{"report_id":"70dd370b-5044-4669-98a9-c4e3d46a7573","version":6,"status":"done","tags":[],"date":"2026-02-06T21:42:30Z","url":{"schema":"https","addr":"tes1.xarvok.top/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"172.67.140.48","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"tes1.xarvok.top/a/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"title":"Telegra","dom":{"size":5195,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1533)","md5":"21fe77d9fe2febbb2cf686032bb163bf","sha1":"a2c03a9a80b51935eb03bb5907bec667ae9bf039","sha256":"12b643eb51f64b356c3944c20c623738290c51252d7ab2efe2da70ddcd552677","sha512":"dab0aca36053e3ae21c5c78c1ae2da07a411ede68383e0653bdfd296077f48f289085995bbd241fbd08cda9672529bf77e8f805361a36ef7212d909eb72a7cd8","ssdeep":"96:RuPAhJ0yDHLWYqWM0iIt4y0tP3p08tzQGC9LBUH/b5CnSq22aAooCwuOvXJQxF+f:o2J0yDHLWYqWM0ii4y0tP3p08tzQzLBd","tlshash":"f0b16563aa94dc0f63994727b9a6f0ccd0a5c809c5987d07f268b49f44e0f96d6f3178","dom_hash":"domhash28870de402f9ba3161934fc4b2478542","first_seen":"2026-02-06T21:11:04.289244Z","last_seen":"2026-02-23T14:41:20.114749Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tes1.xarvok.top/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"172.67.140.48","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-13T21:42:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tes1.xarvok.top","ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-26","domain_rank":0,"first_seen":"2026-02-06T21:10:59.425289Z","last_seen":"2026-02-06T21:10:59.425289Z","alert_count":76,"request_count":36,"received_data":2203429,"sent_data":28175,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tes1.xarvok.top/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"134d54a83bd23eff7a6b46e0cb2d75d7","sha1":"7266b11cf049bf5ebbda9f69b6fac07192b3ae21","sha256":"aba43a6b05deb96d45b7cb4a5144887a9451e3f5dae5c8a0939b21727db7e9e6","sha512":"73c27c9f6e29e0ec2c408e2170c11bf0cc764b8ffb004a0ca29b3ed0bacb158f9a208fe09410c6d4feec2ec8587144db7ccf58678bdf40cebe2704b936063989","ssdeep":"384:uC15kQNaJpomt9G5VlafPNDYfwy6yRjzrgwmH41eh:5sQe9AHafdc6Bnh","tlshash":"9f92a6cf7ceaf67592f6752100afbcc9f19b2f5424247908c321b9e4b57434499a2dac","size":19968,"data":"","first_seen":"2026-02-06T20:43:51.922298Z","last_seen":"2026-02-06T21:42:32.567317Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/compatTest.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4520c8645b038c6e4415accbe5feaf5b","sha1":"dd604fcf7bba761b6a4a6e4e78436fb7588686e9","sha256":"9d0c5cec3807e72bceee93b0a85221c315da0212cbe2b7fed2b6860760a26c77","sha512":"a491233b7cdb0eca65dd2348d6bdc951f286f0d8692a7497e744633fd08d1562755f50f3f468ce271e9152defa4baffac87c442c77dbe1814976d7987bbeeb85","ssdeep":"96:NyI7IV56aD3xXxz1CzYLya2aHHh3zRtzG6aD32IBzEzjDU3BlZImaH1fxae95aeg:NyI7I7643FhmFxQlbG6432IxmfU3qm2+","tlshash":"1db16cf553b00ebe9d328a04fd397c48d8f855a507cfe08ab6037d48dab6ac653a0365","size":5486,"data":"","first_seen":"2026-01-24T00:52:49.50511Z","last_seen":"2026-02-25T16:33:01.808544Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/6708.3f91e6e80ce12129988d.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cb3499e04194c102a58ed4edfe17402","sha1":"a8f4fdbde9e3519ba5b6cb861bbecef064a7784a","sha256":"69d0fcea5d2dfea7462f348ce2fdb7556deb739890017b3a9d8c61e74ae50aa9","sha512":"147f233a3a236da4cb8bc7740eecf108e14d4316c01f22850a50e2ba9150395c9bab533c28bed7908d9f50c10f2d8686edd280904c37c230ad50ea43843a00bc","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ1W:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ1W","tlshash":"8312da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","size":9237,"data":"","first_seen":"2025-08-09T12:19:04.058547Z","last_seen":"2026-07-16T16:02:47.632323Z","times_seen":149,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/route.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c26d4bcfd34069af511e84a453e99fd","sha1":"c48b48168136751af41ba026c497725440e7fb59","sha256":"0e33b841972fe710a30a96b125418b3225eb51967d233517d26bd899dffc3366","sha512":"d82673e20d405a658e63ad25cdfe49353b988f5a7004370eb893300f305ed197a82965fc97c7168bdd3ffbf2f199277bf74eb9ad8d20c09893fbf0ca0e56d51e","ssdeep":"","tlshash":"ed0185f853321c6e84727618be792c49ddf428c60bd7800b51477d88da65ac18b82a69","size":836,"data":"","first_seen":"2026-02-06T21:11:04.315403Z","last_seen":"2026-02-23T14:41:20.13074Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ae6076d5cb8f50019a1ab4477767a277","sha1":"bd04c5930f909bd24543d3931054fe219badf944","sha256":"28865476b71002fbc8519418da3fd06a125346740b54b9550ef1c8b8b36484a1","sha512":"8fd1bcc48956f27c635bc5db9e4e4e4b80f88b78dc5ddb3a6ad5ea0f1d10d41ad8efd851bf367e764461c17722d3c004635d0448c9c9594cd8e0cb02eb5e2ea2","ssdeep":"","tlshash":"04f05cfcf2713e9d8d325214bd361648ccfb258447cec085a02374c8ed3818e5ba1166","size":500,"data":"","first_seen":"2026-02-06T21:11:04.317875Z","last_seen":"2026-02-23T14:41:20.134802Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/a/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3303d9385dd1dc2f15bc2ec66252007a","sha1":"799054b2339ada12f80d5592aa6603e3bf5f5f3b","sha256":"7e12bab6585415519136927796b3cd5d97371ccb8dae300f574ee8099028f252","sha512":"0a241c3c8ae72a15df92efed9e8c5f460269914dff9cf8744677081a3338aa2575b78fc7a585afbb2ef90a09cb0e0315f73b031389132dc52cb111967b4374d8","ssdeep":"","tlshash":"4f31926772f2ec0f17dd0b23b90725cef4f94866c589aa0bb328b88950f464aeb44535","size":1535,"data":"","first_seen":"2026-01-24T00:52:49.515837Z","last_seen":"2026-02-25T16:33:01.815017Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/redirect.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a3a340493275e724dd0f36c976851f8d","sha1":"98947a9463ca5793c01e2e963b884464e363c621","sha256":"91a712c3e6b1a657f97eb33b00166314e4297e30293be652dcd561faa3d73c9c","sha512":"e9dec4d8c834223287fa880c52c559c5e77ed96bc7c25e569523623ff99c54ecbe9a57e740735803ecb169bec7d69465e671e9dc943357d936a74dd7d543d648","ssdeep":"","tlshash":"be1186e053b45faead760205fc35bd5d48f8699647cf909de1037d44c9717d96390320","size":1093,"data":"","first_seen":"2026-01-24T00:52:49.497157Z","last_seen":"2026-02-25T16:33:01.810429Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/main.ad7daceb20639047fac8.js?t=7","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ba880983193c074ec0661726677a391","sha1":"e3796022fb73db59e6f5189243741681cf187ef6","sha256":"e745ed262129e181eead91caa5a66589740b30936ea489265dfaa05b7a2195cf","sha512":"a4ee794b74f5b7d652ed6a6ae029b9c3ab60fa59ba30c3da23d2e51f4a0850913cf52cb6ba9adef23b84ada4f10fefa8b83e963933e20c67130c923cb04a3335","ssdeep":"6144:EbMxkD/FR2BKG8U+fpB/mc8Er7SjIpRFjcXyIcAmhTCZGfnjrDPIPXvNioY0:EF0lyKeSI2d9","tlshash":"0215634672f231394207f0795a5fcd1972356a0b2a88ec593a4ca2511f8a57cebf6fcc","size":933753,"data":"","first_seen":"2026-01-24T00:52:49.491275Z","last_seen":"2026-02-25T16:33:01.81196Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"43d9ec64fd81a542908cb909c8cfcc4f","sha1":"b951ec71aaa9907002638bb490bae821b14e4a7e","sha256":"364a54afce4179d1fd618a1471e83716fc9a7016874b2c5ffedcb369ac054e50","sha512":"5ac6f2e6f8fdf156542c2a52ef6b7c3c464aeaf851ddd5a369bf3e32882b561ee7db7b598f129d600b4a24a1aefc77310c8a03d0c7723725306e7ccba64ef6a9","ssdeep":"","tlshash":"dd1104753a165534d6c5418b31bee7a83d3250617a029084c26ccc355d18d8714dfcbe","size":902,"data":"","first_seen":"2026-02-06T21:42:32.578309Z","last_seen":"2026-02-06T21:42:32.578309Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b065beae48d8c319b969d8caab001a9","sha1":"88711d71fbf9793d0728b0778a55406c8d7677cd","sha256":"8c908d72e8c47111253289d1731f2cde0017e202a9a38340cfe06f2592d61b2d","sha512":"23749ea56e523e80569c75e66844a20f07c6b12397d3c2ecb0b53a95465b221c5eaee7b318ef5cc7e1f2c17eac5292b41e1eeaeace1f2da2378a616ab797ee4d","ssdeep":"","tlshash":"6ad023d51877c430b6d9028e10f7e398656021d077155680c1dccd3b7e31dd344f1d58","size":217,"data":"","first_seen":"2026-02-06T21:42:32.579126Z","last_seen":"2026-02-06T21:42:32.579126Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.873Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-10037\"\r\nexpires: Sat, 07 Feb 2026 09:10:49 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P3sxVMdqobigfnuwXcvc%2FpE%2BHw6RtF1eY%2FgQe8wXGCew4vz7m219KFqZ9E%2Bt0ACIxn5SZ8z7a4tbVkJ8J8JSIBb1wTNc9EbB494EVsQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd3bbbb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-14T23:44:34.605345Z","times_seen":15258,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/route.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/","date":"2026-02-06T21:42:09.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /route.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:09 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=15552000; preload\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Sat, 07 Feb 2026 09:10:38 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: br\r\nage: 1891\r\ncf-cache-status: HIT\r\netag: W/\"6953ae92-344\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a53tpklk%2FnKQL2BoUi3RKQXzXpQpsN8NYShurjHB%2B1kLGBktgPp%2BVm8BpBBPbHOf0HcTXv9UzTWsnEwYG7YAA4T2YNGQ1w23tu%2BJtUU%3D\"}]}\r\ncf-ray: 9c9dd0d78936b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":836,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (836), with no line terminators","md5":"7c26d4bcfd34069af511e84a453e99fd","sha1":"c48b48168136751af41ba026c497725440e7fb59","sha256":"0e33b841972fe710a30a96b125418b3225eb51967d233517d26bd899dffc3366","sha512":"d82673e20d405a658e63ad25cdfe49353b988f5a7004370eb893300f305ed197a82965fc97c7168bdd3ffbf2f199277bf74eb9ad8d20c09893fbf0ca0e56d51e","ssdeep":"","tlshash":"ed0185f853321c6e84727618be792c49ddf428c60bd7800b51477d88da65ac18b82a69","first_seen":"2026-02-06T21:11:04.315403Z","last_seen":"2026-02-23T14:41:20.13074Z","times_seen":3,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:15.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:10:46 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oS8ieZupYxjze682NsObEZTC67a70kathmSKKxhmYD8jI7jTrGUYre6GnbqX2aeXryZVnFSlIeRvxdtBtDvMz%2BRL6KSGY8MXQinflzM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fc8ba3b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/5905.04b286b6eff2126d05dc.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1887\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=txQjB1xh3w%2F%2FwAT8vpULEGqxUyrtZ%2FJ%2F2wqDB0bRUYBJdwo%2F9JvzD3hX3wyTY0x3boPobY9SGKG1yijZn12n2hWVlNo5ChcRE4re680%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcdba9b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T21:42:08.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 06 Feb 2026 21:42:09 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15552000; preload\r\nset-cookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; Max-Age=86400; httponly; path=/\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H%2BxlbRlvFO%2BjRaqGdrxqu%2BBFJdAwcrAoVBvfc4bI1EBdRHtXFQkCXsgWUWxKbPB3vVHb7%2BAEHdBH7SGbgsOE6gxnyO%2FZQNLu0uoaUfN7OA%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c9dd0d26d76b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4756,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (926)","md5":"86bddb433d8e64b890b1530473630d38","sha1":"d16c41e5e7885bc7a7bf4061155fa55cf7bf252c","sha256":"6b715a543d6b52d5db9cc01f34278660e2330408758f72edba599e12c66bad9a","sha512":"2fefb179fca1040a429180ad45de4b4ddbc087b898f5ffb8bb64734390dd8c7f04c890efbb23abf4440f82ee75d0f7be0134e8f99ac87a72db9936db182e776d","ssdeep":"96:vrey09tn0uK0et1A5QiLZYUE9LidWo63YivOOYX0bETDYHon1UmLnx/IR:vrey09tn0uKdti5Qi1YUE9LidWo63YiN","tlshash":"f1a186aaaa129014967281006f7ae3187575d043d34bc884b7dfb69ccf85ec9d6e3b2c","first_seen":"2026-02-06T21:42:32.565792Z","last_seen":"2026-02-06T21:42:32.565792Z","times_seen":1,"resource_available":false,"data":null}},"time_used":807,"timings":{"blocked":71,"dns":55,"connect":1,"send":0,"wait":662,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/","date":"2026-02-06T21:42:09.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\ndate: Fri, 06 Feb 2026 21:42:09 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: 9c9dd0d7f93bb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19968,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T04:12:33.851907Z","times_seen":17929621,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/","date":"2026-02-06T21:42:09.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js? HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ndate: Fri, 06 Feb 2026 21:42:09 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: 9c9dd0d8193db4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19968,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19968), with no line terminators","md5":"134d54a83bd23eff7a6b46e0cb2d75d7","sha1":"7266b11cf049bf5ebbda9f69b6fac07192b3ae21","sha256":"aba43a6b05deb96d45b7cb4a5144887a9451e3f5dae5c8a0939b21727db7e9e6","sha512":"73c27c9f6e29e0ec2c408e2170c11bf0cc764b8ffb004a0ca29b3ed0bacb158f9a208fe09410c6d4feec2ec8587144db7ccf58678bdf40cebe2704b936063989","ssdeep":"384:uC15kQNaJpomt9G5VlafPNDYfwy6yRjzrgwmH41eh:5sQe9AHafdc6Bnh","tlshash":"9f92a6cf7ceaf67592f6752100afbcc9f19b2f5424247908c321b9e4b57434499a2dac","first_seen":"2026-02-06T20:43:51.922298Z","last_seen":"2026-02-06T21:42:32.567317Z","times_seen":5,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:15.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:10:46 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=73rvCBrZH7cZ3%2BYXKzs%2FxYuDMa4cAP02BFyxQy1SHMOhWlLYuqzlZCHOnoSEkTTNa5jFoKK%2BSKFGMNnnUxs0sPMyiTFxfHRw%2FTCRZ64%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fc7ba1b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/7784.2a486dcaaaf47415a095.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-5268\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LpB0rw2eSRoaVR4LlE4T29HqtLr4gbhaTAhIyJM67M3Zuq9bejcXHmWhVkusE8%2FNOEwB696%2BKOFhSP4aIFTvlRqG3Hkf4qME%2BwQ4EnI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcaba5b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/7784.2a486dcaaaf47415a095.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-5268\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D7HZ9Rxoc5Eq25ubCC5A%2FjBdTg3Bh9oOgL4fTz4jpdv0u9%2F8AIfipWqxC8WHNPSuM%2BQp2tfbuy0qeOIVaqQEvm4QspdekiHlp04vH6g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcaba7b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/a/","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T21:42:11.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /a/ HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=1,i=?0\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NL9HtkUl0G0L2%2FTrV8j5bdRYddEvZxTgx%2FBTqlMf3XeAkcR1yD3lHYAnCES4FThjbyzS8dZwQMzdDB3UITIiIPYjZ3BAU3CDAGwtB5w%3D\"}]}\r\ncf-ray: 9c9dd0e40a15b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5147,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1533)","md5":"7ce6ec43b10e235fdd883e8aa0ca4481","sha1":"c3afb352ea61d5eb10ec4378a6c5d0116b587dfa","sha256":"12e511027b5bf0767ad3a3007cc2e69d12259b0817917191616887dbb3ab61d7","sha512":"6161b8cc779beacdedd7205c1d573c35b85581c56e8cab98f0979b434b24e5dc93d2e2fe29b498e30b3e4fbd81c10681e89cc82b659b5d813c5e99eef5ae81e8","ssdeep":"96:3PJ0yDHLWYqWM0iIt4y0tP3p08tzQGC9LBUH/b5CnSq22aAooCwuOvXJQxaf++tH:fJ0yDHLWYqWM0ii4y0tP3p08tzQzLBUU","tlshash":"dab16463aa94dc0f13a94727b9a6f0ccd0a5c809c5987d07f268b49f44e1f96e6e3178","first_seen":"2026-02-01T01:56:59.622433Z","last_seen":"2026-02-23T14:41:20.123049Z","times_seen":4,"resource_available":false,"data":null}},"time_used":652,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":652,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/compatTest.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /compatTest.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-156e\"\r\nexpires: Sat, 07 Feb 2026 09:10:40 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1891\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BgAJt50DloSARUH5gjRAnI7%2Fqb%2BSIxgTZzO6ClzwcvyuwRmqRhDI7pN5xXSSVqfqq0WdOIC4DV24FEz0YCRPbvloYbVrSxGrvPuVxp8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0e86a46b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5486,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5486), with no line terminators","md5":"4520c8645b038c6e4415accbe5feaf5b","sha1":"dd604fcf7bba761b6a4a6e4e78436fb7588686e9","sha256":"9d0c5cec3807e72bceee93b0a85221c315da0212cbe2b7fed2b6860760a26c77","sha512":"a491233b7cdb0eca65dd2348d6bdc951f286f0d8692a7497e744633fd08d1562755f50f3f468ce271e9152defa4baffac87c442c77dbe1814976d7987bbeeb85","ssdeep":"96:NyI7IV56aD3xXxz1CzYLya2aHHh3zRtzG6aD32IBzEzjDU3BlZImaH1fxae95aeg:NyI7I7643FhmFxQlbG6432IxmfU3qm2+","tlshash":"1db16cf553b00ebe9d328a04fd397c48d8f855a507cfe08ab6037d48dab6ac653a0365","first_seen":"2026-01-24T00:52:49.50511Z","last_seen":"2026-02-25T16:33:01.808544Z","times_seen":6,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://tes1.xarvok.top/main.c2527ac16c33f0e1edc5.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11016\r\nlast-modified: Thu, 18 Dec 2025 15:15:36 GMT\r\npriority: u=4,i=?0\r\netag: \"69441a98-2b08\"\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\naccept-ranges: bytes\r\nage: 1889\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K%2BsydhutZAOwFJKBs3NZcdtGCd%2BdtK46yu28L4YubsVeqxg4DRFdF0O9lktBHiB7%2FnARtQA8hPlzvk9e7cAwkgVXX3hh3%2FZzId7D8uI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=15552000; preload\r\ncf-ray: 9c9dd0e98a50b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11016,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-08-16T20:11:57.192066Z","times_seen":34573,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/icon-192x192.png","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.784Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /icon-192x192.png HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Dec 2025 15:15:29 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=6,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"69441a91-bf3\"\r\nexpires: Sun, 08 Mar 2026 21:10:43 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eWikYNpNTIJOgdRhTob4krKQtge%2BD1ZreJRqLowoZKDrvSsxi%2Bnbg9ACSxIU2P50KbR2S330GRwWCk6GMQyJSjM1PwuaBNTdEjGqeBE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0e9ea56b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"1a1650d2c76bfc1ac484646c19e495b9","sha1":"fe58d66042ce9241226f5da9370230285ff604fc","sha256":"6e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8","sha512":"79c5c9278959bc94f66434779bebc1b46c055655f0bc58aa375f179c227e7ac0e52dea196764719d42aadcf98e4fd3b5a4488f2db977edde430aa3df733c03bc","ssdeep":"","tlshash":"bd514cd3253318e8e2dbfd7ace62041f656691ce5638ec120568de720c8985dc070caa","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-14T23:44:34.426524Z","times_seen":16539,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/6708.3f91e6e80ce12129988d.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:15.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /6708.3f91e6e80ce12129988d.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-2415\"\r\nexpires: Sat, 07 Feb 2026 09:10:45 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KfpRqzae%2BtAO6gvyuOvA72MrimzHY3x17DNb3AgyO2D%2B9NwBRCE%2BwDXlLrcYnDF6ohBhWiI8aac1EGDZxPwBOurwTnGbo7DBCtCRBNQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fc4b9fb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9237,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9183)","md5":"2cb3499e04194c102a58ed4edfe17402","sha1":"a8f4fdbde9e3519ba5b6cb861bbecef064a7784a","sha256":"69d0fcea5d2dfea7462f348ce2fdb7556deb739890017b3a9d8c61e74ae50aa9","sha512":"147f233a3a236da4cb8bc7740eecf108e14d4316c01f22850a50e2ba9150395c9bab533c28bed7908d9f50c10f2d8686edd280904c37c230ad50ea43843a00bc","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ1W:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ1W","tlshash":"8312da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","first_seen":"2025-08-09T12:19:04.058547Z","last_seen":"2026-07-16T16:02:47.632323Z","times_seen":149,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:15.752Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:10:46 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9duL8nNVhRU6IXoKa%2BLk6HCpYCjbMjxWVYcSA70PwhEibi0ZVRKSNxswCnaelw1%2F%2Bi3QzHK%2FmefgaGOw%2BSYmkSBB1VdeaFg9ne91f4Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fc7ba0b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-10037\"\r\nexpires: Sat, 07 Feb 2026 09:10:49 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JIwsuF7H1c%2F4u9vq7tiLql8QL%2FLcmC6UjYWQJdO9zR6271Tdg8UH4wZF2oFZtUK6Qe1LHcGhE%2B0dnJ1Z6NAoK1cAl78em9ZpGgGsYbo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd2bb7b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-14T23:44:34.605345Z","times_seen":15258,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-10037\"\r\nexpires: Sat, 07 Feb 2026 09:10:49 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zeFDHUnmFeC4jLbif%2B2%2BgTnxKdfTSNSoC3qQiPCk2%2B7Ns3lU%2FPlOaqM6g%2BFfRrFU8bVcbB4EtWxRgibgInALIAUJykxfFNkSaKxAsMg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd2bbab4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-14T23:44:34.605345Z","times_seen":15258,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/favicon.svg","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: image/svg+xml\r\nstrict-transport-security: max-age=15552000; preload\r\nlast-modified: Thu, 18 Dec 2025 15:15:29 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: br\r\nage: 1889\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"69441a91-37c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FXHWRvaaYGHvQpNZvtKqg%2BkdkXCPaDhGz5byItqYy43tgApW1lbQjlIhUjEkIrdhjnBdNbovY6zft8P5swBjV8slGUU36uBtRZOKOIY%3D\"}]}\r\ncf-ray: 9c9dd0e9ea57b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":892,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d9ee2d4b0edd9f8ba2fb7242162c2c47","sha1":"398522893cf2cdefb5176f11bc67eab31c2d7382","sha256":"a462f1c5333e16b48335054493cfd1d0a13a96847b4b9ffe2cf24403e6e86010","sha512":"e404678e96fe6f6d1fe6c1390e4a64d90844a2d8903f84f1a34b23137593da5ba04112d9504b8bf480b392b294830a363344c5767e3bb5b7a3cb6f5df2a3aa45","ssdeep":"","tlshash":"97114493d060e71ad4c9e16bef61fca0116720cee5b745d485d95a34500fcdbfc08668","first_seen":"2023-05-09T00:01:39Z","last_seen":"2026-08-14T23:44:34.409874Z","times_seen":15706,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/cdn-cgi/challenge-platform/h/b/jsd/oneshot/d251aa49a8a3/0.48890182664247517:1770409953:x9-MFHxDW_46d73ZlQJr7yHmpXwTltkWF-cUFFDqHZY/9c9dd0d26d76b28a","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tes1.xarvok.top/","date":"2026-02-06T21:42:10.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/b/jsd/oneshot/d251aa49a8a3/0.48890182664247517:1770409953:x9-MFHxDW_46d73ZlQJr7yHmpXwTltkWF-cUFFDqHZY/9c9dd0d26d76b28a HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12149\r\nOrigin: https://tes1.xarvok.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12149,"data":"JAWYGmfgPwsjj8M8jVSPMPg8p08k8dY0lZYPq8yYXMPLMtlLQ8$YJMYht838II8qpIg8ncPv38wkafU714WfXE15W8Bzz8yZ8O7Tdw8lveFjZC1t6q08hH65qBnmAZ8NWKuucZgZbMS2lg88VB3EVyZWflXilyG689XcP8BysNwzNUv10AT10a8ftyXTF9XzM8dSQ304-aM3aNuyNg8dHz8Pb8NEJG8q5qQ72ZJ2hxc7KPwLkACCag8dIN88bTTG7dQxvv8sURlgo2gEc8fSUFwP0Z8dVgpqVZdy08JOl60RXL1ndg8P5NwqAIfwzvOyOALfS8ddgPWR7Uc8fTqTw3WY-elNeFN083Ez8e4jy08PzZAekWtyf085N6LG66cmuShlSh0R6xz175hPGnOwTPXztz146cpeLWW8YL5-ia3Y8TzvPY70VtA00ShvVr0wQtjH7V7KbUR$k08gydW88F3GHUG8uiPNNGSYkZmm5z1Eixu-axFep2eLBzBNg$oqgFRx-8qWy9GlP1R0CvvAY8PjJHsFzNxwJSgTTL6PwT-2$zM8kf7g5vNhNSK8kgg9QBWkVvRpbNkxiz2ZGWFRGZ835VyxnprH2U3pVXVb3Du0bC0NFjRi8OQmSyKIxNg0ytiSTL7DmCZBNZeB2AJibQ1MKdUbQhfCwDfr$i2wrPRvj9COlmlbYcI-mIXj968p8zCrNgsFsESDcEWPBNdX0lyNdJGBrgbUGeeSWC4BQlv3s0HR8r5xIufd3miBU0R$W$76O9fN0WdZ8egv1010ve0pTP0vGilqXf8Vf$nbps8N6EegB6iFZ8$B6VwBGfj36ifBkdK701yyf2w82TwXTzqA-Ag8MemBP2XZB00NcA70NYvsAkTPfp0WrfpBYAtAZTFTPNYTs8xMyP0WZVICPZLs8emy0T1lARwtf1TTSTyfmLzBsPwfxvD0y68fxFVL-1dCJU0Z5dhwfdsPAnrm3Zz5qASYBspRGzmp-TMoI8Ng0vWyLep0yRLhUzDQ0B2pIv816jNEffQvpp6QcszmNzST2dcydzqzbN-U2v0QovBobiwWGaUPBoiIPDGxuh-Q3X0I0BqUBY5eDsiJoO1Y5em6FXLfpTC12kW9vqaUzsOUp80$2PPjf3TSq00S0Ef-dWgZOePoiuiTTqtnyHqB0vzqMMI1TLsOXzvPiZTNsT066qMJlgf1j7rtfN72$QUk30UZYc0TEmxnwgT$wpiT$XWZqcezwvys0LvtjWpRABIK6jvhgBPPxZyln01i4gjGEgfwW7U9v5Ars8nGVn8SQEjhXMciIkYcsOpQus8ZTstm-M58y1ZGeVKWimjIZU5mI0iubuyG81OdOLmb3c0iDhMK5kYTstw8iINThgsINTrd4QYBP15hBq69K-dBtf-LbYcBqfryWNRJOZelu6mfc9EPPMZyObd781EV9y17V5KDbKHusM7TuvsPqxgqfuTGsVJAdloDZSRR$xH6C$x25I$x15ATZlRUp12r5Y$iDQo2ZPQglolXLr498vDdfwfDSB9lDBe5asClC-rv88fubgfymSXbSfHbB8Z3Sq8wjNf8q9V97Kqv3A5sWGFLA$RmPj0YP$uUMfxPc001ck7086crfGsuIMERGfdmH--70SLIj8f2C8y8jywGVxZGZ2fq6ceZVYGfv0vPUnH$35SU6v00e45vaIqKQcaoZDTNbefPq6zZ$N3fVA-J1L15WTfyfcXD0MVZhjBffEQiLyhdY9fgP2Ub3-icsh$Pj56sgWYCe8T-IAH6y5LMR8Upu96jQ87OETPMnclylilqgPKE8V1Myy1cs0L1y1tK1GTfZL2s54KQX-GV3ZBfjvQ18WSu1Q8-tSJhqcVVuZRG3OFiPe1gyP7If00jw86a$M4Gm1tE86V1BSe2QZZ1wWzMlFmW031PNcPgqftB9-VBM7lP10lezLIPs-ehNMgU4wvfP8wjlRLLjEWAq31MdUh$xoOEmL5N2uybflPBjU4nqBLfXsORtHnSMxMHfDN8f0oMtBSfyeVEpWY9ToN2ISY8VmWxZb5PI-vNHd5QlB8YENwwCG-ZSK7dVLnM0leVCYyeWzWBR4$P730J1mmT$s-Pv7-e$GQ9J0AvqnLBJvV-B8WTauPf2cYK2tq3QX3QsBjT8jh0N3Sdz8fRRF-Ub-2owUQITTSiS7mP4jSG7vuWktdW1OI9I6WLTFWdfbJ5wN3fpvvbSzZ0NMINrIaFGMUIhsZZYk6jyx1A9SKIoV$Q4CV8qTQejFshqBTbancozfJcnE0N5cJgQ825HPLx14fhiwfeh6AApW7fzIUgAlIYUFYH-o-QJEzc8xC0RzI0NFUMo1czpqvWYl82sX7Rrz385ESFP3qVAlcM4vuR$tw5cYY5wQnyzzHj5LYqNlkv-Y5YxMj0v9v22LortUYLQwbNksf8HQTxs08X6-TLi8wW8lF8wAbOB9Sv$WTvElsMBnGQYsd5kXsppRRgW5d8juZmzlIT3WRPoEOvL4fTMW6OylW0I-2iIEeQ-rHYkNkt60XwNYS-pVAdC9nw8Sn$kx60wxC8QKMSvPjzZRzFFeq0qC9-amMfBmaZQLqCTrsrf8oCNy4q551R$3hy6lOkwU4822Z8yRTijj$W8n0cIA5eZdzW$IrLQu5x0ZGDYu1SGP-xWhWR0slyTVVxnmIAp3TAXvfeTY$f84IMzkJIU1qAflJvD-opaegGCZyJ$hIltPUZwWOhYE221Wn9hlBO4cmKy622rKrPqZSScgBEqg8W2ypT-zZTqeICUDA9A8aYRHYLv0wa557sz1l79xMjo3m7dloq2vekvqyn69YMqZY4o1UqscKnU5FwYP$nSdYfyC7n$zY4G4X0CmV$9N-jDdb1E4XzwSlYxvgUbR$uWSAZF6s-8A9A$GUCPIhgc-FkpD$PKwfGm3nHwJcOGP0PcXBIj8BmsD8MqopFEP2PtclAQxZimb1yPbC2zz4troBZlO5gU0ZbN0sFqcyTzXZVxrw5JMfYp28m0cE8$bo735LRFXG48e7f$59lLeavSv4X2kiKeg75frCTmWnp2YTtfcjCvP17qwRwKm1yOcDObjKjMiVE86NTI4jjP6ciK4-vNoFezq07VnS3O06HaIZzyIiGn$VtLvbppuP0W0722XvXDQFRwD4dFz0tUfZF0ZR52RzF1IqbyktQe8-55fVQhqzIowhxlyYAtoH9mMQJjFs7zIhqUPDHaU7-wvfNVUxvdJwLbUdQXzQrBsx87vFhtZNLZ8l9tzQbNGyl4uqPLW2iDYFsAz2pv7vicFXlaqaL6B-7C9WHo4Mk-Ijq8m8eOgvvApYCkBuSgVIr9cBP$YFgiIlNrpxpU06JZ387R4-iMQV7QzCgEE30oeC38VaCoyjitZm70nwP4tWMq74JSqqJO8J8cQ6VyPbrgQ08WGnkFX9qGJQExpyn9quR01kJa3BNc3DsQwqpdNYdmpXpRqaMEJQ0cdm5adYnOp49I5jpoyBx9BiEI0XNQsgpBRkSYyq3ZgYg0PBWz1$1sgoEUpo0LnA5AesXsPYbQyoBtPsM8D-SkEo0pPIzIRzgM0pgLG6BUsRSoNx0sBUJAyrx2dhZ6gfz8U9R0ncnYB7gJJXJId0q5355TPY$dgydCn-JCyMZYpOPWecg0NXevPuE5ydxZXYsvWzBYb$3BXsG8YZvRP8HuRYD8TBnySkN9EZIUsnNMEzxo9ZFhgaBXJGPv10BuRygNqe31ZzNOpXXwPHGmSVpXp0WnBYdzfFprpvRrGeg$eHENSQfe35saM6Jvf0pExx0XzQz91CBcmKwXn8UdPcjYlxZYfZO0yBZQRwzWTXwXRUiKxMb41mJWpvBY980MFnyWFBZi5jBcKciHXct8JTpS1ypsN5ztzUtEpcK-sg5A3iRzeTk4JA5kgMuDeE1OdOGY5rGuzJBr9n$Inpd6NdNMp9PFR9S2N01YRGpvGGSX313SxIqAb$EU1Zf7k8KGRY$Gsunmd$fC5MIUZoP0osMJPL9TNcfrGNf35EMGN0xO0kfFyMWc31Wd18b9GzWXJtulBTP0BofFR$9WJ8EAar9Z80vkx2SYBcczMz0k0XR9JvMAyYxZXqsK0XE5Bmx2PvMAC5ylq0MAcQSuJx8SlkWQBxNZS8Kmg8vRE7z2ZStScYgYgD$Ar7N0MUbZPSWdsTXoZZsTGTkv5oPST29W4Z9ASRWGNFWS$3BYyYJAJQyTWd85kgENWYojSHPBpsB9BYk9nmSkN5N0KtL1PS8WZ8v0WXeTegez98PeWcMpWZJTwAykWwVYXUAuNY$F80ELPvPuZQsTyANYXBdAVpnV-thkPwjMYd5wTShskUBYRYXwhKeISZYSi$pLSi9AzzZK5A0KZ0NXJvMq8wj893dZ3DJja$fc-nq9StbNPgl-pXd5BYdXdIEU$fq0$kNwinpWz7xrzNBj6Jd0T0rWsAEzzzxb2d9ieZHBxWonxo9eGu5wauqiWydlkASkJdSZJjbScPi8v00Mj8D0$o9ZB0-T9A98krRJgUn8DYrs8PHWKX08cP2t5Y$gdmnUYP6rnrpm2zEUiOglPjjepjFxRjhefgVV0v9ZgaN5WhPc1mSVkBBTSchU2O3hppJg-POupP7MCnsB3D14d7XMCU3NvYeY8c8VHnftDx0ePp1vw0jZCRdhg9B2gNXUINLMpLgZr2NZYOpLpgUI08PSzYEv5-U875nYnr3NUegQqMOY3gi0bQMr5CBqpnPrxLyxx-l8uU4woy30s3WBMA-o8p$w2nNYHnfwTF0sf0q-kYy-kXz2yekUyA1M0czudFZIJ41r9cpZ7jOes-W-QhWdxGBH$7yxza52HFp6k-9rX-YlXW3iE83XRf$NO089p0Iy0c8A7c-0PDEzRJPco1fFE-iJRVbJXwWtXcBYyidZ58aJqRSkZpoHPS1M$3EsRzZML19WPY5PteygAJ9RwWNx14xOqwtE$GZ0tCe8kzV2k$MtDDeA9Wp1nz98BUoJSkBWRU1Ysmlzn2YISzdo3Wemj0IUqrJS2zHnpNQMYPcQJjAs$zitCmvvdPPW10D-hL09nOszDvLWIp9oJviR9nSHSIXUlp8Z9oMzHbthb0sR0Mtg8r8cqq-5PMBF3zC11oqStzkUbQ3SWU551m-fw3gQMvVNltK-12ci5qdl8$SzwqYzkWk-gZxznK5HnCZY0rBqG-FC5p-WQOFc7wrRmTXAwnXuwgcS-hhLN5edsRJmAm-5PziMmCpXZKxZ9Zng-vUMb9Z8hBqYSZPM3MJhrWNmBpKhVV0F1aSVgt2LNxZVbPTF9W$WTmvU4qdYpMHnMbCnfF0M0swsZYMZbju9wwjM-cNMQC14nLJAzp7TymeOgbTpmFn4Ed1tOYuUVk9QkL8GEWrWsJMszaPclqvEkq-SC0DPKG1oPWqzOY5iWAEENwhREPtVHaPy0xg0lO4OHAdzjJGL35XrXZ35yOaQS2QmWvWWmTnpnSmuzu$xZEswAXxz2U1hsEZ-NkXOLWJVsVBtD0jdd0x8hYzJRL5h9Z3DqWHB89nWcc4Vc87vMOFAZUHV-Hn0AmcSao301VHkRJfDhCpB1oxu8IEpjwUdRLHqyMEL9hthvTom3Sf3VmhXN0IZzTWzk-mSs3GnXAXzfLzaeAfnGzJrNxSA2axUHLeueUK0mv$OhZtckdNycOpY1Zl2QoRgOYqqY5S2W5kR50Kzxe8PHXp0t0-xBUBUeAnBsRPufLrqkfzq5Z816E3CZP-0Pt20fFE5shDZNd5hJQMAtsWtR1zwByUDt8036mGuRybZ$3Jv9lRcLWMARsWKBc666Ad0M5pOA0o6NxJjHAuUWgjf7qiRmTZQ93vvVwLvcv6vlvlnSLcU8cWcyBP-o7wwtyLfpYb2VpoKdrBHyasXsHGHXw-jbeWN2e$3PxSkyeneM6woE5Wq6aMArwhbV2wnccMc8-uSo7ezyY30TmcQzt9pYPb2dxNYPhwM$c-x4qsRPcOf8dPcu3OycjrW8B8C5$sjKWHvPusL2a5Zim8cOcwLnjDYmY1YY0kJ8T1ZPRZxZzFz9Fd6mwFVUL2FegkmnlOFBcMe8PcZ4twDYzGYWcYRYdnLL1XrqmAmTzOcFqZznzzz5yYSyMVNtGevsM4G9f2y2lIZqlmnjgFqUZP3-cX-LPivcvAR4p$p3Pa-2aGL7LmvddVkEUYIfm6ezwZdDo0cxfbYnx63WVLVVVQmh2FILLhseITmQ4NTVOr-4$n3p3nQ4$PyfuE28cSk140LOiS9G5ble5VRAi5N-LYex-24BUSk$5xnyn0Z0nlzQmszd$RjLQKXevEo04N8rSIvYuRYlpdAJA5YtybUem1VFEMV43L1SQIUMz-CJ-CLmwVUULhybL4vVVObIUSiS25SKinadUAnIHnJGncN-e3j2tfEZl1jmwhNUfrqLHKYTuRAIDbuMowxPvJDU4ph0Z06-cBO68jvtZwWGEfF1ShYduX-HEN0$Hz7E2nYsEempTFm1AB27s9A0OoxT0$yCJHAGlw3LttLLIlRbQlY1cejvHTl8MPWk-x0SqrHEc1RjJYIJc21Q-DrXZRlof7fiOXfLD0B$IkoywhEPcfMNc9hmuJTYIX36TC$U49QIBBv6JapwRLsjL-LSgQO-5MRUZyw27ENZd1J1y9-EMjk9LYR7-OYdlSHQZmSfE9-e0A4xlzD65LlcPVjtZu-jr1HXJ6$6B$HwcPuJdZYPy5LxMW6rY6ISVTVrAAi$I0yinXBm3Eb6w4jEs$UpGzVD0MAQIL6IT8ahaKsoxM2bQznoA4OpOo6QQFzY-V5g5J1HyTnwYvsV6mFy3OVhR7eGnyBEvDJQD-maKzTZ0S9xZExoQLW1IG4JqkWzbvKS29NQBSdvntpHVB1-UPcdovtmTESQhZbIr1Pjk0gX4LPc7M7S57xQi4PDShbCIkpvn3n3HEJtn2tqwlZE9SFjzlzpXznUd9IjIpzeNOJ0vWAevNd-ma3KA11WLY3A5Pz7ByNYPYzQBcdCKW$9H91487A8L3W9lW-SNhybNbaJjtc9ThOne9-Bpw4tWKg32L5wYcdTm-OjWZyVze6VFSZWXqa4JuWKWRaLDDdnOE5X4Uk1ldPbQvcOKoydAwareDQ0wFZhQWLaFgZpTHqh5NIF05i7ioLS7bFm7LatdI0p4HAnTRL4ZSNT01-BNNE-uG3mkLWxh4Z9ZoFsVtPh6u90g0LQkU7SbYGndN1YHkZv0yBZuGmfskpP5rtBpW1x08xDX$m4jJ8nF22udjhHWSkXjOR1STZ5SH7xE3D3SXc5Zxv9-ExliAHFBKKkBAzz26y8FUle$5C-YBcA$e2xy6yCznyc0Wa6zHAEoWgmaUys$Nblj4j4$n4muJjrBS2Rdw2$Q21K$P1tJjn5Q-xZnMn5$GPAe22qY-SuUAviuCuDCt8JqYMd5oFireFKQgmb$qGjcLSBc-9bJXVH8lMrWEQ976I6xFvAv4wYByEhd3k2QRFan4ZyUVZt2L1yRi-qYOSjWdXKAZHPUY6cg-CbTwMm8-UtVjscwVM66ZWGV8C20$YUnRNAYMYYG6Z0f0k9ZJVPSlx6bxkix0LhETGVAo0Tj0c8RFP6$gT0nYzhHcYTQyJcLjRkQvj7Ue05QtqsPAw4Bnk0UEp49z9meTO8uf-8g1z2sj85BVn2tugg9z$6O8nyaxEV0csj01mGjvREsyusYfO8ifrVM8zAQMP2B-sHYUYBhdo5yiZMdf47qqP45mW2sAUVYKWPwIVY6td8RlMKeUJeiz1G80mENendc8tJ6ppYKM1ke3sZItPQC00fIehyPf3UId9Z1sB1fTPtV0ZDZd0wToMTxYjZVEmGYNdU1YUwZmge01d-$ZAMnWROdeYgcYTmTLKdWSSGfGmyvffdZ$wyBze5PfUKzPuWVGW6uZRYsZV00VXZdyUjfeje8$fTfft6s-oZKMzUP2fY86TlZVkqVJxYeb1clZK$1wBT1IMlTJlNMPWsvUF48clZIftfsZMw54TWYeBQqm$1pd$TBZVA$le3eIlSTLZaWRVYN0ls8cdtX-vS3Q1tYRWUD16JjqDe36uYKcKMW6P0sZb2gnWGQsIPzY9ZZTOcWvsjvT0q0YTtYjtXP3pKuZsPs5p7jldye-nVy7ZYcQGI60Wd0y7VEUJJV9NIymyPWi0na06-rs0ULjSZd6SvftYyYFPzK2SJf8zcmT0SSPU7emYYTqyhzpnWz3Of$17Mdp8W3iBn0$febiwzSkGtqcBY1yKqwAznvyAZm1fren72bIf0bccfLcHiG77jTS6JUwkPgqmz-TIIHt4WhueY1lidI8jUZKWJpXwltYZyfX0AxWesntTdfwwGV5MWTd1UFyGZPVMqq-TXsZ6AMIVBVmOKCWVTylNY0jsn6-sdTatpZv8dBqTiQTqMv-GiTFdyw-TxMCvPESGqGbZZDzegGa87fgf26jW-M8AGSGAfcZzYXmdSXpdAQogycKUxV1Nq4ag86EPwnMc6pfYwU0XXsqw1fq$dR6OhwSRMPQyeIHpoWOjnceo0FmWZ9UFHGqZAYHiJ60ANMw4dCqHm-ZhARctw7hTdsrMlxWj$jeBYutAZMcunv04cPliCWK0RU9LibTZwmT6qyHqzzSPS8R8BVRyUleaMYT81c0FY1s5-Qu8900A$3W1-v0$QM1uc4Z0Y-sn38H6yAhn1T3oYYThUL5G31jSlZQYYZFASZGYsA8v8R6pXnBtnstKTPB8Rx$GPi07Yl1MwB00W1MdycfMO1QVnqPhTVYktT8r078GQebfmNZ8T6eztM7zZ-NHxugB72k6HTs1AZofwQY6EnB2j-RwUOZqFF$cv8EYXQE809VX1VcPDJZn$iR5Ok6ZR1jLMkPs4wfuAuYzY35eBeJQAj98fvWFWsdgFOZuy3fzYpYRfsASz0G0D0uMXNY0Hf8lZRmNM88fNuZJtfcXjfNbkVy2XYspJoNN1Kpjffy2WeAZogsz$wxlWEeten8e0HmXcBLs1FDNitxYvlePdZdhPM-kKfgM4JU1MHqPbLBTJMJOsKjqOxGeMzSd2M8TQ8xYFNduvSfAtrfgWq9Tp6wek8jbG892EyzHUBYWQXMtMSvIchfYo20EXKIVzU87tXyaIwtPFsPfmiMZ5gJwMqsp7uj81nY5pRNd1ymmXwetwSMbfdooZiDnWfvXYflTmmh6t-$h92TnKw1CQ4IfIIVWffcTi2HMT$do6fsDy$yIS4hgyiddYYWZKMmgWlqwyWgJ6jW6YXlehy0-mTxAIZe3JxI3ytDIwjtPBwysV-ScSMsNJN53hFfYURe$cqM0hPUlWb5WuckYEWfHiM3tb00ecsRiPfIyYM0MW2WvfI8XyHYRQTpqUsCf7YlNgdJa33T28ScB5SNJR3oiOyeYZVHUXPRJI6gxMPIGK86ZHIsNon3ePvfZeltIyFW0Y4niYejmvy1Aat8-0ns$voZIYSVt1m8Pa7GmC8B8RzvKXQmyFINVglY8AXtfq8r8kK0FunP3fnQUlyOpO37wDqxFX00zkQf63iI58KAhghqf7GDFyFFhDgIZ8cqstlFXUYhJOROJPY4iZlBgHLEF5ovsUtUB6eLRteiYDF3lDYXBUqZKIHmaWHg7m3ItoI3BWtKtEd2$VmyulIlst8deFF$Iv8UlDgjcWkdjfLF1jbYpYElEjTeFbS2YiLS9zxTL-apHbtK250C7l-apQSZszqSHiCF58MbLWXnsps9tBlkjuDpWeTfq-v8ZPKzXym2mr-$xyAcfBo65Y$FcdZbLf$Dyu7l-RWzdZGXnstfycCngYkb7Yoi7lF0lIDsL5l8BBRACnZYLx582M8Ib9l$PtqGZoRPByblGPFEquG1lKMzUCwWKXWfxf7nFnx90ZWYF$78GbP25sLnyJryjGVNJPjynkP8zgG5bFjwy5B7odL-AnWY1h1U5UE8g2wgWxyxYodyrt6dx8KDRMQHdjcidegCNwXeXBMG4yqjq3MFsc53GG88PATxAjamH6edlcplXesgEDzSlsPKvw0LZ5xGYIWPAxR0Hw6aFpd-$fnJAQjBQl7l9t11g0QNSmHblWcNR$zWq8OGUdKZX1$GwOd383A8gDw56s$6MGxA5NuZqu3M8Cn1wmTWySV2E1e1GMAblJuxmYMLGrDDghitgmYMJGJdy5Jv1KdXtpnxIdwP6xYocGj4hIKgD-wGXcWxQvIat80NbOYcozdIh-iQEwUKvoG7MZ-bYmuGEvR8zIDgVYwS0jfxZ9WDg2LPgtKy4cqdB-453Piu7l-ZyD8ZQSBi7TRwcY9-7zLo5USYoZUI-joXn0Usy80negD-ePLcRTZR6mr1d5$wftVP-d5ZXBTgXjmBf8bdwpE1FtAR3BpdAzWIBPsk0m8P5Hjv0tBT3lL-6APRyXun0YFkyq5FrS337sjYafgUYjrpMnfARrPb5aIW9zafjSYYclF-ihx1PDsgZGTt2CLGgLwBAgXWtWD5kb3AmbyAZ7r503wJMRuPeWSjaqTzLOPDFi58cNdxGGJRyFudzVV4EAomSWwo5nWswgS6h7KnB5iwTlYpI$0Ss8c9YXs0PtoexGtxcpKMPSuyoT2lnSjTREUesEOZz8ejc4$KJ$EoFrn0AyJ$ZPs7n-V4K--MJu1ovq2MlmgHJNRL5G1-p8eYwH5VRd5gyg4vpDHElsoSbon5Gj1XqRHGII2zlHpKHE2LJ74-q4T24LxrReRsQyIipt$$0oBSioAIwhc$f0oe5QfsIm2-xpCdESF-zMs2mcWuwANciFIrz65pNm9vqoP4rpVv0ritBKoR8NzB6MpuXvSGq44ba$Bp2DRq2ElUgZkLDU9t28Cl1h65EoyESOocd$h65x8L7RJocdgh-sB8jPScku-PPjs982edWkSdGhInnYoBSAzd5J2rfpptJRIoq41P-yM2uWSi6LqiphTkOjU4-JF4XSRZUOuM5QoOd0hc45c2phbGH-8mugtw1HEmGs49quWfWHeRzoQd34yiEWLU4jkddIzliNUuX5andqKg655UQVRiid5DmOGJLoMYNMNJYvvVSfjwlRGVlSvIBZvYtQ4oMIFmvQ5TLbRYkgJCmHfZyLbRczmJCm6sZluPSUkXJQvPsglLPEZks5mN2FnMP-Soiu4rt0GBhileTptJ6Nm4RSLCRlz0HnZd4MOupRF-kJhRQn$xU-VScHIxV65EIonmqkQIc-o$5IjJR7zyI-vv4$5UQmBzV4aRto5VuXEeGaIhR5iM2upCdkJIoN7jkjuWfoGxH7NQmq4oOEJkFIppHGpbJM2RfX6x2LZe6PvqCmIHLvGt9mY05SArws8STNP8js$W$Hu30B$jeEPXfhynWJHNMZY8QT-Yac0QEqoboCi$jtcGPijqxTb8iDHKkS9-Qqtd6bP$CMWEUXjYKHEQzRDJBaHT0628YiOl0k1UZIaHx5KzIw1A8RyPfW888xY6VldU8Oc1M06q8AjfrfxtSNJle9MRTTZFAnfqQqVBC8H0htdw0LiwsKnKYB3Y681fBsN5j4888mR8sY-cxWyfXgfOfDy68glPVzd6gzJyhWAcHgSm0x86P4WISv6GLfI44id$385wJj8Zsgh88dW00988fzMEkGjAfH0O2zMqc0ceZYvhefM8SIfGUhfNhw$RL7Eko2HCSPT8C3C0JFQXsph88CJF2HOW18aNc0X$Fj4YcfGZN8kEMkLlCrUVMI8seRY8Z87TSa2xK7BWtv8qZIYq3h8JeL4VvKu-T8Wxd0TB81hR8l07Z3aobPqM$2zMXZ88dU2Z2ZvEMc8wP8o$csxQYwCHhfMfGWkxYdn$8Hf1op8a8$uRc0Ym001cfVTY5UJI8RYVSHDBCvMtYTOyC68S94Pv05fyTqa$0BPf7J2Wp6synZ-xo08LvyFl-7mx2XEfBfH2w$7YdU0ksEVDgSZ0fPVsio6V0hY163hU1fPLQK8F8dUNAPr28vgWGZZtseZYsGs1hTWnMk7RYqYPZ8t8p8N88YdEPZyqnLqx2WlPQ0QTcSF3bpyxzQqZZcN1lWtRy3m8OTeYuS9Z0cqcJ$hg86tKY3XTHswqX5dSPYFYfH8BP453VJqxc1B88fmR9$YSYT7pBOHwde9HCy4MKXaD3FRsruj0MhkZzwSZsAmL88f9BZV88"}},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/plain; charset=UTF-8\r\ncf-chl-out-s: JDDY8Z9DeDyw0hpq9lJqaw==$R/twwHoShMTk3d3kkl5s+Q==\r\nset-cookie: cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=xarvok.top; Expires=Sat, 06 Feb 2027 21:42:10 GMT\r\ntiming-allow-origin: https://tes1.xarvok.top\r\ndate: Fri, 06 Feb 2026 21:42:10 GMT\r\ncontent-length: 0\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: 9c9dd0d8e946b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T04:12:33.851907Z","times_seen":17929621,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/main.ad7daceb20639047fac8.js?t=7","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /main.ad7daceb20639047fac8.js?t=7 HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-e3f80\"\r\nexpires: Sat, 07 Feb 2026 09:10:40 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1891\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IBiFBdWzt%2FU4jX3xl7aqeRNW1gEoPQgM2sNdffWgRP3ZhP7Y4hVI9FXTi0ri0tEqUvvglwY4fXfbYrdksw29wu%2F98o2UhFY4hVrFEUU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0e86a44b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":933760,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (679)","md5":"1ba880983193c074ec0661726677a391","sha1":"e3796022fb73db59e6f5189243741681cf187ef6","sha256":"e745ed262129e181eead91caa5a66589740b30936ea489265dfaa05b7a2195cf","sha512":"a4ee794b74f5b7d652ed6a6ae029b9c3ab60fa59ba30c3da23d2e51f4a0850913cf52cb6ba9adef23b84ada4f10fefa8b83e963933e20c67130c923cb04a3335","ssdeep":"6144:EbMxkD/FR2BKG8U+fpB/mc8Er7SjIpRFjcXyIcAmhTCZGfnjrDPIPXvNioY0:EF0lyKeSI2d9","tlshash":"0215634672f231394207f0795a5fcd1972356a0b2a88ec593a4ca2511f8a57cebf6fcc","first_seen":"2026-01-24T00:52:49.491275Z","last_seen":"2026-02-25T16:33:01.81196Z","times_seen":5,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/5905.04b286b6eff2126d05dc.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1887\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m52uXSUncwThbvH1OVy8%2BqJu2TQ9es%2BobV3TPB88sToMNgGxLSVFJHH3ImPe61BtFcVkbJrJXsuMDFRvoj86RrB2YBogCjQscVDSrLk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcdbaab4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:10:48 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iNjOY67%2FCP6qsikFsR%2Fvla1zKkN9loyoViW0YrjQmFJsT7k%2FtfHCUAM1vMJBngCNppAt5s23CMulG5e2%2Fz3PvtztC%2BUW7O7UiblESPk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd0bb3b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-10037\"\r\nexpires: Sat, 07 Feb 2026 09:10:49 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bpdpiG%2BnQr6%2FVqZx3yzerKs8OGl10k3U7WI3xvZA8431FgwmRwHnW95FVxLCXHw1o9tlFnzF11fiMmmz%2FdbfXjohmrY9HXlkJZwZXN4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd2bb8b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-14T23:44:34.605345Z","times_seen":15258,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"tes1.xarvok.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/a/notification.mp3","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /a/notification.mp3 HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://tes1.xarvok.top/a/\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 10880\r\nlast-modified: Thu, 18 Dec 2025 16:46:03 GMT\r\npriority: u=4,i=?0\r\netag: \"69442fcb-2a80\"\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 1889\r\ncontent-range: bytes 0-10879/10880\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L9dyGasAzFhgc%2By3ySO5K7hpBgNItxqB60Q3Bod69%2FOQBGITbg%2FMkRBnRC0fPlLpM%2BUb8ycqJNLKSvsybHim3%2F48k3Exa%2FxPME2nHOA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=15552000; preload\r\ncf-ray: 9c9dd0e99a51b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"eba09b6a457792c52fc610b5f9f974b3","sha1":"95e6e0f7648e28ea21bc434054ea59aba3a35aea","sha256":"86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6","sha512":"9dfc5ff830c9ed75c9923528c31e1361fa36500d76a209cd475984e5585a644c8aff1600bf02a658ef363436a51988ff1e63aa7606e541dc4a7b3449c5be4852","ssdeep":"192:RuQQeX7rYX/WUUIk8DLh+2BHpZqlXCYP69tuORf6tVQRa/nwNQBv5JC:RRYeUUEDLk2VClyaV0aZ5g","tlshash":"37226b18af11056ef4866bf0b3939b8dc42d26c37a26d4cdd3a5d7e369430e2a7d500d","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-14T23:44:34.464453Z","times_seen":16898,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/7784.2a486dcaaaf47415a095.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-5268\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y6Sj4vZKCGRv%2B4ahSa8L9YCiOiTqIa5RFqgJsNtIiQhsmK89tc5hqWTbhOTsv%2BU4%2BSVJNLkcRNYpOnE3CN%2BZSxYsQUuhnCDEWHtWIOM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcaba8b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.851Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:10:48 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aWDgLG57m7a2V3PLBE5aB%2FMJYAVz43YYMZivK7tSASRKuCzbvP0mTmHYQt478BcfLgklvtgZuJNTBoQq1B2Abb8ccTHYzPJWi6tk4ko%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd0bb6b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:15.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:10:46 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1889\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fHdBD7AzvY1S01Lrs5zMsS5Ig8edotQcEcEkJIf1dyhcKxlb2QXG4DiIvKKNgVfH8S6HLzOCnTbdPmhcieG6y5LkuMJVCsoBZyeHxgw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fc7ba2b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/7784.2a486dcaaaf47415a095.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-5268\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A67BP8fzHQKKFfBm3iSGvZ8sBcZvnJBGW0QfUSo8A8zvFSTc14s2FfT6PVtVOXOdd%2F%2BlSsVCaIirr%2FttCfNr5hoY%2BSXoxHt9r9lHuuY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcaba6b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/favicon.ico","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tes1.xarvok.top/","date":"2026-02-06T21:42:09.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:09 GMT\r\ncontent-type: image/x-icon\r\nstrict-transport-security: max-age=15552000; preload\r\nlast-modified: Thu, 18 Dec 2025 15:15:29 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: br\r\nage: 1890\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"69441a91-969\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FqKP1LdhBVr9Wjw7tiCjySx2pX2lPUSZWrx0kCYLRNM3fGHhy5G7WPuNfSO1uU%2FLShDSUIzQFOvgX2KdXVUZccVRcgFZ8I3zKlisbaY%3D\"}]}\r\ncf-ray: 9c9dd0d7e93ab4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2409,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 48x48 with \n- PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"1635ed0e8715c40d4bed875b7494a93a","sha1":"ca2c72821b30194b9b6daf9c8c0ce1723fe54614","sha256":"504b4621e486970f8c1721d5297561c9f33296f516c83fbb33a0ff3f4f7c1357","sha512":"f710268687fcd3da9bd9ffee9cbf166d21598cab5ff1172c510fd478f57300af7112f35132ba345a2242b65ff53cde9de6ebf0f1ea8cf7f5fce17c832a5a85d8","ssdeep":"","tlshash":"9c413ae3663eb676c5f6a6660c4f01002c1f80d4759aab3c364ae0f68c4316a0ae4a23","first_seen":"2023-06-20T23:38:38Z","last_seen":"2026-08-17T00:54:15.204255Z","times_seen":2903,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/redirect.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-445\"\r\nexpires: Sat, 07 Feb 2026 09:10:40 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1891\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BpE0rNNJg2MO8l5YtfgAXb2U%2BmEgUA3sF3%2FORL%2BSFz3%2FVGE74NkXD93mctt0mY4cAsSbiK8is2OZaKwHpFoo5I3%2BCjztdUsEMrB%2Bscc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0e85a43b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1093,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (1093), with no line terminators","md5":"a3a340493275e724dd0f36c976851f8d","sha1":"98947a9463ca5793c01e2e963b884464e363c621","sha256":"91a712c3e6b1a657f97eb33b00166314e4297e30293be652dcd561faa3d73c9c","sha512":"e9dec4d8c834223287fa880c52c559c5e77ed96bc7c25e569523623ff99c54ecbe9a57e740735803ecb169bec7d69465e671e9dc943357d936a74dd7d543d648","ssdeep":"","tlshash":"be1186e053b45faead760205fc35bd5d48f8699647cf909de1037d44c9717d96390320","first_seen":"2026-01-24T00:52:49.497157Z","last_seen":"2026-02-25T16:33:01.810429Z","times_seen":6,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:10:48 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=64mJvyKuN5j%2FgsXXw8iJUZJuaVb7gUpR57UgM0X85mFTTVb4rQVBDE7zJHfVmuYgQvOr8cfNl%2FNTK2mNLGPrCIu%2F0oW6%2BmYtGZPgAIo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd0bb1b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/main.c2527ac16c33f0e1edc5.css","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tes1.xarvok.top/a/","date":"2026-02-06T21:42:12.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /main.c2527ac16c33f0e1edc5.css HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tes1.xarvok.top/a/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:12 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-1c061\"\r\nexpires: Sat, 07 Feb 2026 09:10:40 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1891\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EXykp7%2FwGEla2RFIWHBkH5KzXvOrFe1eb0kUjMvKTAYLyj8B8kMrYYB2yjklqSlRKlGhzcL0dnVa%2FZzPMi4VmYHj6yfKkddRpe5Wjsc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0e86a45b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":114785,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11610)","md5":"7c25480e7fded5d00d8e2c2b49e52abc","sha1":"f124c76246ed52a5dce817cc6f2538b220086e4a","sha256":"3d15cb758cc9c6c7323f3aa5f1c9afb8e4fca89cf40f27dddc3ddb3279c03c72","sha512":"2f1d1b8739929d7213ca14800d7d9bb47a170ae051493bcdd2e191bcbf82f5076c770d668d8bd77a0eb220595769a52f1429ff4ba92e7764e8473bfe0f2c2ed3","ssdeep":"768:w10Q9RiIfAm3lPrChnv3Xrscbqas3gkndLoo9+b6UbdWAkcI5/ydO8QtfEEV+p2z:IPRiSArscbxs3gknK7WF5oYfNT","tlshash":"a0b3d8a4e98411f9ab23c23e97c4d76c9d38e481dd210fafb617615c07ca3eb12d2b59","first_seen":"2026-01-24T00:52:49.501678Z","last_seen":"2026-03-19T23:23:00.171841Z","times_seen":7,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/5905.04b286b6eff2126d05dc.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1887\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VEDNHQvtptaGgj0BL6%2BScD2Lc8rKsgWALrRlrIK%2BaYqBvKwpIkZSks5PGd7yKwt7tuzMa8qtbmAvm1Xd2qPuQwlv0WfZD%2BniF9d3FqQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcdbabb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/5905.04b286b6eff2126d05dc.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:59 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae93-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:10:47 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1887\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QzY7C2jLoxgW2K5JKU3yyo5je9kr3ff5VDmRPLOWmltkfzKKzqdIgQaB8YibsusMHfHDAwQTEH%2FCPBcQDOvoCgGITUz7s4C%2BZeLtq7M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fcdbacb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tes1.xarvok.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"tes1.xarvok.top","domain":"xarvok.top","tld":"top"},"ip":{"addr":"104.21.40.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:42:15.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xarvok.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 11:43:37 GMT","end":"Thu, 26 Mar 2026 12:37:30 GMT"},"fingerprint":{"sha1":"4E:4A:3A:BD:B3:66:27:1A:5F:6E:C9:64:EF:0C:CF:7F:6A:76:1C:EB","sha256":"C1:2A:C0:94:CE:A3:22:FB:AC:01:15:E0:DA:34:38:07:8E:D9:00:E1:BF:80:5C:E8:05:E7:29:AA:F2:0B:F6:14"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: tes1.xarvok.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tes1.xarvok.top/9443.9a77810d7ca6ba92249a.js\r\nCookie: server_name_session=5c85b662ab5d4293e657eca0e489c462; cf_clearance=kZHnnwQ5nrHqnuJvdYV73cSB4pcCBKnu1Cq6wu86gOU-1770414130-1.2.1.1-d350La0h9Ejpsvxd6KrhmyDAv2bVfWeevI7Ikza_Capr9FGp.FXn5CX3GezDDXnzsbjivRa6HoW6pmaBFUNa53tEGahCedL8IHxR6bASafYpnG4pcdV.YzvH_qmVPMMbvKB9dEIIthcS6ghjKH2P4KljmSApvP9NOrc8SlX5JcIf4Sxjvg4fHYZN6nf0CFQr7HFN8DGsvc2IsBwrMWB2UZCRsPPcHwF66vrtVZxWEpI\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Feb 2026 21:42:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 30 Dec 2025 10:50:58 GMT\r\nstrict-transport-security: max-age=15552000; preload\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6953ae92-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:10:48 GMT\r\ncache-control: max-age=43200\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncontent-encoding: gzip\r\nage: 1886\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=txzxJeKNtuMjgO4e9omoOxLlKaWpC8eapoxceoI4iWve6HnqWrfrFHlgTn7ZOWf1CTmT5F6eiMncedRUZPD7ftBnQgSHVNXdo9JYSnQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9dd0fd0bb4b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"tes1.xarvok.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"tes1.xarvok.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}