KH3ZfzuGDfXzXljNu9KEU0rtqHeI1cNZrOndEvToLzn5A3cCu:0vMYBQEguJa6XzXRMtRIWTnvKnkc9","tlshash":"52c2d1b4cf7e462af74d82b501e18592c62d8d767c088a6bc8d12c6dbb1e2d1d25b184","first_seen":"2026-01-28T14:03:52.366699Z","last_seen":"2026-05-18T05:33:57.413516Z","times_seen":39,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/secureproxy?e=jscdn/getFile","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://opensclaw.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://opensclaw.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eo2upuit3j1bi7kc0oxl\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:15 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nUThgOc%2BK3LV4xICzlb7H%2BVYyRsnnToCxgBoKzeLo%2B66I%2FfIV7HNu3y7VmVr41nFa67fgWM4e4KU%2Bec6nV%2B6i3I5d5AowUPpE9Weqettx%2Byk1g%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff99a2b7a8-ARN\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3673053,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5b98793765a220348c7b53f0be26808b","sha1":"f489c44950f6c4b6b3453e864fa14c9e82e17247","sha256":"2557758495e3ef12a0f46bb73088e85b274059c8f920c2b1ecb0ad4e3f9b6c9a","sha512":"82b98f6caa860f75b0520056cf25783705923a85724878343d279102deda98600c2177c8a1af157777d5eddc87d3fd9fa4a9d36967b95657e06af09cc41cb6ed","ssdeep":"24576:x8pMOTgnKBUT+ubpi68jt+LaLQZDlZXh6lMX9T61nB3tFaTFei:x8pMOTgn1fpj8j0mUZDXAlU9TyB3tYpR","tlshash":"812523e4e0c190e43f64de3857e76aac907ab06fb9d666790908594029375e3c7ecce3","first_seen":"2026-02-14T07:52:00.577609Z","last_seen":"2026-02-14T09:07:38.76019Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1309,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":547,"receive":762,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/favicon.svg","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:15 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=6,i=?0\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"697c4148-4aa\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mFCDqMkjnaIwGeANHLRPm4lsOs%2Fto%2BBdWPoMYMDF3uRKrcKELbuRLFT7ubFKrl54tAzhGIlRNr6upEki9anuzsyeKs6xAMAxb9FUFiI%3D\"}]}\r\ncf-ray: 9cdb6a01e9e9b7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1194,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75661cbf8fd50009be0c46a9ca8b3180","sha1":"fce678ff3189a8ab7c74a896a7bf3d2f22f7f50a","sha256":"fa7e2ec07ebfa696bcc8c27d7e36425cbb7b1772f6f7f04ce390cf5f1c35cf0e","sha512":"e834ca2f4fe1a1a65fd83a4f3e3d1fe0948cfb2547d8eb66b6a56a755ae268964d0d6c1cdc1ff11d73f515dffd8d6effac02e300b6128ce91d341b89d9921103","ssdeep":"","tlshash":"6b21cb64c85d0817e466c365cf0b743a503fc4c25346a3983c6e0eb432b28a7ef1bae0","first_seen":"2026-01-28T14:03:52.326081Z","last_seen":"2026-07-30T06:03:20.200841Z","times_seen":181,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/AryehDubois.png","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /AryehDubois.png HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 99246\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-183ae\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lb%2Bs5BVqqXcB6Cp77mk3UO%2FlFR6brWrTabHRnOKREK31Sa1AA1mpl%2BGmTvLwquf1VL0kvOOQv6K1vp2yIbx5AE7TKAgZ6Mu5JiNO6RY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff599cb7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":99246,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"43faed82be99bdd9b2108a56619d218f","sha1":"daf1971e20bab257f0b2d73a7ddf4958f3e89042","sha256":"ce257f40c1bede8fdc7f339a76a9aeae40ef9060cfb0609ca0e029b12d35e39d","sha512":"aba2e79ab945efb0f6ad527861cb6021b5fd51e63230482a80d057063aeb9c9aba9638728282024b87c8d2cd9bc8f14692cad71d46a342bcfc4ef1342bcd40aa","ssdeep":"3072:+dibqm4edI1AMeqC7iQqNnuL/pjlzqo0IzsuLm:+difdI1ApzYu7RlzqofoAm","tlshash":"ffa302ec382ada82dfdfa0185a1c521941a7c83fd755bcd2cd4d1f2348a942cbab35b5","first_seen":"2026-02-11T17:04:54.640187Z","last_seen":"2026-02-14T09:07:38.761722Z","times_seen":7,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/Senator_NFTs.jpg","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /Senator_NFTs.jpg HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 24215\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-5e97\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5HIsR8cqa9gncjgGFkxJd5a5FsCSeM5S3hUJGOj0kRItXsfDuCYHwez0fQ4KlVAalDaaCuau3CBIXPnLAneLB1c4UvOiS3LKPTSjDjs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff699eb7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24215,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a53f7a14847e5e0bfeb3d72285aef827","sha1":"84174f93c4ba9967f902db4de3225e54f084f17b","sha256":"f700b263f16e19e09d7bf15aa2bdddc4da8e1ce068d7d28694eb9ed056cc516c","sha512":"efe013fe79cc9ba6530b6cfc0432f88d5e342673cad2a5b22a183cc2b96c369ab0b6331d8a7b602ec8a347f5aca950b00254613654d90979f3b2a889f643ae79","ssdeep":"384:sokejYR1EsXJ3VJ9J8JVxsOcEW+60RvlhJymVGHiZlaJEgOK1+szo3gUUOWgLkq+:FkejYjE6lRUFcEZlPnhZl3XlUOtLkqXu","tlshash":"acb2df763fe49103d61c7ebce1258d3e49aaad384ce6d63f8a02423467274d1697e09f","first_seen":"2026-01-28T14:03:52.32376Z","last_seen":"2026-02-14T09:07:38.762316Z","times_seen":22,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"opensclaw.com/mneves75.jpg","fqdn":"opensclaw.com","domain":"opensclaw.com","tld":"com"},"ip":{"addr":"104.21.11.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opensclaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 04:29:59 GMT","end":"Thu, 30 Apr 2026 05:28:30 GMT"},"fingerprint":{"sha1":"EF:E5:5E:73:4D:52:04:A3:4A:D3:52:EB:77:81:7D:6C:DE:62:29:B9","sha256":"F2:6B:AB:B1:79:F2:78:E2:20:F2:69:EE:E8:41:FB:BD:1C:7E:79:14:39:7C:C1:4E:FC:83:BA:57:8C:B4:02:6E"}}},"request":{"raw":"GET /mneves75.jpg HTTP/1.1\r\nHost: opensclaw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 49051\r\ncast-mode: default\r\nlast-modified: Fri, 30 Jan 2026 05:27:36 GMT\r\netag: \"697c4148-bf9b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GdkEMZu3v0jRrTtUw%2BVmk7smeVTphDLu4ihOX8Dgh0DXLFlrM7oRl2cy6nP6k8Uw25VdKgdrcOVcMtXF7ZbLi6aWD3XwJ%2FliGSE5oLY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdb69ff699fb7a8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49051,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"18f2c2e878ec39a0ac3b1e0f9bf82d30","sha1":"47f5d045c0e1bad785c603f6636881320e9fa47d","sha256":"718dc6aae23b73497944034f8de8d015b27b6d3120400cf9645ff4fbd95e178e","sha512":"44d6ec1e2ca118577a82447747720b2b4f8208a94c327736a41d7f2040e3fd6248b0a957b611caae14c7ed3acb07a46f182e90a3a657e4504c3b73d211aab9fc","ssdeep":"768:C19zypeo5XvCXfFKluBZJQThdQxNMkkzyezCVIzq463imI3EUcAxakgffUpU/2S4:C/7vclEjQThdQxNIzCV27yiYXkKfsWn+","tlshash":"d923f1836b1c6d64e2ac1b7d51d276b1fb050e8ac72603c551e184a0fbf9650bec4bbb","first_seen":"2026-01-28T14:03:52.364087Z","last_seen":"2026-05-18T05:33:57.404149Z","times_seen":39,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-14","alert":"Phishing Block","trigger":"opensclaw.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"opensclaw.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.molt.bot/apple-touch-icon.png","fqdn":"www.molt.bot","domain":"molt.bot","tld":"bot"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"molt.bot","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 06:49:51 GMT","end":"Mon, 27 Apr 2026 07:47:19 GMT"},"fingerprint":{"sha1":"40:95:4F:0D:B9:94:3E:87:9B:3D:A4:57:25:0D:82:B2:E7:80:49:A9","sha256":"99:49:5A:BB:CD:1E:12:70:4F:6D:E6:8C:B9:09:3E:D4:3E:C1:1E:0C:15:08:F7:1D:E6:2E:CF:FE:81:E7:FC:B9"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: www.molt.bot\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opensclaw.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\ncontent-length: 0\r\nlocation: https://openclaw.ai/apple-touch-icon.png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M6tF%2BJxLxLU78InbwIQ9Su9vboLZaIn97a5wp5FnxUB%2FI%2FYi8GfpVPqYHCbC9sAGxR9ZfrKtAjPMATy5niJFbP7jSjOYck57K8CQXw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9cdb6a020dbd0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5920,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T16:16:08.429382Z","times_seen":17656144,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":7,"receive":1,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"openclaw.ai/apple-touch-icon.png","fqdn":"openclaw.ai","domain":"openclaw.ai","tld":"ai"},"ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://opensclaw.com/","date":"2026-02-14T09:07:14.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"openclaw.ai","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 29 Jan 2026 14:01:38 GMT","end":"Wed, 29 Apr 2026 14:01:37 GMT"},"fingerprint":{"sha1":"BE:72:DF:CD:5F:B3:BF:4A:21:B1:08:53:B8:5F:F8:39:41:38:7A:AD","sha256":"A7:B6:70:46:2A:D2:9E:89:97:D9:46:C3:AA:8D:22:EA:96:14:B9:FE:3E:20:29:E4:1F:B5:83:D9:98:73:CA:E0"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: openclaw.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://opensclaw.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 56430\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"apple-touch-icon.png\"\r\ncontent-type: image/png\r\ndate: Sat, 14 Feb 2026 09:07:14 GMT\r\netag: \"5c40cae81626052fb1285bb4f48a7983\"\r\nlast-modified: Fri, 13 Feb 2026 17:26:44 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::kv464-1771060034946-c5f77503f041\r\ncontent-length: 5920\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5920,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5c40cae81626052fb1285bb4f48a7983","sha1":"b43df556a1d2ef02cb4dc913cdce97d31f661e54","sha256":"e8c7ce0a3a6c52bd904cc55e31a5b3a8b6392dcd70ba9e220ecf0ef1d6bd8c16","sha512":"0a599d0863af0db99a8d4f3600128b9a8668b0701e6df438389eff3a68d26863ff6a9e2a31b3847bb89bedd780818b6bd227a874f196df90c7c42f590a02a0e1","ssdeep":"96:44BYD6fiqNHEpitRig2uf10oQ+v9B+xnAh0l1KTEQvzZ/swPh9i6JGp7DH966AUl:w+fiqNkpqRiaQgBCcGKTHLOyu7Dd6rw","tlshash":"bec17d721e02b565941a2ab27459a66ad1426fd30c118f27adb2ea360ec2ab40c5f616","first_seen":"2026-01-28T14:03:52.328096Z","last_seen":"2026-07-30T06:03:20.201436Z","times_seen":122,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":19,"connect":1,"send":0,"wait":14,"receive":1,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}