{"report_id":"6bc5db30-3f95-40fe-afae-4c837f2df35b","version":6,"status":"done","tags":[],"date":"2026-03-06T23:21:20Z","url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"title":"USDT Receipt Creator - Create Fake USDT Receipts from Trust Wallet","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T05:54:05.583673Z","times_seen":17866918,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-10T23:21:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"trustwallet.receipts.sh","ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2026-02-22","domain_rank":0,"first_seen":"2026-02-23T15:05:53.93083Z","last_seen":"2026-02-23T15:05:53.93083Z","alert_count":34,"request_count":17,"received_data":8715206,"sent_data":7824,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]}]},{"fqdn":"domennc.com","ip":{"addr":"104.21.45.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-02","domain_rank":0,"first_seen":"2026-02-03T09:24:27.525541Z","last_seen":"2026-02-23T15:05:54.442049Z","alert_count":0,"request_count":1,"received_data":326182,"sent_data":429,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"40c4de522ac618b35fbb1d1702125320","sha1":"f5d2ef38a5f99baf1342ca0b6ca155af56d29f82","sha256":"075d056f9d0f4c9b61ee409a5285fa13a6c23ba002c94d092fffd916ab306d29","sha512":"61e999de689c78303c2161ae43c5d53841a06072e7609ad7fc6996a073a71f693711834af1e9804f6a4d80f407100a88ffbe28821022c93841c501ccf2bbf9e2","ssdeep":"","tlshash":"7bc0128a00b3d1c355f211c676873274f19350973104e144363f87006f5ad0f8517bcd","size":191,"data":"","first_seen":"2026-03-06T23:21:25.915442Z","last_seen":"2026-03-14T17:37:57.716895Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"domennc.com/static/tron/bundle.js","fqdn":"domennc.com","domain":"domennc.com","tld":"com"},"ip":{"addr":"104.21.45.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5b87069e59107b6f4c7e96eb8bbe9bfd","sha1":"ffbfd14d342210c762bed086b9aed1017c006cc1","sha256":"a93de61ed0b06c5f88e49f7ededba80e48ede3aa4306dc4a9785198aab390979","sha512":"0197b2fb62cf2814e4fdaba05e09f43b94a9fd109271f7d969973b1c91592d950111c7382763b0b524df962561d8b7a6ea2528bd28aab4b140105a229e1b8ac5","ssdeep":"6144:7//PRxd02vLVNughJdwlVCZXZgzCt4JyYtKFfz8i:TPRxXDVNughJdwlVCZXZPWYfn","tlshash":"f4645c51b7a53129076b0bd2407b1117f2376d9cb10a80acb3acecd66a7c589e46ff78","size":325527,"data":"","first_seen":"2026-02-03T09:21:53.593959Z","last_seen":"2026-03-13T13:14:58.255818Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/js/script.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2ad87969e8701ec8623ee9709ec47719","sha1":"5f19bee233cab5dd1408791531d4e962a238edc7","sha256":"3f77cdf75e2094f25bc911c03ae35a6677b4eff598df2e8ef66cc16ad671f99a","sha512":"1687d7990097ad6460d003f44f76ca0c3b2b56acd983a45a30147268c8f8c840d835e8864efdc4c365ed21d13d5f3de10ead9a9f429d770330a499d2083013fe","ssdeep":"768:c3cMIG1G1d0VSpd/kwbE3DfV3fKfclfxgfxm5wDfecfecgHqcNfHc6h3e3Xz2O2H:cceQgJNfO2TWmjakt","tlshash":"59c2b52e71f6103280b365aa7787568837345083b005dc923f9d89995f97cb1e8f7bea","size":26308,"data":"","first_seen":"2026-03-06T23:21:25.910265Z","last_seen":"2026-03-14T17:37:57.708802Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/loader.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ded3376a451c79130ccc9921034e5901","sha1":"10e6e4ff0e7779e5d4c15a5e3c72befbfe499e6a","sha256":"d4088f751ac1eb78989f6a3e123f68e452561dca1e484d508228f6a2d0d14916","sha512":"5c6f04290c471faa0771962e9a89d6492c2f2c53b5383f2aed1cc01d029076ffe61b8fcbadffc9eeec66ee81e90d5109be18b51baaa9cefe626d941fce8aaf89","ssdeep":"384:Li54uhaC9nZD8isgqq+G3FUV0kz/g2dfBLZd:LCP9nZD8Fq+GVZkzY6pH","tlshash":"9542500af6583336414325a81e9b166435229097aa1150353bbcd3a81ff8f5fa4f7bdf","size":12578,"data":"","first_seen":"2026-03-06T23:21:25.901275Z","last_seen":"2026-03-14T17:37:57.709632Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e56e9b2b3c236b57097607cc198ac22d","sha1":"a32956f299c669e7cea547ea1d75e58f9c735e12","sha256":"bb489fdcbcad764d277a95a242c449734693e397e3e3fcd5cddccabfce7f2c10","sha512":"d8a76178318f47b681e3b33ffbd8ed37a2ac3a4a7a6e224eec1423e37d8a8d759475b04acb7eeb2ab8726a65e7e4c8a83bb99eb504f3dd3faddbece9a60edcce","ssdeep":"","tlshash":"d4e0c24600b3c1e349e301d9b7833238f2ea10873508e514357f87146f16e0fa116fca","size":322,"data":"","first_seen":"2026-01-28T11:39:41.393649Z","last_seen":"2026-03-14T17:37:57.717787Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5072b6da2e000aa861fe357bb6741f42","sha1":"692bc3cdd4cc874416ef1842fede28ad747277a9","sha256":"484b16a1e42afedad6dbfc56fc46990f653d83927b9bca10718ce03d0318a9a9","sha512":"06e7157bbeb60a5203f5d30de3ec8849740d8f862b607b13b5242ccd96a9bc7527a775966d24f54ce6d7870ac68c33b2ab26ec9a1397fe10cde4cc6bc7e74316","ssdeep":"96:85jtibgCfqkGilRMxemylisVihS5phE1i0dq39n:8Q5dkAmylisVihSThE1i0dq39n","tlshash":"d9b1ef6593b612b50267526b57974a9d222010ab3646c8f83ebd07997fc0f106ea3ff4","size":5594,"data":"","first_seen":"2026-03-06T23:21:25.917451Z","last_seen":"2026-03-14T17:37:57.718776Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"trustwallet.receipts.sh/loader.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /loader.js HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"loader.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"79d5e3c8c193029a4e21b88a6e2fd731\"\r\nlast-modified: Fri, 06 Mar 2026 23:20:56 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::b6cmt-1772839256501-cae1dc3afc69\r\ncontent-length: 4007\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":12578,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"ded3376a451c79130ccc9921034e5901","sha1":"10e6e4ff0e7779e5d4c15a5e3c72befbfe499e6a","sha256":"d4088f751ac1eb78989f6a3e123f68e452561dca1e484d508228f6a2d0d14916","sha512":"5c6f04290c471faa0771962e9a89d6492c2f2c53b5383f2aed1cc01d029076ffe61b8fcbadffc9eeec66ee81e90d5109be18b51baaa9cefe626d941fce8aaf89","ssdeep":"384:Li54uhaC9nZD8isgqq+G3FUV0kz/g2dfBLZd:LCP9nZD8Fq+GVZkzY6pH","tlshash":"9542500af6583336414325a81e9b166435229097aa1150353bbcd3a81ff8f5fa4f7bdf","first_seen":"2026-03-06T23:21:25.901275Z","last_seen":"2026-03-14T17:37:57.709632Z","times_seen":6,"resource_available":true,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"domennc.com/static/tron/bundle.js","fqdn":"domennc.com","domain":"domennc.com","tld":"com"},"ip":{"addr":"104.21.45.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"domennc.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 10:13:46 GMT","end":"Sun, 03 May 2026 11:11:08 GMT"},"fingerprint":{"sha1":"02:75:99:13:37:D2:7B:9C:51:25:D5:21:DF:F1:01:C7:46:EE:EB:EE","sha256":"50:04:D1:D3:19:61:6C:1E:39:58:9E:0F:E0:1B:CF:7F:3C:65:65:93:03:7B:99:B2:B7:0D:E1:3B:AD:19:CA:7C"}}},"request":{"raw":"GET /static/tron/bundle.js HTTP/1.1\r\nHost: domennc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 02 Feb 2026 11:21:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"698088ab-4f797\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J6GYHdVCNpN7XBg8VOaEegcGa12watB8fa2OU67qSFeEhZta1h9TV%2FPscvz7J66sxZkR%2FIhVO%2Bcw%2FNY0zdU4KlLApilY4VAOZsgT\"}]}\r\ncf-ray: 9d8518096f1cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":325527,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65472)","md5":"5b87069e59107b6f4c7e96eb8bbe9bfd","sha1":"ffbfd14d342210c762bed086b9aed1017c006cc1","sha256":"a93de61ed0b06c5f88e49f7ededba80e48ede3aa4306dc4a9785198aab390979","sha512":"0197b2fb62cf2814e4fdaba05e09f43b94a9fd109271f7d969973b1c91592d950111c7382763b0b524df962561d8b7a6ea2528bd28aab4b140105a229e1b8ac5","ssdeep":"6144:7//PRxd02vLVNughJdwlVCZXZgzCt4JyYtKFfz8i:TPRxXDVNughJdwlVCZXZPWYfn","tlshash":"f4645c51b7a53129076b0bd2407b1117f2376d9cb10a80acb3acecd66a7c589e46ff78","first_seen":"2026-02-03T09:21:53.593959Z","last_seen":"2026-03-13T13:14:58.255818Z","times_seen":23,"resource_available":true,"data":null}},"time_used":285,"timings":{"blocked":28,"dns":14,"connect":1,"send":0,"wait":213,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit2.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit2.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 615036\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit2.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"fbda6fe9682d63433ce25aec010fb362\"\r\nlast-modified: Fri, 27 Feb 2026 20:30:20 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256506-0a0dac6f9709\r\ncontent-length: 2707\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":10734,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fbda6fe9682d63433ce25aec010fb362","sha1":"90e234e481359853e1a3d40644dff49ce20f5934","sha256":"c6a0aa994362014ebe33193d0e9a16ec866d3787a32300c030f47fc45e2f4724","sha512":"a65f2964308672761d0c1d04eb449206231cbb1e9fa220937a89fcdf6f50339c037b42f56a7643d91edc2d7397bd5beef20ba1ef613cd9afa25f2a741b9d7f83","ssdeep":"192:SW2pQeCBWg8geYl7ByksxaThcuDNoMmNquwn6J9c3D32WMVwnNNqRSB:+oPsYVPZDmY2kju4Y8B","tlshash":"4122c7caf32869fdf6d34f59db1072b4260a303a0e66536c813d8d3c1a8560ee51fd90","first_seen":"2024-10-12T13:56:58.711689Z","last_seen":"2026-08-06T11:27:12.8992Z","times_seen":921,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit5.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit5.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12401\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit5.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"83986156dd8df49f40175538d33639af\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:15 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::k24jz-1772839256510-e6298a820654\r\ncontent-length: 3605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10085,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"83986156dd8df49f40175538d33639af","sha1":"b67eb4b5fea974adb55977c6cfc42c3ce8b224d4","sha256":"be5bc71658387110e1776fe9d3a6eb1936d747edbeccef35bca7ef14719e0f3c","sha512":"819cfecc001cd9353ed5ccc8a0dca9848531bc26b61194581e29bd4b782e293a54dc55698e1ba5cdac29fcc7ceae9f6e4803796990be6fba397b7554266e0237","ssdeep":"96:9bEPGTGbE2GIywkC2nkDKk97uu6wW1J88PVyzXUtt00I/bCsQ5ZnQFZnS11FQqk7:pEPGTYEAGkD1hhWH8WOEq5gMn0+qkQCF","tlshash":"c022c8c677385d7dfa934facdf04b7e4302ea07a565e5398d2268a38114268ef91bcc4","first_seen":"2023-12-01T17:00:55Z","last_seen":"2026-08-09T14:00:53.550698Z","times_seen":1203,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/_nuxt/assets/index.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /_nuxt/assets/index.js HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::52jc7-1772839256513-aed1ed7dd375\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T05:54:05.583673Z","times_seen":17866918,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit1.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit1.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12403\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit1.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"1645fe9e4e50c926db510f45d2670378\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:13 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::5fdsc-1772839256505-19bad0e00acc\r\ncontent-length: 6424\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22271,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1645fe9e4e50c926db510f45d2670378","sha1":"325294dfe8267c63104646d60cdce3e201f6d7a0","sha256":"89f90f697ecb81bc6558e7a4df1abee65c3e45238e818631b14960c55e6b5ab9","sha512":"c569f384e77c296765cd60c630d8ac05d09e006b057e01f1a6940359d9b76cb3c62f613996be763b7fbd365c9496253ac985d1c2777e5977bbacb7e1775ff9f3","ssdeep":"384:jz7cy1KpXqwovhEqTjOyf731s1uhjNo8JNoXuhGYZe9YZ6iSqHmC/k6O+VgaCqG:jz8AVTjOyB3teC/kZ+yH","tlshash":"32a2b7ca6b385dbcf1c74fbadf2479e8200960ba0e2917d4813ea07d1657dcdd61ac94","first_seen":"2023-12-20T05:41:29Z","last_seen":"2026-08-06T11:27:12.922952Z","times_seen":903,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit4.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit4.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12401\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit4.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"e1e6944c95750e2f20dd0902e8065b2c\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:14 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256509-268a1e291839\r\ncontent-length: 2124\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5818,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e1e6944c95750e2f20dd0902e8065b2c","sha1":"31540228a6b9ddc6cd4701720fb9b53210cb1e4f","sha256":"018c0cea41d585a7b4190176e7a18128a89e1aee685ab9e763741f376081b995","sha512":"e88c0f52743f841767e457a627248ddba418dab011ad59ef302b67a2da15908c8cc5045112348acd125fbbd83f236d4681fc64f54834d29ba6525718657d2699","ssdeep":"96:y2dqoNJZEMhiFeGnITA2dqoNorYvjfLVOgnXpv5pwYHBrhwYpWUoqZB2n+jOdFRf:hdqY38Z0dqJsj5v5iYZhv1Cr","tlshash":"3ac1c8d57734b9bcf0e70be9df10f9a4304e70761a559388c3a1ca3541969ce992bce0","first_seen":"2024-10-12T13:56:58.696978Z","last_seen":"2026-08-06T11:27:12.916499Z","times_seen":891,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit6.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit6.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12401\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit6.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"e6ae2261df1e2aa6625d077542c2ae80\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:15 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::tm6cc-1772839256510-34b2cd32dc51\r\ncontent-length: 1968\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6946,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e6ae2261df1e2aa6625d077542c2ae80","sha1":"e059e06ecf4e3633578ed82be6802b3e8edebbfd","sha256":"03720cd7337f650aa6c8fabea56973a2cef5aba82008f80cb0874744592d3ce2","sha512":"0e7cc6dc80d4709ea35bbb2ff58c67b6de5921bb676f5a8a2831bda1a1ad29ba2a46943083942b39b3a9cf404b1542e7bdf4ffd4b6cfab0f767f3c262ec1aed2","ssdeep":"96:ArdFO+fLClvKoyTjtgI95CfDMd/kPpxPb:ArLOIyioAJ95CrM1OvD","tlshash":"42e11ece37440cfe7e26079aef2a32b9102255fb2d886200c53b1a79158165ead3fec4","first_seen":"2026-01-28T11:39:41.389496Z","last_seen":"2026-07-31T14:13:47.057542Z","times_seen":34,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/logo/trust-icon.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/logo/trust-icon.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"trust-icon.svg\"\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"3ee56d3d53da51941b0270b30ed6ed65\"\r\nlast-modified: Fri, 06 Mar 2026 23:20:56 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256504-af8efb4ed9af\r\ncontent-length: 784\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":784,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3ee56d3d53da51941b0270b30ed6ed65","sha1":"886f96197413c373f78ae46391c135c4e1b0d933","sha256":"d1a4ecc8bda77c6d5b1093baadf917926ed8806b5283d78d648fe5bacc5abc10","sha512":"292287bbe0974d3b61b3734ad4176772b343769cb17312f3106895cf863e24a07dcdbfb6c57fbcb2c0ef373967fec3e63953ae89ec90bf703b272fa9d3fd0452","ssdeep":"","tlshash":"c8016867ea88d93be958861ce12984a14176e1c3b5d0c585d6a4ff0f0d191826d0ebe4","first_seen":"2026-01-28T11:39:41.377303Z","last_seen":"2026-07-31T14:13:47.062699Z","times_seen":39,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/gallery/intro-image.avif","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/gallery/intro-image.avif HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12403\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"intro-image.avif\"\r\ncontent-type: image/avif\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"77e3c9b2f057c85598255546be9321cb\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:12 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::xkssf-1772839256505-ed3143fddc24\r\ncontent-length: 159172\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":159172,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"77e3c9b2f057c85598255546be9321cb","sha1":"fd799462adae9dbd39365b167ce15e391d1f0297","sha256":"efc10220b84b9e87313c50326e21df82f1c61ca6287b7a362624b3cdf87b666c","sha512":"f34e2ba69f6fb78c7804d5c5ec736a67f8f78a70436f08dbab887acb7df14359d3d584b46669d5cc56963e7fe795e4666061fd214f4b3836612c77bb1a1abfe8","ssdeep":"3072:3I4OafgtarybFxqcH+wnsTuNxZe2rYoP3u/Ql5d5CGLbCTnsKOfq:1SVZHdnPPzYo2Yl5ddAGq","tlshash":"38f312bad602cf85f993be3c310948b18e83d63a797f03735a8ca47d54b9e6e0d01695","first_seen":"2025-06-21T11:37:37.70886Z","last_seen":"2026-07-31T14:13:47.049742Z","times_seen":855,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/gallery/cta-banner.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/gallery/cta-banner.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12400\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"cta-banner.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"e8dbce0a3abb7cca91da655e510734a0\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:16 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::4pqlz-1772839256511-055d1db90e5f\r\ncontent-length: 3158\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":10249,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e8dbce0a3abb7cca91da655e510734a0","sha1":"7b9ae270cad10d396c4001898878f81cbb39614d","sha256":"6dfee5060560d383534f9b847164c6580297882591a61f03802ee74ededc2f72","sha512":"5081280510b9abd58cc3203db6442e3a00a6f35d167b5638dc8268e9be8b5604daeabc5993d5309d3e74bd2e3d5455bdac8b3ceac82bc4dd2b254d6575a9d40e","ssdeep":"192:KAcdLt0TAR3pxOVpjWjZiO4NgCAtZ6wzvR5:3cdJ0UR3TgjWjZizqZF","tlshash":"f9220dce3b145dbcf93287a6db02b3b9202b49b707e56310ce361a79640195ea93fdc4","first_seen":"2026-01-28T11:39:41.378942Z","last_seen":"2026-07-31T14:13:47.051349Z","times_seen":31,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/js/script.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.533Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /js/script.js HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12394\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"script.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"44431f5988e8bedc7809801b10a57039\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:22 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256512-b87ff85d21de\r\ncontent-length: 6633\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26308,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"2ad87969e8701ec8623ee9709ec47719","sha1":"5f19bee233cab5dd1408791531d4e962a238edc7","sha256":"3f77cdf75e2094f25bc911c03ae35a6677b4eff598df2e8ef66cc16ad671f99a","sha512":"1687d7990097ad6460d003f44f76ca0c3b2b56acd983a45a30147268c8f8c840d835e8864efdc4c365ed21d13d5f3de10ead9a9f429d770330a499d2083013fe","ssdeep":"768:c3cMIG1G1d0VSpd/kwbE3DfV3fKfclfxgfxm5wDfecfecgHqcNfHc6h3e3Xz2O2H:cceQgJNfO2TWmjakt","tlshash":"59c2b52e71f6103280b365aa7787568837345083b005dc923f9d89995f97cb1e8f7bea","first_seen":"2026-03-06T23:21:25.910265Z","last_seen":"2026-03-14T17:37:57.708802Z","times_seen":6,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/logo/favicon.ico","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:57.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/logo/favicon.ico HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12401\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"favicon.ico\"\r\ncontent-encoding: br\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Fri, 06 Mar 2026 23:20:57 GMT\r\netag: \"f31065f3cd27ee747f132dfb9f3004ca\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:16 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::52jc7-1772839257497-ac23b3b19edd\r\ncontent-length: 63757\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":186813,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"f31065f3cd27ee747f132dfb9f3004ca","sha1":"b1f3cc4a67b0b7c4cc1c8aaa594f4b141e574794","sha256":"aad2a3e5c939abd19c4960dbf40300fcfbf4b1a97b23aa08877f9ca689e20b38","sha512":"e6505d407245ec6a74b73604035572c9ffe3cbb314318e30e0c2aac3a355983d4c250066e25fafbf438fd6989ba70285e30572e7eda117a47e09dae7c40f81bb","ssdeep":"3072:jUcVblV61/KfYGyjVoEovkLYqFYUU9PoPZXLNnYfKDKwM0w+W3:jHVblV61/iYGyjVrovkLYmYN9PoPZXLe","tlshash":"dc04f44aba56d92be01137bcc9b3d1f0e49a6d40fa13b48366f47d87f8318a9cc095d6","first_seen":"2023-12-20T05:41:30Z","last_seen":"2026-08-09T13:55:00.415452Z","times_seen":313,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T23:20:56.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 58841\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"22c3b524e8dc9ecf937b3d94fc46141c\"\r\nlast-modified: Fri, 06 Mar 2026 07:00:14 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256325-942867286424\r\ncontent-length: 278789\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]}],"data":{"size":466636,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (23913)","md5":"22c3b524e8dc9ecf937b3d94fc46141c","sha1":"0082e930727cd1b314b1595f897d1f7e52c1a20a","sha256":"6bd1a5cd10076ca21e5726b2d7cade03d54ecf76e4edb1d02aa79bc0d4c0d6e1","sha512":"379b1d49f672916007350e63f0c66a464a77548bac898e5b4c02dbcd312a8770eb55f0fd1a442adc20e60d4a1a2779a735a46aafa2a62d71807e4a9eca77532b","ssdeep":"6144:waWH8Ua0J9SCZySbgFT10mq3TjeEvzQmbdGNWQGn/LfjyXT3/ln/OE0bYAdx:wPt7zyea0bmEzSwQGn/LfjyXTkdFx","tlshash":"2da4c03065eab5cfb0c6c972f1602e4dbca49d03e525d24c7fef8ba957c5900be62924","first_seen":"2026-03-06T23:21:25.911739Z","last_seen":"2026-03-14T17:37:57.705965Z","times_seen":6,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":76,"dns":44,"connect":3,"send":0,"wait":10,"receive":30,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/css/styles.css","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /css/styles.css HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 615032\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"styles.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"af1edca9cf74afc85377b241f20382d6\"\r\nlast-modified: Fri, 27 Feb 2026 20:30:24 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256499-ae610652b6cf\r\ncontent-length: 6146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30164,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"43bc81403ee5c317a63bfe74c18fea13","sha1":"b65ffe8c0b58462b9a957ecceaf3d69c61e5389f","sha256":"d90922f1b8119122ab989950e1493e4d7c51da698d98c7f7284250ca9aff78f0","sha512":"7f7be7a3f31e276ac087dd1994b1a2fbbfd8e67de0b5c42a96f954201c009cac0fd4d2d352be25a5c0bf4cc4869e6010c1f20ddf3d53d15efedf9c5d3df118bf","ssdeep":"192:7IIu7/SLhqaPoYrYr4z0vb6/wiTL0JChUSCJbHM7eNuPOPHSNzHHoRcP0sVXBqbi:k4wkdAdkL3eQvVfvOa4/wxXd55","tlshash":"59d2434a9a730551785bd9587ffb9b89231cc003cd0ede2d7fcd62488f892a8a561f8d","first_seen":"2026-01-28T11:39:41.382249Z","last_seen":"2026-03-14T17:37:57.713387Z","times_seen":8,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/assets/eleven.js","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /assets/eleven.js HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12398\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"eleven.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"d6e77e7dd3381b2f8be0a380ef76ee66\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:17 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::tqhzz-1772839256501-6e6143135841\r\ncontent-length: 2492045\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":7750437,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3da65c187a23f1a6d8d51f23810b2ae0","sha1":"7061de0e6f09d4ed1a69c2a3209b6501c9904c8f","sha256":"8ee5c7ae26904c3aac81c5de792f3a8e3a6de0d3b9037d31e91c8a033338e6bd","sha512":"62c139e3938c8faed7c50044eab73b4297ea13cb408631533db5bdfd20a7b00235f2683cff5f766ce61e94131f7f8ff82a14baf45051b37e4a2c46b895d6d3e0","ssdeep":"24576:428tHPYfbu7W152TlNJvleNRlPpg+8r/QR2OFnniOflYTwrJfowV7HJ8X36r5lD6:42I9tkpPpg+8r/QR2OFnniOflYTwrJfW","tlshash":"0d25f8ce2d99e56e015239b73d27209be06edc08715ccae0fb99bc34f85831d58b7a58","first_seen":"2026-02-09T00:41:26.532086Z","last_seen":"2026-04-30T11:04:05.824262Z","times_seen":134,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/logo/trust-full.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/logo/trust-full.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12404\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"trust-full.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"883ec26a24ffdf4cb83258ffbafca2c2\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:11 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::24tjn-1772839256503-984c8c03e1b2\r\ncontent-length: 1195\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2545,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"883ec26a24ffdf4cb83258ffbafca2c2","sha1":"0ce46c6de4809d930e919e8426f82af97689b2ab","sha256":"e6d1938640a96fffd5484ea7ced27bd740de21aef414793c866c4ee9cf4a194a","sha512":"c8fce1e31c8289c8475d47426a684dea3be170eaeceb2950f49b49498431b570313c1205d8f107d8aa909ff6c15f50a7d760be937c1505e21086be58370af518","ssdeep":"","tlshash":"df51a55ebb1896a9888487aee2878d793379d0d3f817c550e318de0f148c067ad4ebc2","first_seen":"2026-01-28T11:39:41.383141Z","last_seen":"2026-07-31T14:13:47.061324Z","times_seen":36,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwallet.receipts.sh/images/icons/benefit3.svg","fqdn":"trustwallet.receipts.sh","domain":"receipts.sh","tld":"sh"},"ip":{"addr":"64.29.17.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwallet.receipts.sh/","date":"2026-03-06T23:20:56.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.receipts.sh","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 22:41:32 GMT","end":"Sat, 23 May 2026 22:41:31 GMT"},"fingerprint":{"sha1":"BA:44:35:5F:0A:52:68:A3:BF:98:7F:22:50:AD:9C:66:32:EB:98:D1","sha256":"7B:4A:A1:7A:A6:FD:7B:5F:0E:F7:1C:91:1A:34:2D:D5:18:9C:8D:C7:E1:C1:07:54:EF:7A:C6:AC:6B:58:11:CB"}}},"request":{"raw":"GET /images/icons/benefit3.svg HTTP/1.1\r\nHost: trustwallet.receipts.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwallet.receipts.sh/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 12402\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"benefit3.svg\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Fri, 06 Mar 2026 23:20:56 GMT\r\netag: \"c210d79d224dc0acca1c3beeb029195b\"\r\nlast-modified: Fri, 06 Mar 2026 19:54:14 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::mfzzp-1772839256508-1ee851a06e81\r\ncontent-length: 1216\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4645,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c210d79d224dc0acca1c3beeb029195b","sha1":"75894cf8e5d238f788bd1d0fb258dac88c5b0126","sha256":"d1207a3591df9b2c69e8f08c29200283571c5744774d8e008aa3835957652a58","sha512":"d82594ace6a3cc531d7430a0d55cde548f4273f2ff170b51a93fa1c980baf3cce40bac295cdbfa444827666d7f8276860b854eaa4dd91bcbab07b277be2af6bd","ssdeep":"48:HRryHV/3wZy0xVsTtmv4jb3bU9UN6Zjamv4jbo6H9kMndH9XHO8laGH9XHO8eH9T:HdOAZrVsTsv2brHM1jv2bx1PL09EXud","tlshash":"86a176eafb2c9cbfe82787bccb48e1f5504d61d664c08368c2799f1e51046cb591aec0","first_seen":"2024-12-07T17:47:59.744392Z","last_seen":"2026-08-06T11:27:12.901682Z","times_seen":928,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"trustwallet.receipts.sh","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}