{"report_id":"66e95843-415c-4250-9dee-207c5ce7092a","version":6,"status":"done","tags":[],"date":"2026-02-01T16:17:54Z","url":{"schema":"https","addr":"hyperliquid-detects.xyz/","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"172.67.159.9","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"title":"H​​​​y​​​per​​​​li​​​​​qui​​​​​d | Por​​tfol​​io Tr​​​ack​​​er","dom":{"size":8003,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (315)","md5":"0a1f1c8f0a75a759b6c7febe0573e744","sha1":"49e155f46071add9552f4e8c5a56abfc775cd03e","sha256":"4540d9098539c9e732a4957e6cf56373bcbb0cf136c5b47a0c6fa4dc64de26bd","sha512":"7d7305e08876f23e95b157a1f29df9e5520dacffc76b07f9ada3c4b9d701c9fff3064344ef36442aab285224fb267175de889cf5b618927c62f65f7c29ba1c0f","ssdeep":"96:rhfVU943tgLxS8k45USz+45ga/Jta89+RzydNA1t9+kex8KdRoZ8I7B1g/M:r3UIgxS8LUSZgaLb9wmII9o8IT","tlshash":"4ef192a422fa1e2b818386ed74e77509bd01d253c39c28e6bf6d44f20fc7d91980f19a","dom_hash":"domhash5833762d13b646d6718afae55768490d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"172.67.159.9","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T16:17:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"auth.privy.io","ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-10-07","domain_rank":406771,"first_seen":"2022-11-01T05:18:44Z","last_seen":"2026-01-25T22:06:44.836093Z","alert_count":0,"request_count":5,"received_data":7253,"sent_data":3619,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"flagcdn.com","ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-04-05","domain_rank":30920,"first_seen":"2020-04-05T08:17:33Z","last_seen":"2026-01-28T17:21:14.469762Z","alert_count":0,"request_count":8,"received_data":9264,"sent_data":3480,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn-icons-png.freepik.com","ip":{"addr":"23.36.77.115","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2010-08-04","domain_rank":547661,"first_seen":"2024-02-06T14:41:55Z","last_seen":"2026-01-29T12:29:50.577858Z","alert_count":0,"request_count":1,"received_data":18415,"sent_data":463,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.cdnfonts.com","ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-10-03","domain_rank":50661,"first_seen":"2020-06-10T09:02:17Z","last_seen":"2026-01-28T17:07:01.464052Z","alert_count":0,"request_count":3,"received_data":274318,"sent_data":1507,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"hyperliquid-detects.xyz","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-30","domain_rank":0,"first_seen":"2026-02-01T10:28:56.416622Z","last_seen":"2026-02-01T10:28:56.416622Z","alert_count":45,"request_count":45,"received_data":12166338,"sent_data":21154,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-25T22:17:37.642954Z","alert_count":0,"request_count":2,"received_data":9230,"sent_data":980,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"db.onlinewebfonts.com","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-09-28","domain_rank":91976,"first_seen":"2015-10-20T18:27:41Z","last_seen":"2026-01-30T07:41:55.09418Z","alert_count":0,"request_count":2,"received_data":29727,"sent_data":1026,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-25T22:14:35.458366Z","alert_count":0,"request_count":4,"received_data":125619,"sent_data":2218,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.hyperliquid.xyz","ip":{"addr":"52.84.50.53","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2022-10-15","domain_rank":745076,"first_seen":"2023-08-21T22:32:32Z","last_seen":"2026-02-01T10:28:56.92626Z","alert_count":0,"request_count":2,"received_data":1083,"sent_data":1067,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1159f4250e7555f723427cb297b6a447","sha1":"4733026c8125e59870d174752e8c7f79ea3ad09f","sha256":"46f246748bf2f61420da19c837ca47561075447a5cedd1d23c36f3f7c3c9392d","sha512":"00fd8d44171ee691f5b8f42b34996b11cb0d3b27dc3c9e5074b0e7dc13bf846752bb22e9b305f7d382344068440264193f1d69e766f5776ec57dae41f05ac4d1","ssdeep":"","tlshash":"97c0804c9957420380d53c579995300711728066487d4503114d9f0896d7667416fd5e","size":150,"data":"","first_seen":"2026-01-14T23:35:49.336139Z","last_seen":"2026-03-18T14:18:01.002253Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/widget2.html","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa27277536d6b470e1e71e9281a5e1b2","sha1":"9caf90315eb7a8a6de5659aa439c04bbfe01594a","sha256":"c7d1549bac63fa64566bf762cbf8f61b347fe1e2b1e9600f5e9231aa43b01c55","sha512":"b78a6d7c3dad677ef3b072e95f62b7d33244f74722463cd784f79b41db807a51cd92b39ca7f7d2a49e737e91773c5b83f8d0e6dcca2f9394a064bdf44f2eae00","ssdeep":"","tlshash":"4231194bb2962029b416586472433bf93cbd141399359878f20da99ddfc09f3c5b6b6c","size":1860,"data":"","first_seen":"2025-11-26T00:18:39.209744Z","last_seen":"2026-03-18T14:00:27.463054Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/effects.js","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8907e7ac4435cb0d6ffcd50ed59f9f9","sha1":"16740f889a30683124d1735fbcf44a3ed17416f3","sha256":"56816d420f34ca51067379a149a0b758307831aaaedc3679c5cfe39d517428b1","sha512":"fb3fb6e593de9e545dc68f01648f80469095c7d4f709a8030cbbbeeba9b0e8281beca0abf57f79a99216dcf554d38278efeb7ead7a2732b2309c6e315ada33fb","ssdeep":"768:SI4W7cxh1N3KVYNsWfgYVmkBxqSvErYncPcCIcL6meiXcUucncKcRcyc5cGcjcj+:k1dKVwVV5BESvk6meQfnYxswShho","tlshash":"6b9395c6554bc4d58e2110dde473e818e4682a63ceacf0a3ba6cddc2b45ef66c44763b","size":91734,"data":"","first_seen":"2026-02-01T10:29:02.005223Z","last_seen":"2026-02-01T18:25:13.782961Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/widget2.html","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"65a97aeb1547ceae49fe455f4661e113","sha1":"d36baaa8af9039b4bdfe6738c2806d0cda05f38c","sha256":"71325c52cc5c33da6c0eab559d39f2c3d9d06aff0bfde0299e98a0cb17d49ec8","sha512":"2891a15842058054995c15d1ad31cfad24eb34ceae0e55514983c7d9c4b667d6f22f2cba86626aefd2c870658900d3e98bd42482d169d620b4ed6b884fab6a51","ssdeep":"192:EpNGhezh7VjqumnzUosdL78vn2qbClU/mJjhJz3PytT:LYFVjXMzUNdYmlrXzsT","tlshash":"4412235423fb3136a06220a9e2cb25501138204bb832c4ddbb5dda4e5fc6651d8fbfec","size":9397,"data":"","first_seen":"2025-11-26T00:18:39.221873Z","last_seen":"2026-03-18T14:00:27.46584Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"auth.privy.io/api/v1/apps/clmv1d6am07asib0fs4ss7w2x","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"GET /api/v1/apps/clmv1d6am07asib0fs4ss7w2x HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detects.xyz/\r\nprivy-app-id: clmv1d6am07asib0fs4ss7w2x\r\nprivy-ca-id: 9b5333bb-e095-4eb5-8c74-7ddcb496bb0b\r\nprivy-client: react-auth:1.79.1\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9c72c25a3e9023eb-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://hyperliquid-detects.xyz\r\ncache-control: public, max-age=300\r\ncontent-encoding: br\r\netag: \"u4xz7fm3gr1gi\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-vercel-id: fra1::iad1::hz6x4-1769806872432-fc4a584f6eff\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, accept-encoding\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/apps/[app_id]\r\nx-vercel-cache: MISS\r\nexpires: Sun, 01 Feb 2026 16:22:28 GMT\r\ncf-cache-status: REVALIDATED\r\nset-cookie: __cf_bm=SMjqonGLzjK7U4ZmU.SbGNZXsNdJ_CgY6kqOCMpVRHk-1769962648-1.0.1.1-kHeX1ahgtcTBho1xkmY839vJTobynEqE2JnGH17ZKxSODRGQIiNaPn7Z4qlfiYomC5A.vwOXTDonJE1BKu3edfVOrZ3k63ZpkMgqbR5C5GQ; path=/; expires=Sun, 01-Feb-26 16:47:28 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\n_cfuvid=t.yOGqXTgwJ.xgelIe4GzqKwVjWJTEGiqJPysGxcsqw-1769962648934-0.0.1.1-604800000; path=/; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":1890,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c22e0eba95246acc0cb313a09fe58cc3","sha1":"334ce0a6e4f3e13024847b9d42c158d32741c044","sha256":"745244afa98c6641d679febd66c33517b26f35cfa0ed7e313ed8d850807cd9b5","sha512":"5bb19a9db24d15c97398fc1486e9756d3496ce453459fabcc9b6570ec61801ce53f6f17bdd3222e1d9bbef6dd38422ab28afcba991f40ca0b339665ed9a7e89a","ssdeep":"","tlshash":"9941ec3d461c06bec884c641cd257ac28bade02b30657d78d2e4962cf5d3ed0233596f","first_seen":"2025-11-28T00:57:32.413937Z","last_seen":"2026-05-05T00:47:20.519482Z","times_seen":202,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":22,"connect":1,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/zero.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/zero.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"483-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1s2PZrW0hesGWAYeJ2S5RGOBvYcr34ohe%2FTaYvtT739Ecpi1TBpAx6Xb3RPs5W1yPugjnh9T7V9Rq%2BCUpxHOTWdyLS%2Bg9Vy7H59FXDMiBl0AjnnfTA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8bf56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1155,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1c311da40a7129b5b16febeaeaf942b7","sha1":"01a714ba38c2efc972fe688a71eb95370c6991c8","sha256":"32c93176a69c5843267495d593e9483e113e7c3ddfab6bdc6fcfc3c32b9baf55","sha512":"b3dd48a921c8393f11d557bbb94914481928540b7146639a16bf10e579f271db203f4ac13ff6879a1118dc778aff2d2e00b8b2841bb392030aeea125db773dfa","ssdeep":"","tlshash":"7721e14c574c2732e8e687e4df49e2180ea834bac3415fe8c61129249e7f888d857911","first_seen":"2024-12-24T09:00:30.374728Z","last_seen":"2026-07-21T14:05:53.715602Z","times_seen":96,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/arrows.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/arrows.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"97c-19c0f2d38f8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=23FU%2BEJWTdQD8VU0%2FEZIIf282bKJMUsEut%2BMQUpJGhYWtD6mSnDZWeLr3I5XDc5FzfEvR1ycMJr1tZke8KGvirKGbXsyr%2BHxQYt%2B5L5K69QpSYRntw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8c456c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2428,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e0fe79e7e45e6ab72a200058537aab61","sha1":"6dd6cc2d67a439869cdb2c3138a918eab97a5dc5","sha256":"a0105ec6578596bd1360cdbef110a620ec095e9463f05ece85ccb8a6c0722586","sha512":"56b34dde1ef8d53315491d35d11bc31d57a5a10a02d37bd5ace85dba47d819b1241682411c972ecd59de199299b1300e583dccc2d707894f242f5ffb1008648b","ssdeep":"","tlshash":"f84150cc33be35f8e846e0b5c711a41c669f24fe25018eeac346081d9a99c946c1ace7","first_seen":"2024-12-24T09:00:30.365488Z","last_seen":"2026-07-21T14:05:53.743887Z","times_seen":96,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Outfit:wght@400;500;600\u0026family=Onest:wght@500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css2?family=Outfit:wght@400;500;600\u0026family=Onest:wght@500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 01 Feb 2026 16:17:28 GMT\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4024,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"6af9c8f9b578005e11a7b59887d63297","sha1":"d6a908c832717c57dfb6f2fa2f4b0ee819a98f86","sha256":"d30249df41112105d33ce9823af3a4e5db3246df992267903aad8ec54c46d10f","sha512":"1a1eae0b259ea17dc94f333cad7494bee0facc38418864f2501e6bbb5a38edec2a505a89daa476d596646deadf66bf689275477012b0ee7c6939c0143570d2a8","ssdeep":"","tlshash":"e881caa1042ba504df871cc223ce7e27ee1f62516840d975affe1898acbbd6a435670d","first_seen":"2025-11-26T00:18:39.199822Z","last_seen":"2026-03-18T14:18:00.99829Z","times_seen":56,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/3.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/3.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 12329\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"3029-19c0f2d38f4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20943\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g2ShSK2UWDndZ%2FCS2IpgGzHLzQzL8SWfncdqMOktmAzbmKaSHcejJetMd%2BCcUA5OMqQXAK13oE%2BqVNudajuilBRHLr7k7cNf8QNNaYjtWRGh%2BhCEIA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25e2bf556c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":12329,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"ed1b652c3d97e133a3a52caa573d221f","sha1":"995b39aeb3336a7503445318628a270fcc13aa9c","sha256":"5ba214e8b1730813b64caf4e03100d0cf7023ef5685c3b533a60857b98b8fff4","sha512":"23aca4f38ccab82e3ebeb649021377310877f2bf7a02102c0fcf08d396d720babba4b19269d94b19990816b0c2cd9d19948717e0a59f4efb228665c08a104661","ssdeep":"192:n7kFvPG2wXmfdwAeU9QcnPVriuMxtSjtt3ZDEV+yex8MXALE7fgppPPBmKWw16f:nKG2w8dwAeUlPVHKSjfrx8egbNM","tlshash":"8d42c002d7425ee089f2d3790d00f8b66ecd167a7f371525198376f1aeef4829422d13","first_seen":"2025-11-26T00:18:39.120505Z","last_seen":"2026-03-18T14:18:00.976875Z","times_seen":55,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/logo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.663Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/logo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1cbc-19c0f2d3924\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6BdE1vKZ2wUwg21M9Gmxr3GpvHurYSPbNLZTQamMmHoQNAaFfSc2pjm9cykTcay5h0%2FdU2WFgylJS65S1niADl7XcU%2F8y6MVbxmQEeG0dlUr43%2BfBg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a182856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":7356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fda28f684fde04ab162b1c77437fba27","sha1":"82b0c3a51dad8809043f36a8cbc25c959846a9c3","sha256":"9284325a68c5c57693cc097f46c4dfcebda802a013774fe46a4e785f08ac7b3c","sha512":"1ec68fd2d4626399a1d2ad22ffbe36147bbb7e9f550c25eb549a40ca4529d0f5462c85149a7195e7a749cf197335b1f746341fafcd145b745c6dd2e95ffbe893","ssdeep":"192:L81ZDrGWzUggauQt7q80VHIQR8nDhFmPsmp:gZDrGWzrgauOq89ntFC","tlshash":"d6e196de7b9892d0fc97d7f0dd1a00693a1f68fa0f81c570c3998e48b5972adc489c88","first_seen":"2024-12-14T09:51:47.786813Z","last_seen":"2026-07-21T14:05:53.687738Z","times_seen":175,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/analytics_events","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"POST /api/v1/analytics_events HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detects.xyz/\r\ncontent-type: application/json\r\nprivy-app-id: clmv1d6am07asib0fs4ss7w2x\r\nprivy-ca-id: 9b5333bb-e095-4eb5-8c74-7ddcb496bb0b\r\nprivy-client: react-auth:1.79.1\r\nContent-Length: 286\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=SMjqonGLzjK7U4ZmU.SbGNZXsNdJ_CgY6kqOCMpVRHk-1769962648-1.0.1.1-kHeX1ahgtcTBho1xkmY839vJTobynEqE2JnGH17ZKxSODRGQIiNaPn7Z4qlfiYomC5A.vwOXTDonJE1BKu3edfVOrZ3k63ZpkMgqbR5C5GQ; _cfuvid=t.yOGqXTgwJ.xgelIe4GzqKwVjWJTEGiqJPysGxcsqw-1769962648934-0.0.1.1-604800000\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":286,"data":"{\"event_name\":\"sdk_initialize\",\"client_id\":\"9b5333bb-e095-4eb5-8c74-7ddcb496bb0b\",\"payload\":{\"loginMethods\":[\"email\"],\"embeddedWallets\":{\"createOnLogin\":\"all-users\",\"noPromptOnSignature\":true},\"supportedChains\":[42161],\"defaultChain\":42161,\"clientTimestamp\":\"2026-02-01T16:17:29.392Z\"}}"}},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: gzip\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://hyperliquid-detects.xyz\r\ncache-control: public, max-age=0, must-revalidate\r\netag: W/\"105rjpkrbkr1i\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/analytics_events\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::9btmp-1769962649621-0adcd65fc080\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9c72c25ffde523eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef61636d36a48f545e4a2ce75b5febcf","sha1":"efeee36fd1d8d99eb9a968ca0cb9d79e3b6d0e51","sha256":"ed76277a4374e438733db8fa1addecea3e48d3406f4ff32c1ea0066268ab6ba6","sha512":"e7fb19b5c564001e80690769e8cf9a33302daf54f2e51dde0c0da947400b0e648cc594157ae5b79dcb4c55ecb998d3fcb7e5f05372ce7c093992da5d1a02aa04","ssdeep":"","tlshash":"4a90022d2356842a6a9707d41e4a4c0264e5316069629b901c1101bc03c57654e0200c","first_seen":"2025-05-24T18:07:58.401304Z","last_seen":"2026-07-23T23:18:26.024771Z","times_seen":1266,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/titleLogo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/titleLogo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"19e7-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K5tqDKNoVazKO%2BCnCAknAMfSSs6mBpMC9yBZCBuseAJfblB3KJrxmd5KqVhLKA8HpMhN2w9rxZYz9pDQAeSD0iC%2BOI7esWLjKO0Wl5ivoXOWCICn6Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a888856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":6631,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3487d0cad26270542d237bd0e319fe05","sha1":"fb698b6d33b086fbc74c39d0e63eb46acf5353d4","sha256":"8c3aa09dbd5ac3284e3b42321d01b6b98a521f2523af9ad362ebd2fcc506ba21","sha512":"3cfaf16e3e3212afa1283e892799109e3605b4399b9e81db85a4b40e9a5279043a78f54a1fa05ad28da2b792b9a8b9c26363e8f5c2b0040b0f2b619b06c7dda3","ssdeep":"96:/8FE149AZhLR6qAQh+NRuNQqfzKDuUURcFRduBSwhWbXb9X+/0+fp3Jo:oqrM5wmaUURcrdukwAbXV20OpZo","tlshash":"29d1c4e927215afcf085f3fa9e07507835a3f8fa76959215c7954e4a780288c8944ecb","first_seen":"2025-05-13T10:27:03.878152Z","last_seen":"2026-07-21T14:05:53.721565Z","times_seen":95,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/c/d6ae884b0a2f1a5346717fc160db2d28?family=Roobert","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 22:43:00 GMT","end":"Sat, 21 Mar 2026 23:39:25 GMT"},"fingerprint":{"sha1":"40:88:D9:AA:10:BE:9D:1B:7E:AC:DB:D6:14:FC:6F:E6:79:79:51:19","sha256":"AF:49:70:AA:7C:0A:4C:C7:BF:A6:11:E3:2A:88:F8:B4:87:46:2B:23:29:AF:4B:E4:1B:F2:81:6B:C4:45:AB:CA"}}},"request":{"raw":"GET /c/d6ae884b0a2f1a5346717fc160db2d28?family=Roobert HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: public,max-age=86400,must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3NcSK3yymH77xcPCWWklexcAlTOVezT47phfp32afLr%2Fn0Yx1%2F6p8seuHsFtKc513ZFq8UkZ9oQ0lWwhCVVqcplYze6iHSnyGy1ICeQ4cUlLT0U%3D\"}]}\r\ncf-ray: 9c72c25c6a5c56c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1113,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"b529b194775d85ae8f26cd417d4704d3","sha1":"619b4b5e216843b19f41b360b98cf706139786a4","sha256":"8c0471be970fec7ba6ee94be1ca95704901dd00b1ebc8a700dd6e661bad2e2b9","sha512":"e82215bdbaa2b5a8ec2aa4ad64d03b2970519092d7aeb1cd669fc5b54dfeabf04de062e14c0643c5c71ca955334379cbb04bd2b40e606512b9bf84c6daf2ad54","ssdeep":"","tlshash":"da213b8ec601983497b4060c3bf3e954e883011f9c34aa86b93d9d55efb4a2da151b3c","first_seen":"2025-11-26T00:18:39.192284Z","last_seen":"2026-03-18T14:18:00.967961Z","times_seen":56,"resource_available":false,"data":null}},"time_used":389,"timings":{"blocked":93,"dns":44,"connect":1,"send":0,"wait":207,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/lu.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /lu.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a9Ggy0rV2%2BUi2dTOkI%2FVq20cjfCQH9BN9vM30wKp7tFXQfQNQY%2Btp38WAiUv0c9sXok%2B1BMvJFaFz%2Btz7asphSwpvUOIcS3kxYWh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 305478\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-ca\"\r\ncontent-encoding: br\r\ncf-ray: 9c72c25c5de11a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":202,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7f0dfa41b55ecd5dd0c742bd992e6139","sha1":"c5640a362e5cd5262ce24e9daba20853fbe21358","sha256":"23c57bfe462e31f5655923c458bc77769dc62679e69750f6bf96371f62287f70","sha512":"9abaa14737a61ec4ec90139cac406c68a2a885e45836fa8924cbb1e2ca51839b6d72fb696b9be832d63366f3cbe367c2bce045223cba33759ae08e06e6c15b67","ssdeep":"","tlshash":"32d012ec506c3104d519437e9fbc7cc2608230dbd15606ccf46014e5e70db9bbc50a19","first_seen":"2023-11-19T13:30:45Z","last_seen":"2026-07-13T01:25:20.783547Z","times_seen":244,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ch.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ch.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ktTaZsVqSbH5IHx%2BIA0ew%2FFK96gM%2FcDa59fC9WL4wNCAzPpdRnKTdGpdhQDFch4A47kyt%2B6D7RGnC5XodPhnUmt6r3n2Rxt6t0JH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 728694\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-b7\"\r\ncontent-encoding: br\r\ncf-ray: 9c72c25c5de91a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":183,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2acab683421eae9cbe5ac6555c999db7","sha1":"a573d5b5e766510d10568a13a7be82bb3db20cdb","sha256":"a5ec3bbf0f3e686ea05ae17f51e8f3a287ad332217b679bbd393842b7d427859","sha512":"a8af45d203b5123fe964882e386b5478cdfba39c541f59b4e3af1f26c1e7e56703fe7d769b6b24bf80fbc2df6b57ca28fd1a6330f98943712c02ed67fef3dc69","ssdeep":"","tlshash":"95c012b4945e9547841d4b701f5cb52644bb51d5714809eda5901a0022676e7f861bd8","first_seen":"2024-12-30T23:46:01.888722Z","last_seen":"2026-07-24T01:56:22.792138Z","times_seen":300,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":57,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn-icons-png.freepik.com/512/9307/9307950.png","fqdn":"cdn-icons-png.freepik.com","domain":"freepik.com","tld":"com"},"ip":{"addr":"23.36.77.115","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.306Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.freepik.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 02:22:50 GMT","end":"Thu, 23 Apr 2026 02:22:49 GMT"},"fingerprint":{"sha1":"C0:B4:F8:4D:39:27:04:41:5C:4B:20:FE:12:17:4C:7A:A9:B9:0C:0F","sha256":"D7:24:91:56:CA:B1:9F:78:CC:A1:96:07:EA:A0:CB:AA:73:D5:06:11:4C:6B:0C:75:21:48:D3:CD:A2:38:40:B6"}}},"request":{"raw":"GET /512/9307/9307950.png HTTP/1.1\r\nHost: cdn-icons-png.freepik.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 17878\r\netag: \"159520e52bc2f48f276ebb680e3195cc\"\r\nlast-modified: Tue, 15 Apr 2025 23:34:27 GMT\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\nalt-svc: h3=\":443\"; ma=93600,h3-29=\":443\"; ma=93600\r\nserver-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc=\"1769962649356_388255087_280959943_26_1404_0_20_22\";dur=1\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\npragma: public\r\ncache-control: public, max-age=31536000\r\nx-default-rule: YES\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":17878,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"159520e52bc2f48f276ebb680e3195cc","sha1":"30c051c13eb32cf44530f2c70426beba4a95a129","sha256":"d65b21f9cfaf0414936f4472547830608c5635e1a01434cccc2f7dd68d7ebfdc","sha512":"e508d05a69f4a231ca1fc372e087d044328e139c4cb8f1cdd59562b58053f4ee0e5cb5cfa4901f354b59644e150fe79b1019b3d9c16648bbc70b3a51a6d623cc","ssdeep":"384:hTOwmab+6HcvbDX5eQOLdh+gYMZyaZkKMmpqlxH9cv7rQ6k1ucqKGZgh+N4tw:Tb+swb1RO5h+gYMZyaZkNmmaHQ6k1BJW","tlshash":"e382c01d63eb09dacdecf170028d84fcb9b8417017e64555eaf469891e30e2e7b5e887","first_seen":"2025-11-26T00:18:39.099009Z","last_seen":"2026-03-18T14:18:00.995204Z","times_seen":56,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":70,"dns":51,"connect":1,"send":0,"wait":7,"receive":2,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/effects.js","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /effects.js HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"16656-19c0f2d38d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 20944\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=02EiHqzoYDqMCjb0kRuz7HOiilriTzyHLekkIZ8PTvQObrLx9GYB0jjRa%2Fn73D7a%2FoV6M100GGtYi14EkYwlVrw2rMFPET%2BbtrSWP7TPv%2FS5uCplLw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c257ce4f56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":91734,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a8907e7ac4435cb0d6ffcd50ed59f9f9","sha1":"16740f889a30683124d1735fbcf44a3ed17416f3","sha256":"56816d420f34ca51067379a149a0b758307831aaaedc3679c5cfe39d517428b1","sha512":"fb3fb6e593de9e545dc68f01648f80469095c7d4f709a8030cbbbeeba9b0e8281beca0abf57f79a99216dcf554d38278efeb7ead7a2732b2309c6e315ada33fb","ssdeep":"768:SI4W7cxh1N3KVYNsWfgYVmkBxqSvErYncPcCIcL6meiXcUucncKcRcyc5cGcjcj+:k1dKVwVV5BESvk6meQfnYxswShho","tlshash":"6b9395c6554bc4d58e2110dde473e818e4682a63ceacf0a3ba6cddc2b45ef66c44763b","first_seen":"2026-02-01T10:29:02.005223Z","last_seen":"2026-02-01T18:25:13.782961Z","times_seen":4,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/s/59278/SFPRODISPLAYBOLD.woff","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /s/59278/SFPRODISPLAYBOLD.woff HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.cdnfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: font/woff\r\ncontent-length: 134076\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 05 Feb 2022 02:00:54 GMT\r\netag: \"20bbc-5d73bbcd13297\"\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 20944\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CXn2VSgMm7FZBHBThwcJVJ5oIKHS%2Fio1aLedrnan3O18g%2FECJ7b7Xn4y0HGuWWPq8S%2BMKzcbR2DEDAReWuMULV%2F1V%2Bp2GhJru2Xfna%2FDWJf8dA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c72c25a38e0dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134076,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 134076, version 0.0","md5":"5a6d43d393aff666df0d0b67cbb32c68","sha1":"2bdae4ec52f592b8a9b0786dd53d7efb4f2f5fcb","sha256":"119ccd3741e1185ef0ae63c54b4bcdc65ee0ce4336f1558928707d85b91fbe11","sha512":"2d517324f864d417f62fc74a7aafd0f54c322a23aa7b87d21bb24881a216c5d66c2b76f279800768e051e96c2a6a5b0cb2cc5960f5bb953077b6454c1bc9c763","ssdeep":"3072:PJJ0ljobe01p2YK8TXKSOdXSyEaW1vp3mPxIQuYJ5ORrb6KJ57PCLhqq:Ukee2YKhS3XB2xIQuDxb6C7Pxq","tlshash":"18d3139db96edbdb2da3ed8c10a5efb205dca6c741d178039a81dc67080f796537640c","first_seen":"2023-06-17T15:43:01Z","last_seen":"2026-07-15T11:01:05.639951Z","times_seen":244,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":21,"dns":1,"connect":0,"send":0,"wait":6,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/verticals.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/verticals.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"1bc-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TWZOPvcCZ0C88aVTCdN0rIgCC3Jk2qigsFoSRL6UEAmMpzdpLFBwsvwofjWXlH%2B0e4O8F9pyOhAkhUbCB%2Fu1UVc0Fk9aPr01Jjv4twz%2FMErA71OQUQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25b292656c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":444,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"40dc2001fe15e9892a0bd64a23f05b13","sha1":"81e5cd3fd27627c1ec77b0be1ab9c4ddbdeab82a","sha256":"8c8b0e080085c730b650a0cba679c7632b9770785db02c408f887ba26ed80b95","sha512":"ada37c0f7e168bbb4806a04ab577bc467badc82ad5fd55034394974906d4f2fcc9bf5d6f14122a7dfebc84bac949e3a90980e23022d51e145f17ac28829566ae","ssdeep":"","tlshash":"4df0a0ad272819f4e3d24321af3961ae4d6760e8068552888d0236363691b6e2c7ffd9","first_seen":"2025-05-13T10:27:03.876646Z","last_seen":"2026-07-21T14:05:53.753269Z","times_seen":85,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ca.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ca.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-292\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 2040242\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hK%2Fc1jwDpcDrdWNyLHpyNSJkmJkHaht34nqZ7kU6gTlN%2F2ggzdsj3N%2FpF7LPopcS4lQ1NAL%2FyRch7UsP8Wqb66a33nQTVM%2FPkvTp\"}]}\r\ncf-ray: 9c72c25c6e081a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":658,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"204a7f283c881dceea9b4f4ac6c97a99","sha1":"e80ce7344e5cecc84a97ef13fc06dd499de7163d","sha256":"3cd6c2b9fe12bc0617ef4374b570ad87920bae757a95b104384fc301352c6942","sha512":"02093e6e91e510996813a028c0a3dbef38d1c5f3cbf86412b45f0a319fe4726fe25d22f92c758133a9da522912bfd9f5f679228ebd16fc63adf11538a60ed46c","ssdeep":"","tlshash":"5a01dd308d2cb88c3a432bad103815b203bf9063b30942e8e12f31f933db123e88b500","first_seen":"2023-09-16T18:44:36Z","last_seen":"2026-07-24T01:56:22.669996Z","times_seen":302,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":73,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 32108\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 26 Jan 2026 21:12:48 GMT\r\nexpires: Tue, 26 Jan 2027 21:12:48 GMT\r\ncache-control: public, max-age=31536000\r\nage: 500681\r\nlast-modified: Thu, 04 Sep 2025 17:18:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32108,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32108, version 1.0","md5":"e414fe5664f376c8f145acd792939183","sha1":"5b69d46adc3a06af762193adb2dddbc359b2e786","sha256":"fa31c7981483e52cbb8b8bc1eb0dc6326f160b8699cc0899349f977f0517a9df","sha512":"51c251910e5cce616b3c336bcb63853f83c306e16e9b79e0a18f924a738ba06b3e2cb8132ff9bc6e720527234eb80e90be2625b860e1728b66d4fe86ac9bafe5","ssdeep":"768:gUX6jLkDeuAkZHs27nAflEFIapAgCauwIFPo3zjERcgmcjz:3X6tkpNAf6FIapAgCaMFozInjz","tlshash":"6ee2e14f8beb009ef3828a7812c46b3195b305d569cbfa901eef85d76b5c247c1474a8","first_seen":"2025-09-05T02:25:45.343777Z","last_seen":"2026-07-24T15:42:17.218333Z","times_seen":27244,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/apps/clmv1d6am07asib0fs4ss7w2x/embedded-wallets?caid=9b5333bb-e095-4eb5-8c74-7ddcb496bb0b","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"GET /apps/clmv1d6am07asib0fs4ss7w2x/embedded-wallets?caid=9b5333bb-e095-4eb5-8c74-7ddcb496bb0b HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nCookie: __cf_bm=SMjqonGLzjK7U4ZmU.SbGNZXsNdJ_CgY6kqOCMpVRHk-1769962648-1.0.1.1-kHeX1ahgtcTBho1xkmY839vJTobynEqE2JnGH17ZKxSODRGQIiNaPn7Z4qlfiYomC5A.vwOXTDonJE1BKu3edfVOrZ3k63ZpkMgqbR5C5GQ; _cfuvid=t.yOGqXTgwJ.xgelIe4GzqKwVjWJTEGiqJPysGxcsqw-1769962648934-0.0.1.1-604800000\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; frame-ancestors 'self' https://*.hyperliquid.xyz https://auth.privy.io; child-src 'none'; frame-src 'none'; connect-src 'self' https://auth.privy.io *.infura.io *.blastapi.io *.quiknode.pro *.rpc.privy.systems www.googleapis.com https://api.apple-cloudkit.com/database/1/; script-src 'self' 'unsafe-inline' https://auth.privy.io 'nonce-OWUxNjg2NmYtZTQxMC00YWViLWIzNzktYjE1OTNlZTk0ZDI2'; style-src 'self' 'nonce-OWUxNjg2NmYtZTQxMC00YWViLWIzNzktYjE1OTNlZTk0ZDI2'; font-src 'self'; img-src 'self'; manifest-src 'self'; report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3ed0be16dcee00054d67fd118ef8a00d\u0026dd-evp-origin=content-security-policy\u0026ddsource=csp-report\u0026ddtags=env%3Aprod%2Cversion%3A0.0.3;\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=63072000\r\nx-content-type-options: nosniff\r\nx-matched-path: /apps/[app_id]/embedded-wallets\r\nx-robots-tag: noindex, nofollow\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::2jxkt-1769962649447-d5f115a7081e\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nserver: cloudflare\r\ncf-ray: 9c72c25eeae523eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/eyes.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/eyes.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"6a9-19c0f2d390c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7GEK6C45eOJsRlNilYRg2A%2B9RGeXrrut0YADyb3XZ7FwBmJ7kAPQhCy4uXGtWlKSfZ1uqtba1cELc9Uhf%2Btfq2I12z5pN%2BW3ZuIC23KRttqPQC7u0g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8c356c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23531ca79c9f5dc2be0b39b28aa7524c","sha1":"fbc92b54469e04184464faa2d50c5872da5277dc","sha256":"6d76143b39d23013125c7baf0108a0e80eea7f497e91682f8df1bebd702e7482","sha512":"1b8857d1cb472b308344d22485c476c00fe73bb25fce81a8fd49f713bb9b0259b864b9acb8a9a4b75894a8b4b8638e2dd763e63f21b6382984d99b550fafcdc8","ssdeep":"","tlshash":"e931f28d2b4c51f5e16082d6db098228b84770fe5140db7dc35a3d35999bbdd6c2b885","first_seen":"2025-05-13T10:27:03.894079Z","last_seen":"2026-07-21T14:05:53.701352Z","times_seen":95,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/titleLogo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/titleLogo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"19e7-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VOaOgWNpp940FgH2rs4ZAj6zyQyiOgChjeV%2BooB%2Fozba5S45MBiLo2ojKr%2F5gvQyVu4W9TJE%2FRMFEt42Bxa%2B1x5PM1qnuZG1Hk3VEw9R9rld5YmSrQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8c656c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6631,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3487d0cad26270542d237bd0e319fe05","sha1":"fb698b6d33b086fbc74c39d0e63eb46acf5353d4","sha256":"8c3aa09dbd5ac3284e3b42321d01b6b98a521f2523af9ad362ebd2fcc506ba21","sha512":"3cfaf16e3e3212afa1283e892799109e3605b4399b9e81db85a4b40e9a5279043a78f54a1fa05ad28da2b792b9a8b9c26363e8f5c2b0040b0f2b619b06c7dda3","ssdeep":"96:/8FE149AZhLR6qAQh+NRuNQqfzKDuUURcFRduBSwhWbXb9X+/0+fp3Jo:oqrM5wmaUURcrdukwAbXV20OpZo","tlshash":"29d1c4e927215afcf085f3fa9e07507835a3f8fa76959215c7954e4a780288c8944ecb","first_seen":"2025-05-13T10:27:03.878152Z","last_seen":"2026-07-21T14:05:53.721565Z","times_seen":95,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/largeLogo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/largeLogo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1a12-19c0f2d3920\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=INDVL5%2Bs4NZsbzw6UNQhdYRUmqwjXh%2Fr64H7LKDUldxrkCGYJbni74V34B4C22%2BB87aqG168Jyc0ChAffbGdHZZQYcrw0PrDeKh4%2F1zJZQDMKWegPA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ad8d956c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6674,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"44fc299106753ea66e88cc2f29e9820f","sha1":"504adcacf65299c9551da2ace79dc3913c9873c3","sha256":"2660b8d485828e9fa4d801511d9488233525964235e8615c810082f5105b2995","sha512":"13e1ef1d03492aa088df3f2d5ff84a4ceb1c800eba8517d7359759470030cdc5a999e13e02fa5dcbda8b4d62fdfa92709c2c827fca23e8f824b8146d3c274b20","ssdeep":"192:teREWY5JIaEv5hDlz0ytK9yS5Bcx0nfYvD8qBgU:tXgJVRttSD5w0gvD8LU","tlshash":"73d163fd3b604ad1edc943c79f1601e86e0ba5ba89c5c645c508bf1928978ac984dec3","first_seen":"2024-12-24T09:00:30.372018Z","last_seen":"2026-07-21T14:05:53.752185Z","times_seen":95,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/blob-dark.gif","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/blob-dark.gif HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/gif\r\ncontent-length: 533111\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"82277-19c0f2d3904\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8L%2F1MGur5QUc22yW9TqFmbR9kCmBl2swa2o%2BopOcIC9I1qbRk20Gm4M%2FdyQcxjv%2FtGwmB9povHMR0oQUfZAaOcmJUphrl%2FWP3zuijHphgNKKrq%2BTgQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25ad8dc56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":533111,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1200 x 1200","md5":"4b89c04f65112f96c8f3ec9f0ff1b1e6","sha1":"c312edcabbac8befe2c76f21bc79c76624521210","sha256":"e716ea780e082380a41d3413af124c8511ba8d04af20237a09604359915d7b40","sha512":"41325c22e372c3ab18312b49ab693c0f36655ee7c1c349a958f0354c21da1abbaf5128044f5b7ecbf2df884d2370eaed6456d2bd95f8abd5c44403356180868c","ssdeep":"6144:vhUHdZZv3ibtMqFbTWzIQxfgpR/YrLaza7P/2kpQ:vhcZZv3ibtMqdyJORwr6a7Hhy","tlshash":"e9b4c0cc8ba78c217921e59408e8c89ec1f595fc22b892b3ff497f60365ec96dc3554a","first_seen":"2024-08-19T17:12:45.420342Z","last_seen":"2026-07-21T14:05:53.791657Z","times_seen":108,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 28 Jan 2026 23:23:17 GMT\r\nexpires: Thu, 28 Jan 2027 23:23:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 320051\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-07-24T15:51:22.935408Z","times_seen":542477,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":119,"dns":2,"connect":20,"send":0,"wait":17,"receive":1,"ssl":92},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/blob.gif","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/blob.gif HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/gif\r\ncontent-length: 128403\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1f593-19c0f2d3908\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B48ZFiHNtFuvg5392KY8p8Buz4xE01O6tzFfmX7nczEofm7o6mvLabQ29Lj38%2BPkGAqb7xLbL6hLwS2AVkUHXRNWvrLfzeGHLt%2FoyOvFQXj8hrYNZA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25bb9c856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":128403,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 200 x 200","md5":"a99c245ec131a05a3e2873c63eb0560b","sha1":"6b48fa7b2de0e6d0a26978081256af8dec85e92c","sha256":"ed38d4c064ec376d3645a155c301953d3de30212d0b0b25cabf40bb6d1e6827c","sha512":"167f0c86c86ea9f537c1b7c296fddf71f920bb7b1677fc762c00f7e9fea5e24992aa55c341bd9174b07b3b6192f34a7f63fec2fe6d6ef257303cf454128e739d","ssdeep":"3072:7WdpI/qi9scSyxJrYGcV2yaIIbXXjgg/V31uDNRDO9lYAlvc9l3J2UFrHJUa4Fs0:yrI/qksJyxJrYGcpaIIbXXjgg/V31uD+","tlshash":"4bc39f3ec5355b63da2a8eb3211f80c5130e5f3685712da78904abaf2e1477770a52fb","first_seen":"2024-09-19T22:52:05.905151Z","last_seen":"2026-07-21T14:05:53.707087Z","times_seen":323,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/telegram.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/telegram.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 780\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"30c-19c0f2d38f8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O1icS7r0QdApOCsY%2B6qJT2u66q1Qch7e7UpdbJ3l1bCnCJ0qN9mXCGFvXt%2BY40kuCTIKENiOYxt%2BMtsPtGGibZJUo3IVOlRqJrWo813ZWpNWKmFUgg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25bd9d656c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":780,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit colormap, non-interlaced","md5":"54206d2b6e21595393eb1a1a95129305","sha1":"989c819a58b5d5addbf7335633ed8394b3cbdf91","sha256":"ec19cbf91e65101ba4d0cb5d2eb9714249ee3e94b570ff330058d9294daede87","sha512":"aa410da73e0c6db91306d106439adc32364f0388762346bbe7ce6633f4edbefa4c8db32e59ece815db5bb6af9b6ca857772c2b7261d25a20b5a1bbfec87a7f39","ssdeep":"","tlshash":"8101205edea8ce3adc58e0f9572620829712cb382bf560c849fcc6058cb320ff0d2615","first_seen":"2025-11-26T00:18:39.091838Z","last_seen":"2026-03-18T14:18:00.992684Z","times_seen":56,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/gb.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /gb.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-229\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 984483\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q%2FQEti5veslASCgf11vkIRMm0k%2Bbn%2FEShDcfdujMofb1OlrT3aIy3TjPQFmWfMAQNq%2FPVuMiy3iXGhiiLJW5ABhfy77qk8u62pQc\"}]}\r\ncf-ray: 9c72c25c6e011a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":553,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f0487cd502c5e2dbdee5be26ffa835c9","sha1":"e6c2ff948790e5d9aafd3530e49171628248cf0f","sha256":"42f04826dd7a76e4ecdc9a55fb4a774a26e03a425ca1363628bb1c6f6ea1a87e","sha512":"6df8ddf15b8886dcf672dc1dc7eb7dc54385738425651a76d588c2c7e1253e8af588ded8ad1e1c7fc8e728ca9f46e55d18be4e8e422600ef20e08aa9f7421ae1","ssdeep":"","tlshash":"49f02b1d22286926e22b4354dfbc74b4013f24de2388100cb8443378c51973f79b7aec","first_seen":"2023-07-18T00:24:02Z","last_seen":"2026-07-24T01:56:22.75924Z","times_seen":1060,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":77,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/static/js/main.6d043f69.js","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:27.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /static/js/main.6d043f69.js HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:27 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"2dbae1-19c0f2d3a88\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 20944\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TmPNPkIsNBSz1OenvIWKH5YxhdscKtW08Z55L6niAsB%2Fp5PJbZxP6exG29ifCh0gHphwnyo6ToyuwhSFs8TW1Js8GT3F0NUyrI9K0dZ%2FLUPXjjnYuQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c2536a9456c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2996961,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3256f8604aeeebd9a80abea5c5e2295d","sha1":"a21caae1b62896cb18926966d62b47679b59df4a","sha256":"31b8586c01d4467701818c42d62a88510bc3145f0e6580ba92676fdf54ce22b2","sha512":"4a44857a57ba69a7158225c8c904758baf5fdf77f33cf5030f457f07e8ebb19acd677582277ba541dddbc8fa6bc088a27b78ff04f6584f62aaa9859980682cfd","ssdeep":"12288:gxOYYl+ZTDeYiLhBdnMhKhVHC/+Kt7bFxb+nV:uOfl+Z3LWBZMMhE/+Kt7Jx6nV","tlshash":"16254bc47391f06647e791a6403f1007f3396929780d846cf768ecea7d69989a23bf39","first_seen":"2026-01-04T19:06:41.320572Z","last_seen":"2026-03-18T14:18:00.993677Z","times_seen":41,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/cross.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/cross.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"d29-19c0f2d390c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gkrr8dUe4SOUtYPlLr%2BLetokZ%2FO5AC9kbvLtLfc9j4R%2BqWdDdDbWEDSmX%2BIgzVRQWEoSEV0eqpLcntVeZFWAkNd6FINkwK4XIK5%2FVSTLttdY9GhiZw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a383e56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":3369,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2be6009f566db2b00b2354b27e8a1038","sha1":"bec4b18b685cfb94766e50de043ff57aced66921","sha256":"332a945cdaa366b3caf09024c108e23d45fff1e2e651e72a1468f2227d874990","sha512":"64a99df77353a1b0304a21252be67b8d1b171c2e1a034d5e00a83765fa017ebeb774b144420de68198646e8e7a21dd3a70b46db54370a9c3c070af0308874c43","ssdeep":"","tlshash":"6c6164cc77dca3b9f416e4e9d7072494598abcb803c40564cb553e069d2e8c8ef9798b","first_seen":"2025-05-13T10:27:03.882817Z","last_seen":"2026-07-21T14:05:53.755398Z","times_seen":95,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/mask.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"6f4-19c0f2d3960\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SywrZEMdpum%2FY8F2k%2FbCKLATgfmcf2j7KZCmjkp%2F51bpbF%2FmuSCrtEFzDJHec%2F96D%2FNNR3U7RvAvJsY2pqNUShjMiOJtuCJc%2BdXHTL90wNVfI1F1Og%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ab8ae56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/landing_video_background.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/landing_video_background.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 664265\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"a22c9-19c0f2d3920\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fl3wIbueCpimO9zWd5LY%2FOZChzxf62dIBBUyGNa6Led7lwkJPUooBAgbvKn2mQnmFAYu6DrWwv4Tul3wd3lcLqJFSx%2BNvLB3IByekiMsSsyltIYsSA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25b292156c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":664265,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced","md5":"817f7b3f823e6b829936d143ec711377","sha1":"83a24f9993fe449abb5517758399897bd9765ba4","sha256":"3564ac6e86b7a2db3264a97093c4b7535c677821b02b6ebdf6e350a2d5660ed2","sha512":"ab287bb7ec71fa1bc0fc046ac7fba98ed31261879f13dd9d41f8c55de31431ecb050ec46a74bbc050b9ca31a1207d0d49873d62eac16ea8817ecebebcfc33803","ssdeep":"12288:PnBf0slBwZfk0xpty9KCqX1j1RWiG+y2Rlvv/POIdFMIFsISWczn2JXT9o8YWK:Pnq4BYrnLCIDNvykl+IdFMIFtvc0xo8C","tlshash":"87e423538d1f8e479883359c621d9353001d99ea09af3b5a65ec98e5d07b8233f9f82d","first_seen":"2025-11-26T00:18:39.184387Z","last_seen":"2026-03-18T14:18:00.975708Z","times_seen":56,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/fonts/Teodor-Light.woff","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /fonts/Teodor-Light.woff HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: font/woff\r\ncontent-length: 48544\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"bda0-19c0f2d38e4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TqRvYr1ZzQJZfWdTGY35EjwuXoG9Y2EwJlxoZughq8vQ1MqLpwrr8vJ6K%2BWi8yrD7Td2zOdLk3xYnSFjCFSNxUiDd2FOQNfoStBLFKkhZGaHqhiF9g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25b292856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48544,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 48544, version 0.0","md5":"9230afdd48c386f422f322498d06e9d3","sha1":"acec13841c56a2a5f60efc19725e80bb21a34940","sha256":"3e52268c028380759b5b74c7d16997c3c74f67905d237eaaed7dc7dd978c93fa","sha512":"a25c72c30d05b32a597f44621eaac4d54e14b2c36de4fc03985fb18b2e4d36662c3882b4e39282c7d09c7dceccd31722680eee5807e0e3a92c1d1a9adbb9c1e6","ssdeep":"768:d69IdRNJrtIssppRsaYxLX3vadbF/krLhqEzm6LoCG11cgXy5Vd0xn/5x0:dnvKssppqzLvEbFwlmjP1I5ih+","tlshash":"432302b7a425b023967752f200ef6f7475a09a4f905af0523e139b0f826d1e39dd1d2b","first_seen":"2024-08-19T17:12:45.41721Z","last_seen":"2026-07-21T14:05:53.695694Z","times_seen":111,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/favicon-16x16.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 443\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1bb-19c0f2d38d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7w4n7tDtDrkb3rAH1Qx7wss5M85PnMQzZynODAV35zbKOMkgP2YhSvxpvwHXJgGTITwAEjOrAI4D8q4hAPf0I81kUL1rSAJRCDHwsjR74UBFpksp9Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c2605e3156c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":443,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"8b790f9419300894697b539cb22a3ea3","sha1":"a5a9c3b6f255a28a502820a1caf80d1e2b1df859","sha256":"1a5cef82cb2430c4f7ea7ec377e4b96ff01b27a6e258a7ec594f5213f58ca069","sha512":"f55ff8e6214b22d41b7b042f635f36cac45c0001dccc5ba76957bb7ec898ba8a4869ba2d3e65cc9e7b67d792b639c9016bdcccf77d4495eb2503a52ac9ccfffa","ssdeep":"","tlshash":"4df02bc517a77c73dd4c6716b34f5548851b831d4b05143d55063c65549c74c5054d8b","first_seen":"2025-11-26T00:18:39.106691Z","last_seen":"2026-03-18T14:18:00.987644Z","times_seen":56,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/logo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/logo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1cbc-19c0f2d3924\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=or2g4bIMl7f%2FUbB%2FOsBkrVvUBWwzym02s3KZvXIH18IXVqshO1SkIGuADhxDumO0XSl367QW86uj3BgZ2NY2zx7AAN5mNk6bXM%2F%2FBxtmJBO88Y7MmA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8bc56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fda28f684fde04ab162b1c77437fba27","sha1":"82b0c3a51dad8809043f36a8cbc25c959846a9c3","sha256":"9284325a68c5c57693cc097f46c4dfcebda802a013774fe46a4e785f08ac7b3c","sha512":"1ec68fd2d4626399a1d2ad22ffbe36147bbb7e9f550c25eb549a40ca4529d0f5462c85149a7195e7a749cf197335b1f746341fafcd145b745c6dd2e95ffbe893","ssdeep":"192:L81ZDrGWzUggauQt7q80VHIQR8nDhFmPsmp:gZDrGWzrgauOq89ntFC","tlshash":"d6e196de7b9892d0fc97d7f0dd1a00693a1f68fa0f81c570c3998e48b5972adc489c88","first_seen":"2024-12-14T09:51:47.786813Z","last_seen":"2026-07-21T14:05:53.687738Z","times_seen":175,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/static/media/inter-cyrillic-400-normal.cb04b2ee2f7d192478b8.woff2","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.830Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /static/media/inter-cyrillic-400-normal.cb04b2ee2f7d192478b8.woff2 HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/static/css/main.215ebfc6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 7712\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"1e20-19c0f2d3a8c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A%2B4TOTHUmqCu6ACGeQTWtrD6411p2JgX7tiEW8IP61w%2BJarCDVXOLCP6JeaYKlFYnWV1eL1EJm7kRhCTdf3xuYVNiQXJTuGAzZuLK6GPA7cOHz7L5w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25b292b56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":7712,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7712, version 1.0","md5":"5343aec6e59f4cb940ba242550ed0ca3","sha1":"f18f7b4fe7afbc2264922521e85abe0181933fd5","sha256":"636d13aab05ed9fa49df19c57fdddbb6f3d084f463743ee5257549dbb7124005","sha512":"6faf32a0d55dff2f9b36e839b17ad776c6fccd14b8c363baa2c6b25f8ef6d7e01ba735b3889527b64defab4b797c972f94286313d5097a58156fc86f12bb8389","ssdeep":"192:qRc0das8PDGXX4D+MpC/plzZSUBWYHuCKCRXP8C69g:HMas8PDGXX4k9lRH4j9g","tlshash":"e2f19fb0a1312604cdcd3fbdeff29c0d585a226603ebcab5764b6c8df75311d9899226","first_seen":"2024-10-11T08:42:10.141147Z","last_seen":"2026-06-29T19:38:18.241637Z","times_seen":113,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/static/media/inter-latin-400-normal.9698cc7dbf147ed363b6.woff2","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:27.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /static/media/inter-latin-400-normal.9698cc7dbf147ed363b6.woff2 HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/static/css/main.215ebfc6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:27 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 23692\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"5c8c-19c0f2d3a94\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20943\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wA6lcNy75K0UhxwwMN%2BolsZcu%2FHIH%2BU0uqoIkgxI9RTLKfAJBNsqrQFYfdYT4gOni6sl6tCYeaE9i79%2BhyGJIuKcV25tH%2BubyS3ps1P0Goa7PugVEg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c253eae956c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23692,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23692, version 1.0","md5":"f837d382a885a07c34a3d4bf4f49373d","sha1":"68ddceef1d164a48d9d01d4a74f26b7897323229","sha256":"dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33","sha512":"ef010d89971c4f69af7bf541430364c56245a5b63ed730fe628e49f48fa9e201c7f42b1e104eb14c3193bf79dd7ce20244f6b963e9996eb8308c0d61f444ece6","ssdeep":"384:rfabeuzsqm+MAlOitodpHq9WS5TO+cig4RKuIc7OhiVaCcHKLgFT1GS:rfEeuzM+MFSoHqgS5TOjr+QTUVPuSQ5X","tlshash":"85b2e177a100a48ec93cc9ec53b1ea7b736f7941f02e5fad41fa50361c7e580a19a0a6","first_seen":"2024-08-02T10:23:33Z","last_seen":"2026-07-24T13:01:28.365339Z","times_seen":8001,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/css/sf-pro-display","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /css/sf-pro-display HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1165984\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nlast-modified: Mon, 19 Jan 2026 04:24:23 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7%2B2zwnnz1o12LLy6tuQJ0Emnue7Q3iEjNXq8Au4CWzMWk6fSEkdZXS0fZhSva5Dk5Pr6yslMtPhFmT6o25jAZyNbhPKPzRyL2W2hTRtNd0MLqQ%3D%3D\"}]}\r\ncf-ray: 9c72c25839678deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1946,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"751bddbee1b2ea1581dab2baeb2c29f0","sha1":"4d84900f4e08c54f32002a71c21ec94a97a7363b","sha256":"5ac7863e22f33bbf9c3186e919b9c227021236915dd0317d9f4851a63644c09c","sha512":"59fc2944e75419d45a57d1713dd8499dc21f14dc4d0bf22d10b3b53f558b1f589e1aa541635640c751bce43f1e1cf33d6441603fef11e56278287b0bce84ff1c","ssdeep":"","tlshash":"2041a971089ba54866312dcf779f3f1a5e0b500b3189da143ef93d089ee3d2a9281f2c","first_seen":"2024-12-02T22:38:00.917644Z","last_seen":"2026-07-24T13:54:09.136506Z","times_seen":1141,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":39,"dns":21,"connect":2,"send":0,"wait":7,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/main_video_edited.av1.mp4","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/main_video_edited.av1.mp4 HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detects.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 2356137\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"23f3a9-19c0f2d395c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EM7TGxWybiJKquDEON3NFx1iwIMGoZlNejDKMRRiTP8eN6VK5IO%2BxeuYg7O4wkT0lKayF%2BjkvzgYpaQgb9MQ7Pg8PbsB6w9R9I1W0xwyY%2Bp4mZDbrQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25b596656c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2356137,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"9ddd10a4130e6f93a1ee785ee3d440b2","sha1":"35b2cc01128aaf2f564399d5d12ac0015018aec9","sha256":"e9efff972c6a4b7831939e3e2e48b31d8416959884b2a62a245117e25a3362ee","sha512":"49c5626200f12cb17c7bab1b452b89694b83bc4d59e88358f3d8b44b7d0390a7a1045ea9935ebd1b893eb1b912e28d78f37527f3d230910eb782ce3d0d736c9f","ssdeep":"24576:g3F15cvkaBPM/ZXeXeIjGHJWx9HoEeYBFzagcmwQyn:AXMk4kRXOJks92YBFzHvyn","tlshash":"832523801bb5d4a9e29882bd5dfbc3143f52c94a4317ab4b2b113745fefa7a3c5808d5","first_seen":"2025-11-26T00:18:39.156854Z","last_seen":"2026-03-18T14:18:00.997293Z","times_seen":56,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":9,"receive":238,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/secureproxy?e=jscdn/getFile","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detects.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eppuprsummeotp2qufzt\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WQ%2BWXSigwtFo%2F5J5LHEBcI1gYW3WP0B9J%2BFYEJlUh5Lkxd67rkclxbKCeQtyVV%2Bgmqp9kon8pFNCEKr8qPlWn1SiEitSy2yaGgJRg2qg79%2B7jA%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\npriority: u=4,i=?0\r\ncf-ray: 9c72c25d9b7c56c3-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4095923,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2221582a3db076e8977d736f35a4676d","sha1":"8e8e581c602165b949930c0d86f6bb89d82adbad","sha256":"26fef6c81335c4501a8857c0a1e5acbf2f10c25c9683d068197142a2aa85023c","sha512":"1019bf6f167c273b2b20c70611354feaa432743f1abba5576047e1441f8b3fe3b1a1bd3603c6e99f5579e2a0ee52da545e4011321edad129d47ce416e8749535","ssdeep":"24576:uU8QnFDau6lSQQNeK3enrJvFNF8MxYnmzYZCVymivwCidE1mW:Q0Z6VQNT3entHF8Mx8mkZCxCW4","tlshash":"0c2523dae42280c13f57d42cb6d60dcd29e9448d9a760bb1ae4dbc46109b47dc6f8ed3","first_seen":"2026-02-01T16:18:00.168791Z","last_seen":"2026-02-01T18:25:13.876815Z","times_seen":3,"resource_available":false,"data":null}},"time_used":680,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":369,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/d6ae884b0a2f1a5346717fc160db2d28.woff","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.312Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 22:43:00 GMT","end":"Sat, 21 Mar 2026 23:39:25 GMT"},"fingerprint":{"sha1":"40:88:D9:AA:10:BE:9D:1B:7E:AC:DB:D6:14:FC:6F:E6:79:79:51:19","sha256":"AF:49:70:AA:7C:0A:4C:C7:BF:A6:11:E3:2A:88:F8:B4:87:46:2B:23:29:AF:4B:E4:1B:F2:81:6B:C4:45:AB:CA"}}},"request":{"raw":"GET /t/d6ae884b0a2f1a5346717fc160db2d28.woff HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://db.onlinewebfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: application/x-font-woff\r\ncontent-length: 27008\r\nserver: cloudflare\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\nage: 20943\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nlast-modified: Sun, 01 Feb 2026 10:28:26 GMT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GigeQYyox5yJPABJyA8MMRCOmH7g6ec2Q1hTMAptIqFF%2FJMn8RkI%2FkkVNG0aLajto904EqzRDZqav3GkAWUfqXO5K2wrHcJUROEJYKUy9JwlbM2n8Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25e5925783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27008,"size_decoded":0,"mime_type":"application/x-font-woff","magic":"Web Open Font Format, TrueType, length 27008, version 1.2","md5":"e268bdba1a8d929c3fcbf0e82715314d","sha1":"dce4df6fd3b44a6517dba02411188863fdf74121","sha256":"0476a430debd224899e40502a2d3222918ad9215e29a74c901507506d137b9e0","sha512":"7242698b0122f54ae2c2fc367a29f8639044b355b90bf01d00111ce318b42f0c8c6d402078f25df13536930c425ed11545b2357ea821521d6766f5bd12294d20","ssdeep":"768:wPa+GIuGrPVafePrg4DY031BDIFYts9zh:Z+GqpnTg4DY6QF","tlshash":"7cc2e1315fb4a4b5ce1e97eec8b3776496b0b22c35d10a0e17e0d2bd4d0a2d5085ace7","first_seen":"2025-11-26T00:18:39.195731Z","last_seen":"2026-03-18T14:18:00.973531Z","times_seen":56,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":20,"dns":2,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/blob_green.gif","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/blob_green.gif HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/gif\r\ncontent-length: 166809\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"28b99-19c0f2d390c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XMKcM%2B%2F2D9BHlk%2F52fvAT5Zn1%2FNfjHIGM4qc6qTjlEb6YdWrcCbBSUxMnn%2F%2BHPrEpzxr400QRPmzHEPhCqZ6ibOOIB7fdh9UQ%2F4t1kR4lqmJJEirEA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25a182056c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":166809,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 300 x 300","md5":"da09864f233ce0bb00e2da394736f38b","sha1":"cc8f254febea95a81016d2d52300f7bc4772fcaa","sha256":"c6c9e3823d546a595b18684fa9b48ecddfe656e7ecd8e5d81d5c0ef6bafdd00e","sha512":"6bba7e22baf01c7e294a9ed4cb6949e405d523000776dee2ccc3f8b53898c3c83300479b4ff867bfeab753ae6b4c1e0f217c0899930fd67a98fc566d961243df","ssdeep":"3072:rh7H9HfrW3rkxJKsS4cKVBiCkO7WWmEfAunjMX8v4gzIbN+t6Yc2Q:9FrW3rkx0sS4cKVBiCkO7wunjMX8v4gI","tlshash":"45f3c02bc22687b796238bf6545ee1ca158eef7f856528f30c1053b31949fbe30145ab","first_seen":"2024-12-14T09:51:47.768581Z","last_seen":"2026-07-21T14:05:53.732792Z","times_seen":154,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/zero.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/zero.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"483-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vibN3nqbQtyBlwlXF8YqM0%2Bp6eRhN0eHvoRXC4Ln5yWXexLKwzrsgwGb7UUMmo2Q8Cyna%2BTtBxxo0dMPMEbAs4BEZIwSRozGf4q2FPuXBBspxNKg0A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a182b56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1155,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1c311da40a7129b5b16febeaeaf942b7","sha1":"01a714ba38c2efc972fe688a71eb95370c6991c8","sha256":"32c93176a69c5843267495d593e9483e113e7c3ddfab6bdc6fcfc3c32b9baf55","sha512":"b3dd48a921c8393f11d557bbb94914481928540b7146639a16bf10e579f271db203f4ac13ff6879a1118dc778aff2d2e00b8b2841bb392030aeea125db773dfa","ssdeep":"","tlshash":"7721e14c574c2732e8e687e4df49e2180ea834bac3415fe8c61129249e7f888d857911","first_seen":"2024-12-24T09:00:30.374728Z","last_seen":"2026-07-21T14:05:53.715602Z","times_seen":96,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/1.jpg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/1.jpg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 2948\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"b84-19c0f2d38f0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20943\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CJsQZzoLXjzlnxioS1RcwuBIEKxN6MalLjrXTepcz7cS4VfBLYvSzU%2BQR8QufDnRdrDCSrYf0cVtPNLmOf2Ja4bq3BBXswotnxsSsFX5gZF%2FOO5kvQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25e1bec56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":2948,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 100x100, components 3","md5":"8297af4428a06e1aed012d357b056f97","sha1":"12e8d42d563c90e55b31c3d7822b07466ca66e7f","sha256":"64096b87ea94fef11abfb7afd1e731397e8c0ff54baf4a85884a7e7ae94b0fd5","sha512":"023e48b1f6d7ea2dbb919a45864f60e7d00688b69f88d1732b157e9444b6d239a3dbf1a5515503a04f1e03f8948e783c4cd1bed801d9e753e18d6d03e33fbc71","ssdeep":"","tlshash":"75514dd3bde1206aff3c9c7a94e41268d64642e1b896bf9a580301ac879f447344f738","first_seen":"2025-11-26T00:18:39.150097Z","last_seen":"2026-03-18T14:18:00.986527Z","times_seen":56,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/twitter.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/twitter.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 749\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"2ed-19c0f2d38f8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dFWvHfP96G7YGA0LlG8gaylHTnsDvDjTmQbTSqxnHpk4X2t2RtgPVtw3zsWFSzoz0o5sxmkNhZrGVAl%2FrY74XSqhaPJ2grC4P96KdwHGnJn0b1fJbQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25bd9d856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":749,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit colormap, non-interlaced","md5":"08c4467b40ac461b7cbf2de4d7d667bc","sha1":"1ee226ef3c17de10dd9b84593fcc513a62a65117","sha256":"6a020db454d2b7ebf65e8538611edf1188c9ea83a675b8658a152cfc85905d29","sha512":"0e8f53fd07e0a9badbb18755c1878fe8c6fc782e8175088623b00d6a188b1f4ad8489c4c436113b54c272c2d4923457c765cd726271823c883469a1b9a4e12f9","ssdeep":"","tlshash":"910165fb6b0b9d35ab9e9ea2284dcae399624542ed2150e153104c5535c498542e5f60","first_seen":"2025-11-26T00:18:39.160676Z","last_seen":"2026-03-18T14:18:00.996252Z","times_seen":56,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ae.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ae.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kffv7LMgiUl%2BKUD3Kz4PYeSruNJ0F3jKpBdeIQaGGwdsD2VlJbuatEB9exCzuza3RpkBMWAUNNVuCnt0YDStKCxrGyj%2By%2BHEA7MB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 909411\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-e4\"\r\ncontent-encoding: br\r\ncf-ray: 9c72c25c5de81a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":228,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cf8785787f9b5d09eeb392a3c57d616d","sha1":"c5e54922f80425f875e9c2ee6175cd42492d7c7b","sha256":"8db8bfc3d1a711967e44fbe237a52d75cd03a3dfbcefc9d78febd61c2973915e","sha512":"471e9b2e8bd7aba4eb0fe4b308e17dab29c3c37d82693c7d71ed9409b9de18d362f34296a24ef0b0570f88e8e59241c11c86daeb0775080a701c8a6e1e3a0662","ssdeep":"","tlshash":"29d0a9e192bc34040c0343b04fac70c380d3308b724a02dcf1440128225e78bbd41a59","first_seen":"2025-07-05T23:55:45.268447Z","last_seen":"2026-07-16T04:17:52.717414Z","times_seen":189,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":58,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/blob-dark.gif","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/blob-dark.gif HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/gif\r\ncontent-length: 533111\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"82277-19c0f2d3904\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zJ8sUUESJySU20AL3hKHHp5f0fxXJMiit%2B3j7tNu0Kz6k7ceXai0AKSaF2QOFwWplCYagQoKs8hMqBEVa6KCOoaeR6ttuNh5raNaQJ7HDiIkPuKKrg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25a989856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":528416,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1200 x 1200","md5":"adbb5d168742fb1b626179dbe1dea365","sha1":"c07db2a4b1de3869d04509f683d22c97241438b5","sha256":"011db6fc9bb020e7453d56cdb6554b75ff06f4279df18c2ecb9606728224594a","sha512":"651c79720790c6af6022d11696007ef40268b12d74ec23c2919f78a38990537fe426924f37c284633277ad0909e1516b33f5768412d04c770fe3214d30f9a5a1","ssdeep":"6144:vhUHdZZv3ibtMqFbTWzIQxfgpR/YrLaza7P/2kpW:vhcZZv3ibtMqdyJORwr6a7Hhk","tlshash":"5ab4c0cc8ba78c217921e5a408e8c89ec1f5d5fc22b892b3ff496f60365ec95dc3554a","first_seen":"2026-02-01T16:18:00.178063Z","last_seen":"2026-02-01T16:18:00.178063Z","times_seen":1,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/widget2.html","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /widget2.html HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 20944\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s6jX4AU7gAXpu0H9fzBtebMe3mk5DM9XnszpYh2OxfrzFkoAnU87TmqD8M8zpyY8b2V7%2FxTybSuqfgW5LdSUiZa9V7aHpkIzs%2F%2FWFznPWsuCcG6rqA%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9c72c257ce5656c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":41614,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16745), with CRLF line terminators","md5":"53a0fb9dbfa19a09dc90a5f5f018a257","sha1":"0959016823e9d3f470a67dadd3e6c20a52be30e4","sha256":"a8d9215b15cb16d1c62f008035caf47079245fe303af49fd0279fb5a48d42a0a","sha512":"7963e1bc56f5b2102348528568d2cd4bf75cccec6b66b7dbfb75ecc19133a622e6591c3e5e2c78858289aae1745075b6838b570baf4c6d188952df22bba7abd0","ssdeep":"768:ckpoMyPPwy/9OWMr9S6OfatGteqZsbok0Hs8qGIs37rhwuTRSB18//kDOc6o:Vpoxnwy/9OWMr9S6OfatGteqQI337rhq","tlshash":"7313dfa1419a303ef02286d5f2917f2961b95006ec3240acf3add54f9fd5865e8fbe6c","first_seen":"2025-11-26T00:18:39.076218Z","last_seen":"2026-03-18T14:18:00.981346Z","times_seen":56,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/apps/clmv1d6am07asib0fs4ss7w2x","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"OPTIONS /api/v1/apps/clmv1d6am07asib0fs4ss7w2x HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: privy-app-id,privy-ca-id,privy-client\r\nReferer: https://hyperliquid-detects.xyz/\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncf-ray: 9c72c2592ef6568b-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: privy-app-id,privy-ca-id,privy-client\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://hyperliquid-detects.xyz\r\naccess-control-max-age: 300\r\ncache-control: public, max-age=0, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/apps/[app_id]\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::5l5kf-1769962648518-973dafc9b6bc\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=_3opyY193YMtAlI0fUL04_i0wYVjFdQneTA1OKpn1Bo-1769962648-1.0.1.1-v._wDCADd4Q8I7DQO0mgUrWXRJMMwoi_QwntQJtrPY7z837jbQtuVeP1M5cDNRCQ_Yaof4oXwdfLfsfed5phSk8MqFTPYgT15lp13MfNc6Y; path=/; expires=Sun, 01-Feb-26 16:47:28 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":342,"timings":{"blocked":92,"dns":19,"connect":4,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/screenshot2.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/screenshot2.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 155629\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"25fed-19c0f2d3970\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a70Yfu%2F93BMHr0Cpc3OxGgVPkMQFDyAYE2pnoqI0m0nPMF6ZX%2F6F0lX%2BNigFGgznk2Ti%2FI3YgAbVY81utvRVp2Uu6DF%2Fy98AQhN%2FbvOK8gyqZTKMgw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25a686956c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2879 x 1464, 8-bit colormap, non-interlaced","md5":"58c1a83c57b1bfee45658469ee5f6e1d","sha1":"0a4ca1dcdf9a9384ab709db94190bc6595a5d5da","sha256":"109b5c7a7680201d38c08d23b63e80bb6afd451e7b38d70839821bf3101faee0","sha512":"00ed75731c42ef6f9a1b0fd863853e1db6a80558630774adcf317c478f4a6b5c4b7ebc9cf282eb6144da0d00459646c52af7e86f82f10758b29df14b219f1918","ssdeep":"3072:slFYnKZEca1YKjldd0CZZFO9QgCkKoDUSgpSL5x3blZQW77y/JALXg3vrCSx3jyO:oF0UX6jG2m9QwDUJpStxL97iSLw3vOSN","tlshash":"1de312f195a62590cf1f0f7bb588991e0b2a9ce5c5128e7f97188e26275c14eb34f313","first_seen":"2025-11-26T00:18:39.173626Z","last_seen":"2026-03-18T14:18:00.984723Z","times_seen":55,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/wave.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/wave.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"7609-19c0f2d3974\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GzJGqLUeP6JyDv3W7cPtc352pOJlXbHk5NLOzcfHJG3EVuB035tctKCTGWRK86vA8u5saa1YQi4aZk%2FD6GFNqWCTgCgjntKwLXp20YKZ6K6Z%2BISawQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25b292256c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":30217,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"452472b80636e3d91196d67329928606","sha1":"fa94dd3e17e4b6d623f84cfacbe71b674b563473","sha256":"409ac461d71dd443c330b5be3bff5e30d38558fd8aa957a49c6bf97e0ff7dece","sha512":"67500fe1077c2da09b900a1f9d5415e48036dcb255d430a7df97776c8d163538dfd133ef6636a6fb15f1621560f74d925ddb0c464713e672f9f481020bdab0a7","ssdeep":"384:LAc7ilOrs4A2h3nj4l0h90I62AgYMGBqB8J5W1HMSUzlH/zUApyO9I5WDTKEZg63:08+2NMl0HF623YMGBqqjWTqH4q9I++I","tlshash":"f4d286eeab119ce45ec8c1d6ee11c1d47b0fb03f5b6b8761c048ebf9780ac98895ad54","first_seen":"2024-12-14T09:51:47.810301Z","last_seen":"2026-07-21T14:05:53.784851Z","times_seen":104,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/blob.gif","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.912Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /landing/blob.gif HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/us.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /us.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-2fd\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1085512\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mRWb2xYgUPER8mz%2BKCzCMOcT7HFsl6v0Ii1%2FIm612BvaFttXAATmyd5xyhCZAwrYFB%2BRr8Z%2BHovCRUPjRTsiifnBvf0D3vSDDhP1\"}]}\r\ncf-ray: 9c72c25c5ddb1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":765,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"95cabb26729b10db04ff2cf3452b06c1","sha1":"aaad0f734694625c31f69fc3d5e205a445b263b6","sha256":"e1792c011daad918fdbd99a21f7f46fd71018ffd052af5a7d7faf9954d593e31","sha512":"174b15e4297e500e85f9fc3e5265e256e03a09326f66af485ca6add8afa13b2c1e85822bccf2d7fbd4597e7f5a2257b6a1d6035c02f7e390cbe967ca9ca8e12d","ssdeep":"","tlshash":"d9014982946e070d921873fcd2b8f0e9c0137866229f0daff861b659a17e7566e92d18","first_seen":"2025-07-01T18:36:10.386523Z","last_seen":"2026-07-24T14:31:35.459954Z","times_seen":1176,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":78,"dns":17,"connect":5,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/de.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /de.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PDGXSn3q13obsEoPLr6lG2jvny33fuyuGzh%2BRzp1n5rjdnAbaRQnbAicfCjqhhqawlq6qMB3wFGjuAhBe2GlJf%2FtH1Ho7rIFrhCN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1070171\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-ba\"\r\ncontent-encoding: br\r\ncf-ray: 9c72c25c5de41a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":186,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cfed9f984610e26dac5ff281c0329bcc","sha1":"b9ecc2265d397c12111fa819ad51892842eac8ac","sha256":"595d7718f6a22e5ea9de0cbbcabd857ac1892f4a6c81beb1ef936050193d9323","sha512":"a0f6fa22c59331000a426862c9953458e98c9e1b358efdb471565338168e74ba97c9a5c396aa00df307188ff5a99117230830ecaa231d848aceb5e02b46fab46","ssdeep":"","tlshash":"53c012d584ac3904cc1583720e9c65ce52977046614401dce4802619138d69f7c51ad8","first_seen":"2023-08-10T23:55:19Z","last_seen":"2026-07-24T09:17:49.514429Z","times_seen":994,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":77,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/static/css/main.215ebfc6.css","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:27.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /static/css/main.215ebfc6.css HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:27 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"b80-19c0f2d3a54\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 20944\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jeKV1MoFOjCzjrRBhzjjCNBdpOkLDVPKe0Qf7832TzIpqWLABio%2BWVmCX46BWPFrJOYrC5%2FxY7DUZx9orOO5Y90Car760yJ%2BNa4FjePgBLW7Qek6iA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c2536a9856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2944,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (2944), with no line terminators","md5":"04a6031e9fca9384a65178866fb4e26e","sha1":"3314b181e49b2c04899c991ad02488c3f377c253","sha256":"6b90434a75d9ad370e21784cd06ae519d58d828214564b4f9e9c6573b9742a6e","sha512":"2f4f361bbcd2330932bd3db346950804ff191d265b0cc6f817151d5af208c2c9d3b253cbe35b2c67b1b97b8a7e73fc7d31db0cb3e26181a1c8edc74aaa813ac4","ssdeep":"","tlshash":"5351ef104026164ee0a3be5236ce6f131d3a285515e91a03ff1d9e658eebc7773a1f2d","first_seen":"2025-11-26T00:18:39.190397Z","last_seen":"2026-03-18T14:18:00.977504Z","times_seen":56,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/mask.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"6f4-19c0f2d3960\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5GJciLw68WOEqc9CwlaN44XyhVGl%2B9sMLazBZacF3WO6MenTe33mXPpsIvxDWpw%2FmiLvnwhjThDuWDEqBky2kvv81m4SNL6MKn11dwAHvhiGoOsWCw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a182556c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.hyperliquid.xyz/info","fqdn":"api.hyperliquid.xyz","domain":"hyperliquid.xyz","tld":"xyz"},"ip":{"addr":"52.84.50.53","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid.xyz","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Thu, 31 Jul 2025 00:00:00 GMT","end":"Sat, 29 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"33:BD:50:89:D6:4D:E7:95:1B:3D:33:94:1B:27:5C:F0:50:79:ED:12","sha256":"CA:1E:6C:6B:EE:C6:41:84:60:4A:36:EC:7B:1E:C4:03:1E:42:BF:E3:32:7F:27:A1:E7:EE:F6:7E:F1:68:CF:E4"}}},"request":{"raw":"OPTIONS /info HTTP/1.1\r\nHost: api.hyperliquid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://hyperliquid-detects.xyz/\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx/1.22.1\r\nDate: Sun, 01 Feb 2026 16:17:29 GMT\r\nallow: POST\r\naccess-control-allow-origin: *\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nX-Cache: Miss from cloudfront\r\nVia: 1.1 50557aa30b42f85b01a1a22ebf5ee7a0.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: OSL50-P3\r\nX-Amz-Cf-Id: WEP4_Z7firgDkZEP5SdDi2rBo89A2SuKJBVU_Ca8qqu5ttosaJxW6Q==\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":365,"timings":{"blocked":74,"dns":11,"connect":3,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/apple-touch-icon.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 7456\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1d20-19c0f2d38d0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20943\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h4maoOycB%2BCGBiqjRHL24udKvrhqPpwgLmAmqIf3jMMQnq%2FMRIfhlCgbU4CR9ZB85DobbLsE65BaJzAccGxmbcENMqJsnQmlJcuKDSeTbgZnv%2FaMkg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c2605e2f56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7456,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ac5d8f07916cbfc01c04f466a4ad26a5","sha1":"788bc9e5f9427b97d2f12472bc9c7bc25d1467b2","sha256":"03b6e88cd148cbd0163b8858e9969c07ef64a436ec52988e1adddc02a9639829","sha512":"371c0c77cb8350def95415dd6dcac0a39d8002d695486f2fc1e7360c030ff924f9300d85bd24b8f5d422a6d13f0087c2fd95c7cd8b79143f34591d361fb0f3ec","ssdeep":"192:Pye0YNI6K1EC40TvzxrmF1KV0uDdd+TPEyleLmMiijS0m:agIb1E2TvtrmH80uJd+2mDijS0m","tlshash":"a6f1af438b7e12d188bed4576f4b3a8e1329b3088545f5cb1a5fb43f56206f84ac3953","first_seen":"2025-11-26T00:18:39.104051Z","last_seen":"2026-03-18T14:18:01.000259Z","times_seen":56,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/s/59278/SFPRODISPLAYMEDIUM.woff","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /s/59278/SFPRODISPLAYMEDIUM.woff HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.cdnfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: font/woff\r\ncontent-length: 136108\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 05 Feb 2022 02:00:54 GMT\r\netag: \"213ac-5d73bbcd1367f\"\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 20944\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7rxtXdhRSI1kXBy8XpKcTVLzFDJ0zmcigejFolcLe%2FgmYKtFJ9f0DehZoBUDpdDIEUPLTY2voIV8Pmle4Ve5MAXAw9fKDwbrP7eLV7nkjMMOEA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c72c25a38e1dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":136108,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 136108, version 0.0","md5":"6b0b578068963e37736d9ea7c04a4138","sha1":"b585e56b8c3eeef511d2c871009d090a27acf6f9","sha256":"d2c8f9696699b39621059896e051637731eb5efd10e04eca55181be50b974eab","sha512":"91c6f6e1198547862f1375d8c4ddd1ff87e4de796d5b22ba5f5ffe8b6918561aaa86d8645d353f82df8b0529ca69b5f21925fdbe727475332a2365abd6bdda36","ssdeep":"3072:pSWiLj93sZdwJZBc7nrczFdxTknitA03ERCSlnP0:MLx3sZyBcMzFdxQIA03ERDh0","tlshash":"f9d31296db3576e6f151ebbc4530c9c14d5402a2c39ebbca1d72c6c2280a732a33ce79","first_seen":"2023-06-17T15:43:01Z","last_seen":"2026-07-18T13:00:42.390992Z","times_seen":153,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":6,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/arrows.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/arrows.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"97c-19c0f2d38f8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yiwmUFtAwDJXS8OCS9ZpSKCxW%2B4g6wR2PxGiqK3woQPcdnHQFGqw8GFdpAz12DKI8OhxqQ%2FdZyMqPToahuLbW%2FIIhGbc4HddhCuKQOLJoqz%2B2%2B%2FmBw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a788056c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2428,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e0fe79e7e45e6ab72a200058537aab61","sha1":"6dd6cc2d67a439869cdb2c3138a918eab97a5dc5","sha256":"a0105ec6578596bd1360cdbef110a620ec095e9463f05ece85ccb8a6c0722586","sha512":"56b34dde1ef8d53315491d35d11bc31d57a5a10a02d37bd5ace85dba47d819b1241682411c972ecd59de199299b1300e583dccc2d707894f242f5ffb1008648b","ssdeep":"","tlshash":"f84150cc33be35f8e846e0b5c711a41c669f24fe25018eeac346081d9a99c946c1ace7","first_seen":"2024-12-24T09:00:30.365488Z","last_seen":"2026-07-21T14:05:53.743887Z","times_seen":96,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/fr.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"104.21.31.228","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:28.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /fr.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UJv55uBqb1zxYkEwTwL83fITnSGqRXL63vb4%2FETBs3LTYIQ%2BT3GZ%2FwYP6d555xS%2Bt%2BmRZ1E%2BL4XM0VZDHNN%2FpSMKBHPqaL6oL6OF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 230010\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-bf\"\r\ncontent-encoding: br\r\ncf-ray: 9c72c25c6e071a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":191,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"348ad62f3469cdf68fae460f38fbb05a","sha1":"1b0035428d1028228af43f32edbcce344df05dcd","sha256":"09645c97a47436337d63cd54625200542c65e0e1c83b774a58c9d28d0555b0e7","sha512":"2b9ba447cbbb910f7d31a55ef6a2ece913fd53c9429913a451c7946ae2088d7135b583eebc2fb6006c4c9b96bc67f88479d270d580edbe81252acca34fd002d7","ssdeep":"","tlshash":"4ec012de90ac2348c91883b95bec31e20182308fa15d02cef0842860e20178bbc9ab69","first_seen":"2025-07-01T18:36:10.396471Z","last_seen":"2026-07-22T15:44:30.10576Z","times_seen":706,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":78,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.hyperliquid.xyz/info","fqdn":"api.hyperliquid.xyz","domain":"hyperliquid.xyz","tld":"xyz"},"ip":{"addr":"52.84.50.53","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid.xyz","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Thu, 31 Jul 2025 00:00:00 GMT","end":"Sat, 29 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"33:BD:50:89:D6:4D:E7:95:1B:3D:33:94:1B:27:5C:F0:50:79:ED:12","sha256":"CA:1E:6C:6B:EE:C6:41:84:60:4A:36:EC:7B:1E:C4:03:1E:42:BF:E3:32:7F:27:A1:E7:EE:F6:7E:F1:68:CF:E4"}}},"request":{"raw":"POST /info HTTP/1.1\r\nHost: api.hyperliquid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detects.xyz/\r\nContent-Type: application/json\r\nContent-Length: 22\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"{\"type\":\"globalStats\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 83\r\nConnection: keep-alive\r\nServer: nginx/1.22.1\r\nDate: Sun, 01 Feb 2026 16:17:29 GMT\r\naccess-control-expose-headers: *\r\naccess-control-allow-origin: *\r\nvary: origin, access-control-request-method, access-control-request-headers\r\nX-Cache: Miss from cloudfront\r\nVia: 1.1 38bf1dd1623b4168f1f298799f6898c4.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: OSL50-P3\r\nX-Amz-Cf-Id: xqT5rEzkLOXN2xz0uTop-1Ho1GXIZgiLZ_bqiFB7SZiqezAh512TgA==\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":83,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"55851ba222fc52f20efe721eca2344bb","sha1":"fff76e8efb8480ad51540cd0fe31d724b44ed02c","sha256":"186f10e20a1aec26f19ee4e1391004f08d3c2e11eb14d02604a823a1cccd84aa","sha512":"be5fee0fa54cc2a200aa35cd21f4b161c1c17670f899d241df3fc8e0cac3767c6f504e90b5e5036b27b3ceb9033368e8c49bcb5e70376bf7b804e177cfe68e6e","ssdeep":"","tlshash":"c0a01202100196c0442dc70005c1104089e7211600188120494c788419d3d09200206b","first_seen":"2026-02-01T16:18:00.189481Z","last_seen":"2026-02-01T16:18:00.189481Z","times_seen":1,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":33,"connect":3,"send":0,"wait":269,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/onest/v9/gNMZW3F-SZuj7zOT0IfSjTS16cPhxx-ptRtN.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/onest/v9/gNMZW3F-SZuj7zOT0IfSjTS16cPhxx-ptRtN.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14660\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 31 Jan 2026 18:36:08 GMT\r\nexpires: Sun, 31 Jan 2027 18:36:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 78081\r\nlast-modified: Tue, 09 Sep 2025 18:53:43 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14660,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14660, version 1.0","md5":"8856bcf43a6e084bc3e1957d7837c0fb","sha1":"ef1886481636ef5e963ddc8cbf8b47d2f0718fb2","sha256":"7c1e312df6aa912caf5feeb738623cf42b48f330f6d22608a5d6185648d5eba0","sha512":"96a01e2d60129e3fccee9da8854a19b1c8f3a995dc524135891aeedfb47bcc762ec19a6b5b06d11f3f00725e178b2c875f33e49b2d7a8a161404b1d97c4eb580","ssdeep":"384:GT+rbS0lfisJdXVX8qt9YJkjCISep8LgYnu:Vm0laQdFsqtmJkOjep8UL","tlshash":"ad62d050aba01d0fe9f310b5e53a57821a7bec851a055a1d2f7b2cdf1306358cdb6b1b","first_seen":"2025-08-16T20:35:30.701889Z","last_seen":"2026-07-21T03:38:27.964595Z","times_seen":77,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@400;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@400;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 01 Feb 2026 16:17:28 GMT\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3854,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"d26543f025bcc11228dcc6abc937fde5","sha1":"15a4c6e6a591d1882d1de0187151bfcca542ca00","sha256":"79aa70267aa0ed514c62a5a45172d93f6ddc48e9a04ffeb4502fb485f96230be","sha512":"59d38efa15a1ec680537b78442220a9da2d3bfd71f90fea2cf9cee5be84c1bfca2da7eb937a5e6b40b581eb4364cd58adb911d7237aa2cdb1aac96dd865111d5","ssdeep":"","tlshash":"2f819b91105ba500e7472cc923cf7f26dd4e61627494c57a6ffe2ca8adeac224325b3d","first_seen":"2025-09-05T12:08:59.10937Z","last_seen":"2026-07-24T14:02:26.391793Z","times_seen":1224,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":192,"dns":1,"connect":22,"send":0,"wait":31,"receive":0,"ssl":169},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/logo-privy.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/logo-privy.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1cdd-19c0f2d38f4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bO4mAS4mqHS00rqR362R2POmcEQ2wiVEHhW%2FJUkD7YPkxkXfPatLW7LqS7l4AnKzJmVnEyknbZqsanbz85TG25MdTTjiDzKUBCbCyHJy%2Bwk1nIy73Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c2588ee056c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":7389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"766f2387956b714ed1187970e6e993a9","sha1":"e84d850478d7cf66241b7789eb6361e79cf25a71","sha256":"639d8879178dcef27c985ebc8a8682fd45fe70642948aad298a3f827d0f3119d","sha512":"b0542709b9c518694be9b86d3cb2473d73595ade80ca898c62f6c39c201cd148fcad56b9e1ea6c43bb5252e2a8fcace1e5f385531b2a880c4ca3bbf98a92caa6","ssdeep":"192:niL+w9lkDvs9r5VoGGckX7NoBpJKPPzruVvx17avPz:niL+KlkDmYL6BpYnzq/Vaz","tlshash":"6ae1d6fa35a453e8c502e3f1ee17b4696e6f28fa3bc042a6c360ed9567250798d4ccc0","first_seen":"2024-12-21T19:32:48.64242Z","last_seen":"2026-07-21T14:05:53.771405Z","times_seen":328,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/eyes.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/eyes.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"6a9-19c0f2d390c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oHUnHsSIYyJgMgsyP7Cd6%2BaPtiZFn2dLlZht%2F57KGn20vNoSLkOM1NHWcYCzO9AI%2FNVurHURnmTEd8EZZ%2Fu1DByzmBFGn9YmgLW20akscZU3rwGb1g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25a787d56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23531ca79c9f5dc2be0b39b28aa7524c","sha1":"fbc92b54469e04184464faa2d50c5872da5277dc","sha256":"6d76143b39d23013125c7baf0108a0e80eea7f497e91682f8df1bebd702e7482","sha512":"1b8857d1cb472b308344d22485c476c00fe73bb25fce81a8fd49f713bb9b0259b864b9acb8a9a4b75894a8b4b8638e2dd763e63f21b6382984d99b550fafcdc8","ssdeep":"","tlshash":"e931f28d2b4c51f5e16082d6db098228b84770fe5140db7dc35a3d35999bbdd6c2b885","first_seen":"2025-05-13T10:27:03.894079Z","last_seen":"2026-07-21T14:05:53.701352Z","times_seen":95,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/mask.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"6f4-19c0f2d3960\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JMHN0k2qQFPi7r1j7e4uqUzQ2ma1Ru50GDQ25HMnHMSPuaP6VKyaXCOyrbXH862PNyApAgXi%2B606RDQdG7Sa7yEePQY%2FUR%2FrcQTQ922FYJ%2BHuxgybA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25b291d56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/images/2.jpg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/widget2.html","date":"2026-02-01T16:17:29.308Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /images/2.jpg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 4168\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"1048-19c0f2d38f0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xcEgkyCmEcsFJyS6hdVpTR8FP3KLAdmDk5NGlUdYaudow4JpH8f4zfDWgrXphat%2BeQD5lYMwcEjVT9YR%2BomMUOjAWGWQe17LuD0TOEWsWda%2Fn5bnWg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25e2bf356c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":4168,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 100x100, components 3","md5":"21ee1126feaf6e9783f9f49fadab7bf4","sha1":"17bb3a1dd9f11996939f2dac6fa35606b37d37fc","sha256":"f72aa00b2031b6f510ae3e693f6225b55a4372a217bf10400a07d80ed12dd507","sha512":"eab27cb6f3c0121a7083fab26e797bd28d48c534984fa0de67014154f05c7f4f3abd91e7bb8a0b46c6a4535a2ec8c4db68203d7e0ce6f3e70a4c4ba32a688466","ssdeep":"96:NR1eZO5OhwYWauodQXNP8Nf3UwAuA1ypM+f214B9r:NR1ec6yabdG0Nf3+uA1mMPaH","tlshash":"8a814d8a8775ca0be87f4778f4d8e7ee5b59a49014305e2d7422186487a117283fe725","first_seen":"2025-11-26T00:18:39.165377Z","last_seen":"2026-03-18T14:18:00.969127Z","times_seen":55,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T16:17:27.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wXMLVdo2lIqfFWkG3J3XE4uFPfWz3QBr9VwSQyHvi4cK6aSAxYCxZ1duqdonk9Pos%2BjvsnurzQVgeNPUFQF9YcBoK46jaOK%2FN3hdIpKfQf6TRLrxhJIZ\"}]}\r\nage: 20945\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c72c2528afa8be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2155,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"20c4c448ca03de9139bd34fbaf41da34","sha1":"a31853f73cf4366bee2ce8ea5d71aca584e76977","sha256":"1c3fd57e25e95f68da10ad344b2860ce8537d22ac5280f5cf8d6405bebb9e40e","sha512":"6f94decb27c2691c1955573090f6c7f776c2c8074dc247ce37a77160fd16c378ccaa83e1905ca940a1afc04a93c5a1743d110088ac9c46c9cbe8f1edcf399ed7","ssdeep":"","tlshash":"014113639a319c0d62348958df46b004cd69ace6cd656d40a0c8edebcbd1fd4c273677","first_seen":"2026-01-13T14:56:05.376716Z","last_seen":"2026-03-18T14:18:00.99977Z","times_seen":35,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":84,"dns":67,"connect":1,"send":0,"wait":10,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/largeLogo.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/largeLogo.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/cross.svg","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/cross.svg HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:27 GMT\r\netag: W/\"d29-19c0f2d390c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ilc%2Bgr6l3YS3y8OO712TCYybm3n0eXE8fwua9sro9r3MMBr56uN8vaL0rXfHIO90DRa%2FnA7PRt1rlRg9AdM2BcJv1kZ1G9HQEACC3oY3g5QoCl%2FwRw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c72c25ac8c156c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":3369,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2be6009f566db2b00b2354b27e8a1038","sha1":"bec4b18b685cfb94766e50de043ff57aced66921","sha256":"332a945cdaa366b3caf09024c108e23d45fff1e2e651e72a1468f2227d874990","sha512":"64a99df77353a1b0304a21252be67b8d1b171c2e1a034d5e00a83765fa017ebeb774b144420de68198646e8e7a21dd3a70b46db54370a9c3c070af0308874c43","ssdeep":"","tlshash":"6c6164cc77dca3b9f416e4e9d7072494598abcb803c40564cb553e069d2e8c8ef9798b","first_seen":"2025-05-13T10:27:03.882817Z","last_seen":"2026-07-21T14:05:53.755398Z","times_seen":95,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detects.xyz/landing/screenshot2.png","fqdn":"hyperliquid-detects.xyz","domain":"hyperliquid-detects.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detects.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 13:20:23 GMT","end":"Thu, 30 Apr 2026 14:19:03 GMT"},"fingerprint":{"sha1":"E1:84:99:75:C0:A6:72:08:FB:C9:C5:48:31:D2:07:5B:2A:C3:93:46","sha256":"F5:41:EB:90:3E:46:5F:85:B8:B7:1F:2C:3E:1E:0A:CC:A6:54:7B:98:CE:BD:F2:C2:DE:02:6D:81:DC:E7:5D:4C"}}},"request":{"raw":"GET /landing/screenshot2.png HTTP/1.1\r\nHost: hyperliquid-detects.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detects.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 16:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 155629\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Fri, 30 Jan 2026 13:52:28 GMT\r\netag: W/\"25fed-19c0f2d3970\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 20944\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BcIQJohSkC6TmU%2FtlSda%2BIhXjaIyquAKzauW17xofrm1k59AjY1oeCOLQTDixpnJ3yzDVWQiR6HtrBowt2U9c5yiusMKfh2zAdyM5KLRI7MoWZHVNw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c72c25ac8c256c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":155629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2879 x 1464, 8-bit colormap, non-interlaced","md5":"58c1a83c57b1bfee45658469ee5f6e1d","sha1":"0a4ca1dcdf9a9384ab709db94190bc6595a5d5da","sha256":"109b5c7a7680201d38c08d23b63e80bb6afd451e7b38d70839821bf3101faee0","sha512":"00ed75731c42ef6f9a1b0fd863853e1db6a80558630774adcf317c478f4a6b5c4b7ebc9cf282eb6144da0d00459646c52af7e86f82f10758b29df14b219f1918","ssdeep":"3072:slFYnKZEca1YKjldd0CZZFO9QgCkKoDUSgpSL5x3blZQW77y/JALXg3vrCSx3jyO:oF0UX6jG2m9QwDUJpStxL97iSLw3vOSN","tlshash":"1de312f195a62590cf1f0f7bb588991e0b2a9ce5c5128e7f97188e26275c14eb34f313","first_seen":"2025-11-26T00:18:39.173626Z","last_seen":"2026-03-18T14:18:00.984723Z","times_seen":55,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detects.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:28.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 28 Jan 2026 23:23:17 GMT\r\nexpires: Thu, 28 Jan 2027 23:23:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 320051\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-07-24T15:51:22.935408Z","times_seen":542477,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":148,"dns":1,"connect":20,"send":0,"wait":16,"receive":2,"ssl":122},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/analytics_events","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.21.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detects.xyz/","date":"2026-02-01T16:17:29.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"OPTIONS /api/v1/analytics_events HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,privy-app-id,privy-ca-id,privy-client\r\nReferer: https://hyperliquid-detects.xyz/\r\nOrigin: https://hyperliquid-detects.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 01 Feb 2026 16:17:29 GMT\r\ncf-ray: 9c72c25eecdf568b-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type,privy-app-id,privy-ca-id,privy-client\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://hyperliquid-detects.xyz\r\naccess-control-max-age: 300\r\ncache-control: public, max-age=0, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/analytics_events\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::z58qh-1769962649458-036db39dd56b\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=XeFuadgc.9JaUHvvdHIcnRUZ86u0JfeCV1M0f.HA88k-1769962649-1.0.1.1-bKSqS8p8ivgM8_m6nmxXuW1qP4CY1dfSgy8P7mgZPkRoZDbbTvCjZt194jdEKXP1ExoGmhbQA2d0tKXinK3.LauupwuOzSK8pORHejTEzNE; path=/; expires=Sun, 01-Feb-26 16:47:29 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}