{"report_id":"77eff8d0-d604-4077-a9c8-1f134bab9f03","version":0,"status":"done","tags":[],"date":"2026-06-09T16:34:29Z","url":{"schema":"http","addr":"web3agree.com/mbilling","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"title":"MagnusBilling","dom":{"size":53425,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (14526)","md5":"26108bc3c50279d49d4cfc38657afd81","sha1":"db60b30ad862e33d24dcabb3ecc544827d6671cd","sha256":"a84a1161285371f7279cf5600615f539d1a60f61c493aec15efef5a8e89af8fa","sha512":"9292c1eafa6d9efc295f2cda22524e7948f3666fa0bc008fd445a1cfaa26bfd28e4455cb6159f4fc86ca3d039f611c2955c43adc1e4e59d57dfffa4efb98802a","ssdeep":"1536:/EdOstv+iVjZeIVNb8jqhKUaxigs+e2+eBbe3:/EEsttVdeIVNb8jqhKUaeE/O","tlshash":"9633e94123d5a13a8307a0e0ecafd91871355b0a96859c19fb5c80d8afb5d7858beefc","dom_hash":"domhashae2ad1bf24031eafb2a73ed4c13c7ff4","first_seen":"2026-06-09T16:34:37.15402Z","last_seen":"2026-06-09T16:34:37.15402Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"web3agree.com/mbilling","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-14T16:34:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"web3agree.com","ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-11-05","domain_rank":0,"first_seen":"2026-06-09T16:34:32.39272Z","last_seen":"2026-06-09T16:34:32.39272Z","alert_count":69,"request_count":23,"received_data":3896544,"sent_data":15407,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/locale/en.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9b9374b6f4b06d36c41bf24e913c7363","sha1":"f1538ad0de6608e34b3eb59c84172df203dde8fa","sha256":"524144969164c3940cd61a9fbac2a650827573c9bde22b18319e9eeeba82310d","sha512":"10a5e41b83a074cc511027a4691a4eab20c071b76ebd24e5599aac5ca8c4e6f86aceffbce56b1f22535d84c622d06b370e6944e3540e04475b096f64f10b9843","ssdeep":"384:mUtE4s/QHedOpNWnAdUzZPmsk3QXGeC630RJwYWLUBC5tP:mes/QHedOpNWzNhk3TKUJWLG6t","tlshash":"8ed24ff1891323214e844a9f653dee5031995277eec23167b46e9e182fef30e62f6436","size":30031,"data":"","first_seen":"2025-10-21T07:23:30.542475Z","last_seen":"2026-07-24T19:34:26.227239Z","times_seen":175,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a56b7fb7cd45445b1566b7e02288f71d","sha1":"e91522b9ade409998872b8bc2700e565bba1c859","sha256":"3140a2b5d11b64b5b7e39a940e4969f71e0bd3750d31337bd94f707bf5cba689","sha512":"ddf6a976d68bffc67a07954bac2c3e9fd7ee5aa08787078b2443d3cd814cbe93ab93baa19590743b7b0f0938a1a431e16f55483133bd472061631662329f9815","ssdeep":"","tlshash":"e99002f470c254495173316440565a98d124552030a48a628150d4609c55061823a5dd","size":52,"data":"","first_seen":"2023-04-11T22:28:09Z","last_seen":"2026-08-02T14:43:13.464027Z","times_seen":1377,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"17011a794619bc193fb8404da0cd9708","sha1":"2163840cf70b146b9c98dd5c0dd471cafd4e3076","sha256":"1870450ad1f5b3766620b78ad21fea35df619461f52aaa51ea85442af91e3ccd","sha512":"db637389dffddecfd23013918dcae35e30153c630dfaf716bc1135ab9eee3800229468056a8f00d0a372ec3d80c77b84151edd2f3233405d971a8496564304c6","ssdeep":"","tlshash":"8c115cb134982c3b572338a5283d9f4c7eda7a049355c8cd8228c9a50e75c6c954c1fd","size":913,"data":"","first_seen":"2023-03-09T22:29:12Z","last_seen":"2026-07-24T19:34:26.278454Z","times_seen":397,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"e022e2d70dd9ad115889c910e056e532","sha1":"98411e277ea0ffe98878a10ff58eb6c1d22f0466","sha256":"7ab3d9376f6b12127da11872f7070f3f8bc3554c2547a1227c5b4ffe5f49272a","sha512":"ed94325471d45da952f5cf259db1493d44d04b10c35618c2d0544c272ead00952db681328ac71c1451d598dd8c9586514e2f4f2abec9b4e3d7a8f213a9fcf92a","ssdeep":"","tlshash":"e5d022c33deeb031af803c50321ecc4cb3bb401c52e18085e4a889ce06a2cac068c66e","size":213,"data":"","first_seen":"2023-03-07T12:03:19Z","last_seen":"2026-07-31T07:05:15.158351Z","times_seen":1497,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2807d7764317dd64d672174c886674ab","sha1":"e3a863416a7c89bec58cddf07a1e64903a639230","sha256":"3d9a6e63d7bd492549419f40cf73b471461fef86852f40241e971b3720e61822","sha512":"b3d2717dda5a9f2073eb6d57114a5f1c9bb73c847e9940760e5e170abd304b7b1700b02c0f428911ed65ec53c7550b2d5cc7293f21fd54f6d4b7232876ff3c82","ssdeep":"","tlshash":"33a022f830c200002033b0e8000b0ac8e320282030a0cb22c000c0200c0a0b8823a8ce","size":72,"data":"","first_seen":"2023-04-17T12:57:21Z","last_seen":"2026-07-24T19:34:26.24894Z","times_seen":754,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3f87b95ea40712f0b9659b933465538","sha1":"ddb52cb28e5b72a3751426702f35301a85bf3e0f","sha256":"395cf3a0af6861cc09057ebf2e266a93d7773a27b7628724db2e6d98f5b93871","sha512":"e606ae37d657d5e4458ca03e43bf4a9b01961e433eff70a39694f96edf42db0e04c614ae9f5e5ff08a82abff40bcf077f163aa45ee38ad051e2565aa297ae2b7","ssdeep":"","tlshash":"44d022ab0d1182580eb4b012a213eb1cf032c092fc048280356d61212fa0ae3880c820","size":198,"data":"","first_seen":"2026-06-09T16:34:37.208447Z","last_seen":"2026-07-24T19:34:26.250462Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d14471d3c4162e94d13e3d61ce4702e","sha1":"b6dbf3c269562327f99db53d3e6a0f8e7b705868","sha256":"364fbde1390d22af13e54e1ab3eea5f3630754ee5587349ca801ce38da3028bf","sha512":"bb23eb22f7fc2ea66d408c14c3f9f6a2ce5bca7efb697f7dde1bc17ec6b04b72f6200ccf0f642206b148720ff46c6486bdfea96bf7ce8cccc02558f7f8ed5e9f","ssdeep":"","tlshash":"61e0e584980640d808722232ab73b7203a037327a8b0c462ff5e83443fb1a8bd3693c4","size":428,"data":"","first_seen":"2026-06-09T16:34:37.210016Z","last_seen":"2026-07-24T19:34:26.25104Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8dcc3fb5674f639fe8ed8fd4dead0a0","sha1":"7f2cebf6c2c46675446881338c6c3ce1646144db","sha256":"57ace124d013771d895b1d20e74c66bce27cb218368206eb7b1e4b165fc49d04","sha512":"5499525373797aa910f02380ecb1c3a07301c6f322a8ab2bae1f149f2237874878af84ee6f6707fc98d9efa8c715f54b2d5847754b4f3aff39df457c5f640c02","ssdeep":"","tlshash":"8c31355b178317344a2722b793aba360243590239b1af604ff1d0824afa974f90f5eb8","size":1604,"data":"","first_seen":"2026-06-09T16:34:37.212186Z","last_seen":"2026-07-24T19:34:26.252117Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa4df8e86f3f58ee54a5fb8bb0073135","sha1":"56a08017ad95f784211bf374078ce99001a0fc36","sha256":"32947a75173ec653effd0c2e70b298b7b2104ba1b99ca8c5f519feb154370d17","sha512":"18520b280b1b77929cf12f6ba08e0e2af614269af3b0311a9072c850c2968b49bada0b1cdf6c5cf293b87692b3c04b3edc78e54a0ea553f56282ef7b208c4930","ssdeep":"768:hyZBaFHK3w7X/K93OqZwjKeBa4ZeIVNb4s8dpi+q8QdANKaR:hOstv+iVjZeIVNb8jqhKUaR","tlshash":"66f2934623e5a2398647f0a89d5fd850b1385f0b2689dc9db91cd0c8af6097c45beefc","size":35001,"data":"","first_seen":"2026-06-09T16:34:37.213647Z","last_seen":"2026-07-24T19:34:26.252625Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3520a1aa37816a24bbed80c1d44952af","sha1":"19917e7b98a7fc5a77afb702cdc087296837ddb6","sha256":"82baf8063e1bf148bc674f2934f70da3e8430e1ac538c6acfa902c94f0369c64","sha512":"5a28b7ff06ded53378eafdce3879b02dda0043614c9ad7180a5bc46776f160b32a16a7961794093e1008363746c5dcb3a0f1e36ae2534e3bc0fea1b75ed8d577","ssdeep":"","tlshash":"5dd0127510c814a53031f1a9264be6ed431269e4f050d54c41a191941819ced8d74887","size":224,"data":"","first_seen":"2023-04-17T12:57:21Z","last_seen":"2026-07-25T14:49:10.102282Z","times_seen":659,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"424809ce61c6f11cc6037d8706102675","sha1":"e79d5670dc6707d9127f0e67721ea0380b656c8e","sha256":"aa341f982efbbeed2679b8c271af33d57ddcfac08baaadca051b81174ed4aacd","sha512":"79644f074a3ca4fa0dbe86c7f60fdc9b455eec2f0b2ae2b2c04577c3532a023d55b2d2a8e13e6e02e9239b87bda719434964b317d11d48c711b0d74858696922","ssdeep":"","tlshash":"92315ca27178193be6163825183d9acdbad97e05e385d9ccc35c9ca60f79c1ce0988bd","size":1547,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.249466Z","times_seen":320,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/locale.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3e17c5b027303bea5a626602ed8b8e3","sha1":"dbcc328578939308ae9a7d9251f216c00c8ee864","sha256":"6b7a10b0fbffc97be20f0d99e27ddcf57d251ae05831e8e9f089552570d2a5db","sha512":"0c33806fd387f2e9f7d07afc35959917f4fa92be738623419c4a356cec70c1a79d02a4808cfd0977e0c2d8707958512bfd0b993a80279cce4f0ed4d596630c42","ssdeep":"","tlshash":"ae31cd1539e23253115b73d043bf6619a01a32877120d8e8feecf2146fd5a2748b69fe","size":1772,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.225224Z","times_seen":266,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/index.php","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"79ae7c20541a4d572eb4f48e12d94cbc","sha1":"20e90d2ccb0038a98612e51c7cab67ad2ae6053d","sha256":"ee85d2756ee367c1c87328c7fa118e1e75078975ef571dc39bdb02e11965800a","sha512":"2d8356f2f4bfeed87ca4fb6b26a6a7b1d1afbb8407212fb87713d493d82c9722de62a0b354074f9e59651d523071cfc822ec178ae5f2cb6b0450ec52463ed255","ssdeep":"","tlshash":"03012c3aa05fac0530b06170d383bb0130a8ae88526026e43baa00787c45c0bcec69f2","size":817,"data":"","first_seen":"2026-06-09T16:34:37.201242Z","last_seen":"2026-06-09T16:34:37.201242Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"ed17d9c632201566c94bc4a1c51b6af9","sha1":"742b8211ea4161aecb92c539f91fa865a57c45cb","sha256":"5efbf589ac200160f0cefac316166c0248ceb4174dec62856b1a34c9b09d4de5","sha512":"1e757c596651c56a591255d294ea9df9e14fd89896ada90ede254a771b380bf035090fd79fb692769769676c738c4db54e3b612777bf097084bc9b14cc8a6d64","ssdeep":"","tlshash":"2d618b6274785a3fe911385a4c3dabddaecabe01e604dccd835c9871097ac2de0984ed","size":3207,"data":"","first_seen":"2023-03-07T13:11:39Z","last_seen":"2026-07-24T19:34:26.255443Z","times_seen":362,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"72555f8ee8da20a89831661ff42e44bc","sha1":"ff08d0903c98e5e9b6bb3a9cc5d1228fe2f711b0","sha256":"a846958880629fecd50bbee4c29f707763b19c12b3664db67697f1e1e511bd78","sha512":"5db16e1e923b05656830b05af7b475048ddfa9dcd9e78fe7ad0b38e000fdfd3f97a2fd8b1286d59ce0aa7ebd1a28b493e2ba8ee4e6017ce4fb509f464d85ca42","ssdeep":"","tlshash":"c2a022f830c200002033b0e8080b2eece330282230a0cba2c0c0c0200c0a0b8823e8ce","size":77,"data":"","first_seen":"2023-04-11T22:28:09Z","last_seen":"2026-07-24T19:34:26.277836Z","times_seen":414,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"434bc8c272edb231952c0acb7a2db4a6","sha1":"e3f0fe0b7e9ebb3721d459b631f2906a60abee35","sha256":"5cbb70acd21edb087a379b31b59e25d0e22d3ff63025301a9e5a7aa85db3a2dd","sha512":"c65f6fcc624c42e9b4153fe52c5ddbe5487d690b6642cd2542fecff7b4844aed21d95ee2734e809c28231dfb0e198dfc5a70e364a992a131a0717b05e7d70d09","ssdeep":"","tlshash":"529004f470c351444153315440573dc450345530317c4f71c151d4505c55031c33d4dc","size":43,"data":"","first_seen":"2023-04-11T22:28:09Z","last_seen":"2026-08-02T14:43:13.466873Z","times_seen":1503,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"8fe2babe85ca6f8357cbf84ccf11c559","sha1":"985d3c517efccae373a9ce524529d536f8bd1a60","sha256":"bb3daa9779d3adaee4b92e53c2c4f40c8fe03bed679b9e9b8b6c1e7548e84497","sha512":"3770bfc6471566c19eadb6f8e178bd68988ac005713836d7895eb3752333f266899064e082292a1a6e5768cc788aec4cafce535ae5b3aaad73cf4506caa92132","ssdeep":"","tlshash":"73d022c33d9eb031af807c60320edc0cb3bb002c52e180c4e46885ce06e1cac064c6be","size":216,"data":"","first_seen":"2023-03-07T12:03:19Z","last_seen":"2026-07-28T23:52:37.601979Z","times_seen":1126,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"bd1b80aa56c0ac7fd758c3c53b2041ba","sha1":"8cf9c8ae0dca8ed454ee667480007781973d8e0a","sha256":"828cc317606c7540296caba02e99001736806efd3f5e54209a85098dd1ec0e14","sha512":"eaebee2869afb2a6c0455215fc250690b94b66c7198d21e165a3444afee98477033e1dac37b2377a563850c25bbbaa82802182c9696232886a2be76013da54d5","ssdeep":"48:fBAdetlE6IkGsZZkNegon03ZUirZkeTTpSfTOpnRNEbw4pp4pZskpJpZ0FpyHCT6:ZAdew6u3lu9bbORWXYvl","tlshash":"0ca15f62607c1a3be11634594d3d6adeaec97e02f318d9cd831d9ca56e3e91df0804be","size":4922,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.244992Z","times_seen":326,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/locale/ext-locale-en.js?_dc=20250925182304","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8cadb178e1334f0240f22ba2b01df65","sha1":"f782acfe62b9bbae7669c2b704b517f0468572e9","sha256":"9dcfd9ab3878dabba91f354a4b39df52d62cd651e186768cce5f5b3c537bddb8","sha512":"1df14cac0ee04b83ae4c98c9ecc3c2adde3b71f33565800bf180f50325e554d1c33f9d0a9e9f2172ace7d15b3e692fb5bd8610a4aa9e3ca8882a56364e16ef6a","ssdeep":"96:lxVDyq40gITSehIiZQo+CgqmwszDYFw9zQ+3gQ43+IfQe3IXQeQJ3/QQ3LmxQQ37:bQ70gAmmBM716IAN59DN6U4lx","tlshash":"cbf1894c450a913512420397afce198767d483fac9a784d2b159cd273962e9c11fffb8","size":7916,"data":"","first_seen":"2023-03-14T16:51:00Z","last_seen":"2026-07-24T19:34:26.229467Z","times_seen":260,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"e694d23ab6388bbd41f59d38f06fb979","sha1":"2f371ef0bbcb9bcc7d2f15a8a93f27ed5b62545e","sha256":"6583265e27ec57e59ad0e4039119c60ec459d2b2edb4133b693f0ef95f49ba7d","sha512":"19ee0a6690449e38b3d77de685377ad04516f6642aa3c7700a3610e2596b8e5b2902865118b1689644e898503509d31381e4096450e3a455739ff9a1ce6d1104","ssdeep":"","tlshash":"28e092823f5970316f44ace1f61f9d8cb7621428555685cad554a6df00c5c78850cdbd","size":373,"data":"","first_seen":"2023-03-07T12:03:19Z","last_seen":"2026-07-31T07:05:15.149113Z","times_seen":884,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"50d7043cb0e76ca4944c11fc0adc3cf9","sha1":"3a1ffcfe3efb739f2f6fb8ea3628282071a6f103","sha256":"cebe165b2a25f37965bd2ad3db0077fe1db0aa54b877c534df7549a638aa91a7","sha512":"e8698347499cae3df33438c2100316b8305d8d221ae45ddf4fcc3c6edb43a88bdc9d9ef7d526b857f66ef28056629d62da9a7d3da9cb72aee0eebcdec4b1819a","ssdeep":"","tlshash":"e6210aa2716c293bf7117825182d9e8cbfd86e01f795d9cc822c9ca51f7882cd4885fe","size":1343,"data":"","first_seen":"2023-03-09T22:29:12Z","last_seen":"2026-07-24T19:34:26.256455Z","times_seen":393,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0fc4111973e1814f70f78402ea9c03eb","sha1":"d22268b05dbb57e2b280b27e16214c4c7b0e1b0a","sha256":"60d2f636db3edecf5f5644c6111d2f85041dca1dba709ac77a9584b429c08198","sha512":"9ff1319b16a63a9908610b682d9d496fbbc4fe34add026f86a250f0ea12b4fe8951423b8ab12224f5de52b08665e3be6def59e37805cd8b150beba52c59b3f77","ssdeep":"","tlshash":"cbb012b920c510553172f0fc444e66dc933278213054cb91c1a0d0a41c0d9f9ad7d8cb","size":128,"data":"","first_seen":"2023-04-15T23:50:07Z","last_seen":"2026-07-24T19:34:26.259736Z","times_seen":403,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"9d8256724e17bb4ca37e50c06e60e781","sha1":"47a966a7342a1b6ecaf15e82abfdfb8f01b1ffd5","sha256":"9c955fe52b7d1506d02d1bc03e7ea336d4912b1c36a78e4a902db80e878c1c75","sha512":"c3ba7c6dc6d036e35718080dbdb7f17d0e71d0753589feb4c56379083cb4931e2fbe199b7dd32808f03089a08cdf7670731cf37094bd5ff7140188888c35184d","ssdeep":"","tlshash":"ea5148a274781a3ba611385a1c3daaccbed97e01e744d9dcc35cd8741a7dd1ce0845bd","size":2927,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.262012Z","times_seen":317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3f87b95ea40712f0b9659b933465538","sha1":"ddb52cb28e5b72a3751426702f35301a85bf3e0f","sha256":"395cf3a0af6861cc09057ebf2e266a93d7773a27b7628724db2e6d98f5b93871","sha512":"e606ae37d657d5e4458ca03e43bf4a9b01961e433eff70a39694f96edf42db0e04c614ae9f5e5ff08a82abff40bcf077f163aa45ee38ad051e2565aa297ae2b7","ssdeep":"","tlshash":"44d022ab0d1182580eb4b012a213eb1cf032c092fc048280356d61212fa0ae3880c820","size":198,"data":"","first_seen":"2026-06-09T16:34:37.208447Z","last_seen":"2026-07-24T19:34:26.250462Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d14471d3c4162e94d13e3d61ce4702e","sha1":"b6dbf3c269562327f99db53d3e6a0f8e7b705868","sha256":"364fbde1390d22af13e54e1ab3eea5f3630754ee5587349ca801ce38da3028bf","sha512":"bb23eb22f7fc2ea66d408c14c3f9f6a2ce5bca7efb697f7dde1bc17ec6b04b72f6200ccf0f642206b148720ff46c6486bdfea96bf7ce8cccc02558f7f8ed5e9f","ssdeep":"","tlshash":"61e0e584980640d808722232ab73b7203a037327a8b0c462ff5e83443fb1a8bd3693c4","size":428,"data":"","first_seen":"2026-06-09T16:34:37.210016Z","last_seen":"2026-07-24T19:34:26.25104Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8dcc3fb5674f639fe8ed8fd4dead0a0","sha1":"7f2cebf6c2c46675446881338c6c3ce1646144db","sha256":"57ace124d013771d895b1d20e74c66bce27cb218368206eb7b1e4b165fc49d04","sha512":"5499525373797aa910f02380ecb1c3a07301c6f322a8ab2bae1f149f2237874878af84ee6f6707fc98d9efa8c715f54b2d5847754b4f3aff39df457c5f640c02","ssdeep":"","tlshash":"8c31355b178317344a2722b793aba360243590239b1af604ff1d0824afa974f90f5eb8","size":1604,"data":"","first_seen":"2026-06-09T16:34:37.212186Z","last_seen":"2026-07-24T19:34:26.252117Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa4df8e86f3f58ee54a5fb8bb0073135","sha1":"56a08017ad95f784211bf374078ce99001a0fc36","sha256":"32947a75173ec653effd0c2e70b298b7b2104ba1b99ca8c5f519feb154370d17","sha512":"18520b280b1b77929cf12f6ba08e0e2af614269af3b0311a9072c850c2968b49bada0b1cdf6c5cf293b87692b3c04b3edc78e54a0ea553f56282ef7b208c4930","ssdeep":"768:hyZBaFHK3w7X/K93OqZwjKeBa4ZeIVNb4s8dpi+q8QdANKaR:hOstv+iVjZeIVNb8jqhKUaR","tlshash":"66f2934623e5a2398647f0a89d5fd850b1385f0b2689dc9db91cd0c8af6097c45beefc","size":35001,"data":"","first_seen":"2026-06-09T16:34:37.213647Z","last_seen":"2026-07-24T19:34:26.252625Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/help/help_en.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c465195fb82acbf4178fe47ec327ce47","sha1":"6afeeb927db7267aeb2e5c6fe2a4b7278f2c4992","sha256":"c61977af984b8a1f9ce8dd367c43d245e0ec4c598e2e9d3580db3c67f1ef5add","sha512":"dc018e8035b70103fa2879aae939a682a9b6398ae176f472bf587a104c71cb6da1ba593f59b8e406f0bce46488c3768da09d0641294be234a2437e46e8383dbf","ssdeep":"768:LgOeb9D/LQ3XnvbZ61NYsiXyeZQzgbw2Uf7L17GtTdYutKwBlLjAlkQ+jjz:L+7HYsZcKgbw2Uf7AtRDtKuVjAKh","tlshash":"5963d50712cb3331097223afa91de2e59b25801f5e657019b468c2f82f9e52fd3769f6","size":70279,"data":"","first_seen":"2023-05-18T00:24:29Z","last_seen":"2026-07-24T19:34:26.226627Z","times_seen":245,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"84ca9105786ae2b154d80a303a16c554","sha1":"89a440032d9d700c80ed63479fa2df9b10f560ec","sha256":"5fa02bef284913b9c2e4b574f73003ee2963494217f5d46316b528d82a806a1a","sha512":"b0c199a31e9827b359bc3727141b7e563fb4ee341446c4749b39fe5e7515b8a81b8e8c493426bb347c9b05123e7fb22d707d2b6ad308c7f771ea4b129b4a0eff","ssdeep":"","tlshash":"6111ed3354ec143747673c28083aaf9cbe817a04a310c4cc8b9c81695d38b0e960cbfe","size":990,"data":"","first_seen":"2023-03-07T13:11:39Z","last_seen":"2026-07-24T19:34:26.276398Z","times_seen":479,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"8912f9ff3a867ac213d048de46b43c60","sha1":"22702fd831b6db082cdcc5b67d2720b48a03a83f","sha256":"46c2c7f614270b9f981b431264c28864e94f12996dc460dd805450377d0077be","sha512":"17124c7b98622b89d7d10039a307c76e096399f0c4f47067268fa735f82db506eee45df3aa3061e1d79711ee0dc589c0b0a184324a0a46b84df4cf0ad7d47353","ssdeep":"","tlshash":"b2a01200189e246045131720301b50c299548c72130c3435d134848c1c00459c1f4267","size":85,"data":"","first_seen":"2023-03-08T15:20:33Z","last_seen":"2026-07-24T19:34:26.25704Z","times_seen":324,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"dd1a8db89627a5d73240881f47227db5","sha1":"d04de8edb28f65f10aae07ef2aa21a5c81a89c78","sha256":"e9e63ae8ddd501395b2f43da640c1f30d5b2911113e7db261e780f538948c229","sha512":"89f268400778bc50b1e756c5e4c422967962036a3250e102ee1fb2903862624452d583a077b26bbc631657af706d22cda16a998e693725363b2e8f4c81a13f06","ssdeep":"","tlshash":"70b022f830c200002033b0ec080fabc8e332382030a0cba3c0a0c0208c0e0ba82be8ce","size":87,"data":"","first_seen":"2023-04-15T23:50:07Z","last_seen":"2026-07-24T19:34:26.270331Z","times_seen":387,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"e713da78e1bcb00acf4b5a782a56b9b6","sha1":"2272f4d4dcb8f10360c5a7f080cf5560be4dc847","sha256":"f3e8da2cc8a516c11fcbdb364be4d3b2e4be88d7b3dc47cc1c93a5f9b0e91277","sha512":"5c631ecae14692194b53f45c3c22d6f406014bd4598f0f25a5b05b5fd2b3d65eced5640bfc4b5cb03525404b45a1932c43cc706911b334f8abeaddd409beeede","ssdeep":"","tlshash":"4d81c36260781a3bb26534590c3eabcebec97e02f758d9cc831c98751a7d91df0844be","size":4020,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.260871Z","times_seen":337,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3f87b95ea40712f0b9659b933465538","sha1":"ddb52cb28e5b72a3751426702f35301a85bf3e0f","sha256":"395cf3a0af6861cc09057ebf2e266a93d7773a27b7628724db2e6d98f5b93871","sha512":"e606ae37d657d5e4458ca03e43bf4a9b01961e433eff70a39694f96edf42db0e04c614ae9f5e5ff08a82abff40bcf077f163aa45ee38ad051e2565aa297ae2b7","ssdeep":"","tlshash":"44d022ab0d1182580eb4b012a213eb1cf032c092fc048280356d61212fa0ae3880c820","size":198,"data":"","first_seen":"2026-06-09T16:34:37.208447Z","last_seen":"2026-07-24T19:34:26.250462Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d14471d3c4162e94d13e3d61ce4702e","sha1":"b6dbf3c269562327f99db53d3e6a0f8e7b705868","sha256":"364fbde1390d22af13e54e1ab3eea5f3630754ee5587349ca801ce38da3028bf","sha512":"bb23eb22f7fc2ea66d408c14c3f9f6a2ce5bca7efb697f7dde1bc17ec6b04b72f6200ccf0f642206b148720ff46c6486bdfea96bf7ce8cccc02558f7f8ed5e9f","ssdeep":"","tlshash":"61e0e584980640d808722232ab73b7203a037327a8b0c462ff5e83443fb1a8bd3693c4","size":428,"data":"","first_seen":"2026-06-09T16:34:37.210016Z","last_seen":"2026-07-24T19:34:26.25104Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8dcc3fb5674f639fe8ed8fd4dead0a0","sha1":"7f2cebf6c2c46675446881338c6c3ce1646144db","sha256":"57ace124d013771d895b1d20e74c66bce27cb218368206eb7b1e4b165fc49d04","sha512":"5499525373797aa910f02380ecb1c3a07301c6f322a8ab2bae1f149f2237874878af84ee6f6707fc98d9efa8c715f54b2d5847754b4f3aff39df457c5f640c02","ssdeep":"","tlshash":"8c31355b178317344a2722b793aba360243590239b1af604ff1d0824afa974f90f5eb8","size":1604,"data":"","first_seen":"2026-06-09T16:34:37.212186Z","last_seen":"2026-07-24T19:34:26.252117Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa4df8e86f3f58ee54a5fb8bb0073135","sha1":"56a08017ad95f784211bf374078ce99001a0fc36","sha256":"32947a75173ec653effd0c2e70b298b7b2104ba1b99ca8c5f519feb154370d17","sha512":"18520b280b1b77929cf12f6ba08e0e2af614269af3b0311a9072c850c2968b49bada0b1cdf6c5cf293b87692b3c04b3edc78e54a0ea553f56282ef7b208c4930","ssdeep":"768:hyZBaFHK3w7X/K93OqZwjKeBa4ZeIVNb4s8dpi+q8QdANKaR:hOstv+iVjZeIVNb8jqhKUaR","tlshash":"66f2934623e5a2398647f0a89d5fd850b1385f0b2689dc9db91cd0c8af6097c45beefc","size":35001,"data":"","first_seen":"2026-06-09T16:34:37.213647Z","last_seen":"2026-07-24T19:34:26.252625Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"bdffe696a2ef77fcefdd6bfef8c18f4b","sha1":"13106d61c06af58493353525375261336e27e13c","sha256":"326040af879ba3ee9fc7ea2b6952e625d2199ba43243456941c3481f4f3d8692","sha512":"74af611c2cc69fa759be6560702f3d4a53bc02c838fd0f04505a0cf52035a31daa09afd26a9d90ed59b8b259eb76867a1181128459b9c422b35a23f685c0a735","ssdeep":"","tlshash":"61a0029a3cb1e0515a53566410776b586224e4609c95cc4040e4e5551df22b8b61a95c","size":63,"data":"","first_seen":"2023-04-13T07:45:37Z","last_seen":"2026-07-24T19:34:26.275723Z","times_seen":727,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton/app.js?_dc=20250925182304","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a7955c09ed52921f76487fd132192822","sha1":"9bb6db0469689511ffb3e3c105bb46553683bcb4","sha256":"456c9185410f42248f91bc04db9a0b6d9613794f8dcb8377c169080ea5d2039e","sha512":"02eec35001c23a981734f2baec0aec3ca460537d9854ae515d9060d976cf13a897554482745cd410c088c3cbc7c73f535a519868a0feb05209c72ae11750589d","ssdeep":"24576:/DLDCYXgnGcqmYqkG6IvVHW0wdvjjtHlfqWipt:/DLDCYXrclPkG6IvVHlwdvvtFfqWipt","tlshash":"b6d54b9532c13876d2ea3378a2af250a6b7a25a2d94880e0f779d4db5d785c71037f3c","size":2894019,"data":"","first_seen":"2026-06-09T16:34:37.233086Z","last_seen":"2026-07-20T20:55:16.901405Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"1b18afe07537bbbe1d5b1103c6608d53","sha1":"1dd634ed05b2e80da608f3a4635c8d9877a14c35","sha256":"309829c2c0cd73af01d857c5ec34280805f19a50db39be6d05bfdfaf2fe68596","sha512":"08a3c8a263fa6280d6d0b60e891f711e67121504558ab972fd90abb3eb9b001d9654a5b849973848fb0f95faa06c1254a42b9a3272aa4eb5a3e21a1f8ede9bdb","ssdeep":"","tlshash":"44f08b536138103ba22938295d2daecdaec93b01e344c88cc30d98b45f3aa0ce1445af","size":574,"data":"","first_seen":"2023-03-07T13:11:39Z","last_seen":"2026-07-24T19:34:26.269602Z","times_seen":359,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"85cc3a7f9d3b1592b851aaa13ed4cff7","sha1":"52d4dc773a4181e701ed82a3628514ec409b2af1","sha256":"e09cb667d522383972dc067cb777d27ad6154b0439683b494044a7962640411b","sha512":"d2953cff3c185092bc592ab1d9847eb7c878b21dd2e3a75a4b08e8512ceea7c8b669e8f9c7cc9b89b56dc2d22833a9634ee33062d92eefb17ad20ec9ac072615","ssdeep":"","tlshash":"e2b0924058af64a04a675a60351b90929da48c73230c387ae2b4988c1d404aac2e826b","size":119,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-31T21:48:44.765026Z","times_seen":397,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"35d334f0233280586b4434c59291ea2c","sha1":"e43fac0ae20640c927de963d6287942fa5b23761","sha256":"a731d04ccc2aae3a10411f5b4c23c1d492cb2f4003625401861571809623746a","sha512":"dc569334078ebeced8cf6c322fb78f6ab1c05d32fd662a5de863bd3d78f8cd0ae49e1fad481a0843313447fec5d3e32001d67ccc20a4c331cc3cb311a2f93562","ssdeep":"","tlshash":"a4e04c7511c81ca12035e1a6777be6dd731679d4f1d0d54c41a19154185bcee8df4887","size":338,"data":"","first_seen":"2023-05-18T00:24:29Z","last_seen":"2026-07-24T19:34:26.258704Z","times_seen":329,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3f87b95ea40712f0b9659b933465538","sha1":"ddb52cb28e5b72a3751426702f35301a85bf3e0f","sha256":"395cf3a0af6861cc09057ebf2e266a93d7773a27b7628724db2e6d98f5b93871","sha512":"e606ae37d657d5e4458ca03e43bf4a9b01961e433eff70a39694f96edf42db0e04c614ae9f5e5ff08a82abff40bcf077f163aa45ee38ad051e2565aa297ae2b7","ssdeep":"","tlshash":"44d022ab0d1182580eb4b012a213eb1cf032c092fc048280356d61212fa0ae3880c820","size":198,"data":"","first_seen":"2026-06-09T16:34:37.208447Z","last_seen":"2026-07-24T19:34:26.250462Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d14471d3c4162e94d13e3d61ce4702e","sha1":"b6dbf3c269562327f99db53d3e6a0f8e7b705868","sha256":"364fbde1390d22af13e54e1ab3eea5f3630754ee5587349ca801ce38da3028bf","sha512":"bb23eb22f7fc2ea66d408c14c3f9f6a2ce5bca7efb697f7dde1bc17ec6b04b72f6200ccf0f642206b148720ff46c6486bdfea96bf7ce8cccc02558f7f8ed5e9f","ssdeep":"","tlshash":"61e0e584980640d808722232ab73b7203a037327a8b0c462ff5e83443fb1a8bd3693c4","size":428,"data":"","first_seen":"2026-06-09T16:34:37.210016Z","last_seen":"2026-07-24T19:34:26.25104Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8dcc3fb5674f639fe8ed8fd4dead0a0","sha1":"7f2cebf6c2c46675446881338c6c3ce1646144db","sha256":"57ace124d013771d895b1d20e74c66bce27cb218368206eb7b1e4b165fc49d04","sha512":"5499525373797aa910f02380ecb1c3a07301c6f322a8ab2bae1f149f2237874878af84ee6f6707fc98d9efa8c715f54b2d5847754b4f3aff39df457c5f640c02","ssdeep":"","tlshash":"8c31355b178317344a2722b793aba360243590239b1af604ff1d0824afa974f90f5eb8","size":1604,"data":"","first_seen":"2026-06-09T16:34:37.212186Z","last_seen":"2026-07-24T19:34:26.252117Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa4df8e86f3f58ee54a5fb8bb0073135","sha1":"56a08017ad95f784211bf374078ce99001a0fc36","sha256":"32947a75173ec653effd0c2e70b298b7b2104ba1b99ca8c5f519feb154370d17","sha512":"18520b280b1b77929cf12f6ba08e0e2af614269af3b0311a9072c850c2968b49bada0b1cdf6c5cf293b87692b3c04b3edc78e54a0ea553f56282ef7b208c4930","ssdeep":"768:hyZBaFHK3w7X/K93OqZwjKeBa4ZeIVNb4s8dpi+q8QdANKaR:hOstv+iVjZeIVNb8jqhKUaR","tlshash":"66f2934623e5a2398647f0a89d5fd850b1385f0b2689dc9db91cd0c8af6097c45beefc","size":35001,"data":"","first_seen":"2026-06-09T16:34:37.213647Z","last_seen":"2026-07-24T19:34:26.252625Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f571e193123574fbfc54ef01d306e4a5","sha1":"b26418b8dceddcc07b277d20a0b134aee13f26a4","sha256":"e5f9b0b80aa74e2a3999f6ad1df65b5c4c440760091ae28f1c2418c5aa624756","sha512":"c065e776659275c85326d6717f2f6513bf063941c223c37d48dc527c249b87086d24e22c27e01c8e52b2d779d57a85a06c710ecba7b22e5e2338b5f089ad5037","ssdeep":"","tlshash":"d19002f474c250444173316540561984d068552030a44a628150d4a45c55061822959d","size":47,"data":"","first_seen":"2023-04-11T22:28:09Z","last_seen":"2026-08-02T14:43:13.467488Z","times_seen":2244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"5765b77d2771f8b826847032831bdffc","sha1":"01cabea9a1a2329ad67f8fbf02205201d12d0f87","sha256":"ccc6b15a22a91b5e918aecfeca74ab1f147dffa9a438a5a792b44c29ff7556e6","sha512":"7fc6100767616efd904ed1897768d067c60eb4fa3df05262b68834a22b8ee947b5bc7bc6c3deb9573e3a70f96966825f2c8dd87b5b58b9c734f0fa6128a3e224","ssdeep":"","tlshash":"0921e8167578167bea003c64182ece9cbbea3e01d742c9cec29c98610a78c1dd0891fe","size":1342,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.273349Z","times_seen":320,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"feec669da0deab0d8854683417eee2f6","sha1":"b1ba7527d84cc22d731b6c09a242d22fab4425c7","sha256":"f4ff9556355bbff09bd308e5e908bc6ce4708a52a5a9fcd0f4948c1a2436d395","sha512":"25601a608f51530923d66421d813d569ee12d43d24bffe6be214aa7ad216a063e82a7575fa5ce07c73dd9b8976d7808cbe9a33f3dd4b03d762dc786abcf69dd5","ssdeep":"","tlshash":"f321d22264681a3fb216381a1c3e9a8deec97e02e314d98d830dd9605e3e92df0454bd","size":1119,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.274897Z","times_seen":319,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/icons.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"68fd3cb047854374c3d1866166683557","sha1":"67fcc61f4acbaad97a475a95bc8f21bc57bdcdfd","sha256":"5485e2fbe9abcc48d9b696d335e9fecca74fcb2952576231189281a9c6bd5847","sha512":"18dc8ea2bfdcc3f49934992e911253ead20051ea9efd4248662fcd039715a0a3aa1409306861fa821262cb5389318269905d76b6a3a60a06102532cbf598850a","ssdeep":"","tlshash":"fcf0a0904e61fb7b811c4c9fe55d76226c4f0523f98bd5bae4f96dde00aa061988ccb0","size":475,"data":"","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.225952Z","times_seen":293,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"9a2d7b075b0cb797b76bfaa036a8cdde","sha1":"35ccb827ff6e8a6e9587eee06dd39551e8b37b0d","sha256":"99bd6786600a5a877019a76094d6ed57dc21a8f31698263a938f115fde7df0c6","sha512":"b9426712f817dde8e2fb8a6f060ff8fcce0db7fb26cfa5e122b8635e832d2486459d5c94ae30a4bda8e1a6a2d20152288187c5d4c2cb289ab3dc90ca548d746c","ssdeep":"","tlshash":"28e0c29378ae6533a7013c10251e998dbeea6d08a3619488c01c88d906ba95c86486be","size":301,"data":"","first_seen":"2023-03-07T13:11:39Z","last_seen":"2026-08-01T03:08:49.697541Z","times_seen":460,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"web3agree.com/mbilling/icons.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:04.977Z","timestamp":1781022844977,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/icons.js HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"1db-64f989504b180-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5jmbBct3KoZAtm%2BSAPApLDWbf%2FlwAYu12GFW31ksDL8cZzfXd6SnNSke410fbvN2pm8llr9Jh7L8SMJ6c1G7Mw5jt8FhLLrIfFwcf%2FNF7OHEcyGYnFJYzTnDlYZAZHXU\"}]}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 267\r\ncf-ray: a0918aad1ddbb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":475,"size_decoded":1013,"mime_type":"text/javascript","magic":"ASCII text","md5":"68fd3cb047854374c3d1866166683557","sha1":"67fcc61f4acbaad97a475a95bc8f21bc57bdcdfd","sha256":"5485e2fbe9abcc48d9b696d335e9fecca74fcb2952576231189281a9c6bd5847","sha512":"18dc8ea2bfdcc3f49934992e911253ead20051ea9efd4248662fcd039715a0a3aa1409306861fa821262cb5389318269905d76b6a3a60a06102532cbf598850a","ssdeep":"","tlshash":"fcf0a0904e61fb7b811c4c9fe55d76226c4f0523f98bd5bae4f96dde00aa061988ccb0","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.225952Z","times_seen":293,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton/resources/MBilling-all_1.css","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.475Z","timestamp":1781022845475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/black-triton/resources/MBilling-all_1.css HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all.css?_dc=20250925182304\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 02 Oct 2025 14:52:28 GMT\r\netag: \"51597-6402e2246c300-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MSF1ELH0eh1KlHDBiXa6r327%2F6%2FCgMEzbMdbB35VLy16vaLMsEu9%2BMcnkEHoDctV0oV7OefwdQQqE1bC3p9wxm8wclTxom5PBrz2R74H3PWn6c9qanqAtlVTI7P7hBZ2\"}]}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 33633\r\ncf-ray: a0918ab03e24b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":333207,"size_decoded":34376,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b02667df5f97b90cc3e3a7c62beca2cf","sha1":"675d1d600b7e9a58954f3dc7b513956408a6500a","sha256":"b8a185a33c4fd0f32903acff66d232d952cb2628c41ee5fc75f15d7c64057c6c","sha512":"f39c69edf2c4a93e2ef4b2e3dae8925bf9b64569eeb1e8b60425605d9701286bc5b55a66e8708e3506c4f935b4ee289407ebd4d9cd4fe315acac7e8f4793cbdd","ssdeep":"1536:n9gvKXySt2hJriSskW5yYII4XW7z1TgC9mRPTSC8aPaw3YIxyDfNqj/2pa9V3auX:Mh","tlshash":"85647121b089156f2b2fc607d85c6abbf79b0a4ef5037a94b1a13de843c99cdd271319","first_seen":"2025-10-21T07:23:30.556647Z","last_seen":"2026-07-20T20:55:16.841941Z","times_seen":8,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/locale/ext-locale-en.js?_dc=20250925182304","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.072Z","timestamp":1781022846072,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/locale/ext-locale-en.js?_dc=20250925182304 HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"1eec-64f989504b180-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HNqFlczQahCM7V8L7q911YayRZJWcd1AhFCUeFhVeip4Pwv9bVHhZSj4k9fX40dFjjf3sjxnGKP4Ymo2V%2FdmpvDiHTowvYhhNWo06JNqDkUthlSYxRiosS9cQ6dc7q%2FB\"}]}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 2577\r\ncf-ray: a0918ab3ee5fb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7916,"size_decoded":3323,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (7198)","md5":"e8cadb178e1334f0240f22ba2b01df65","sha1":"f782acfe62b9bbae7669c2b704b517f0468572e9","sha256":"9dcfd9ab3878dabba91f354a4b39df52d62cd651e186768cce5f5b3c537bddb8","sha512":"1df14cac0ee04b83ae4c98c9ecc3c2adde3b71f33565800bf180f50325e554d1c33f9d0a9e9f2172ace7d15b3e692fb5bd8610a4aa9e3ca8882a56364e16ef6a","ssdeep":"96:lxVDyq40gITSehIiZQo+CgqmwszDYFw9zQ+3gQ43+IfQe3IXQeQJ3/QQ3LmxQQ37:bQ70gAmmBM716IAN59DN6U4lx","tlshash":"cbf1894c450a913512420397afce198767d483fac9a784d2b159cd273962e9c11fffb8","first_seen":"2023-03-14T16:51:00Z","last_seen":"2026-07-24T19:34:26.229467Z","times_seen":260,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/images/lock-screen-background.jpg","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.228Z","timestamp":1781022846228,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/images/lock-screen-background.jpg HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all_1.css\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nlast-modified: Fri, 04 Oct 2019 19:53:41 GMT\r\netag: \"2f914-5941b0f0b9b40\"\r\naccept-ranges: bytes\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rkojh%2BeCUQllD6FXdxWgM8D58LCN2NjbT1HSZnXpbjQs9lrkZHfXB2FBKVDCAZlPRVV8ylSpxB%2BSNH%2BWGCL%2BKj5w4RQyouMuaXQs71TLyet3%2BpFC%2B%2BCGaBKUAauu0i%2FE\"}]}\r\ncontent-type: image/jpeg\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 194836\r\ncf-ray: a0918ab4ee66b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194836,"size_decoded":195537,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1366x1000, components 3","md5":"8a75850569164dbf93c15519500a2926","sha1":"8e3ac0e5f1b53f64e36539023bada7eccb5a074a","sha256":"321322f679a08dbf2f8955c403ec4d9d5f41c02a02811a43370e46e9fe0b82b5","sha512":"5a3c061fe1341957125d0d714dfce527604d1ccfb2e4579fc4c064c8bc0ba8dfda8322511360ddb4da3e0173694cbe961c91a90af6ba5cd5a2b5e30e98cfb817","ssdeep":"3072:JgR2Aln7DWljbMsjLn+2HBkHZwMKslNcIF4s+VwdxyosiBalDtgEEi2SZN2VxLW6:Jg0KylPhL+4BOOeX+VwdM4aMQ7NKx6WR","tlshash":"f11413419f2075b4fdb8533cfaaa97bc1ab440b4d114255d1062ed3bb0bb3ec6d4a4ab","first_seen":"2023-05-18T00:24:30Z","last_seen":"2026-07-24T19:34:26.243167Z","times_seen":215,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":131,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/images/flags/us.png","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.230Z","timestamp":1781022846230,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/images/flags/us.png HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/resources/init.css\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"261-64f989504b180\"\r\naccept-ranges: bytes\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w8xHG316vm1JaYE1qdcWLMd%2BMWQRpB03bGZKmekO1NEzdRSUIe72LCpxv59odtmzj3k20r9SV9dY6cze4QUGkyV8DJxLYaWy96WYUR1AoAODJ0fQOA7%2BHBH15x07v2W9\"}]}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 609\r\ncf-ray: a0918ab4ee67b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":609,"size_decoded":1292,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"968591e0050981be9fa94bd2597afb48","sha1":"dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43","sha256":"36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585","sha512":"ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219","ssdeep":"","tlshash":"9cf002c1fb856ae9e16a52610d7a16701c07c3a4217640a46c26ded41929f0dc2d8221","first_seen":"2023-04-07T17:29:43Z","last_seen":"2026-08-02T11:58:03.480737Z","times_seen":7972,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/fonts/OpenSans-Regular.ttf","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.238Z","timestamp":1781022846238,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/fonts/OpenSans-Regular.ttf HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all_2.css\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 \r\ndate: Tue, 09 Jun 2026 16:34:07 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gzZ7Za2%2FktQf82dDscL5f6Lw%2Buv8HRbjhGNoFpZSV%2BOKfbCXS5%2F%2BiTSK26kkWGqx%2FtBxr%2FXDEGFdGpmQsyNqP7D2Vq5b8jn04SkV0rynYL8n8y6e6stXWHwdJE7VdiBq\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: BYPASS\r\ncontent-encoding: zstd\r\ncf-ray: a0918ab4fe69b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":279,"size_decoded":821,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"099f5f3799d80cc8dbedb6681c592d16","sha1":"0fb20edd74c9267184f11de53ec246e0cb865b30","sha256":"44022e86159025b6f3661e2238eb97e037f7928ee87fcd3d68b99b79226b1aae","sha512":"39de02cc8920caae928ab222ee97752a0fe1136be1ed78119b1385acd8a5482bdc66fbd5735135408a9615ed05c20a6ae80b5ccf7fd037c9ff944a11c5e32115","ssdeep":"","tlshash":"ead0ebafa00f202d0e1323802ac22980245910f4e08748cc9a4ae48382d42ba8a0ad8c","first_seen":"2026-06-09T16:34:37.176504Z","last_seen":"2026-06-09T16:34:37.176504Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1750,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1750,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton/app.js?_dc=20250925182304","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.342Z","timestamp":1781022845342,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/black-triton/app.js?_dc=20250925182304 HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Fri, 13 Feb 2026 18:11:33 GMT\r\netag: \"2c28c3-64ab888fd3f40-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=prDuaMddYyspahAWKT%2FHUu9TucRdSyeedYHuwjngfKXWp8jVHmoPOoxHgg0eBNay2m5uh0lxjzkGi3PXzBSDZThz%2B%2FD6Xr92%2FSSXXhzq7UM3DpQTAhf1jhEMm8vg9wS5\"}]}\r\npriority: u=3,i=?0\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: a0918aaf5e09b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2894019,"size_decoded":795754,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"7b1aed2d5577aa0fdf7f37be9c5dd035","sha1":"1b92117e22ca9c5b58e9506bc553f796c6217120","sha256":"996c760ccea634010c741b17d5a486f4eec279e726281cb439e4ede6386c23f6","sha512":"80d39e36f7addb9c325cda5d0790327d37cc8adf5993cee75a0f530690702078de9db085176c185b468b3e7e60d76bd002614b04bbef5fa98ab9c638456a5a3d","ssdeep":"12288:XvBhLDZcYXLEn2dvc11jKsjqtFiYqkOnNsEu:/DLDCYXgnGcqmYqkGE","tlshash":"5c250bd973c2357686e73375622f110ab37b6892a54884a0f775d8dbad3468a403bf3c","first_seen":"2025-10-21T07:23:30.544316Z","last_seen":"2026-07-20T20:55:16.838151Z","times_seen":8,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":170,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-09T16:34:04.449Z","timestamp":1781022844449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 \r\ndate: Tue, 09 Jun 2026 16:34:04 GMT\r\nserver: cloudflare\r\nlocation: https://web3agree.com/mbilling/\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7%2FXHqumLfYbLJtWsztiWmtHcuL8VwkJ2Uo2OLzrbtFpKKS7b5MLY%2F%2Bp3QptLHvrUtO0HRXx3ZltwtGyMNH%2FGPulMpKN6pJsTUvDQy5Xsqi%2BlqboI%2Ff9H0FtlQsURXvRV\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0918aa9fda6b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T17:49:43.421481Z","times_seen":17675866,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":12,"connect":18,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/images/loading.gif","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:04.986Z","timestamp":1781022844986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/images/loading.gif HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"8ff5-64f989504b180\"\r\naccept-ranges: bytes\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UsBnnU7twEZpm8DhDTXM6AutFmaeWxAF012VTSxF4EEe9kyT7Aq1%2BwH7pehg3qfUYk5d2BYANYm9VTEubdGGvPLaS%2BFwhT%2BFJlvrg7ysx0d2qLzZUnt83A8bOM3c6TDq\"}]}\r\ncontent-type: image/gif\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 36853\r\ncf-ray: a0918aad2ddeb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36853,"size_decoded":37541,"mime_type":"image/gif","magic":"GIF image data, version 87a, 450 x 345","md5":"4a7447fd9c687514129a6ff5193e3f33","sha1":"6f83c8d8bcee89537e8bce62acc7366a8e1d0d42","sha256":"91385c3fc1ec258d8bd0b863251535eeaf458e321249c91cd9e732ece178909c","sha512":"e918cd26701eff786734a28fd134c648c2505639d6efb3603dfae86fe910b15b19744bb7bc25062c78d70edf459a500cb113d45cd70051dfe2c0b9b5fad58cf7","ssdeep":"768:Yqqp/n5nTMnNKOaPnAHdyFB2H22AHNPgMnNKOc:tmP5noNKOAoyz1dNKOc","tlshash":"1af2cf6752994ad8c6c5b1573dbedcac9ccb90eca268cbc57231d370f88129d40e85ae","first_seen":"2023-05-18T00:24:30Z","last_seen":"2026-07-24T19:34:26.243761Z","times_seen":277,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/help/help_en.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.117Z","timestamp":1781022845117,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/help/help_en.js HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:15 GMT\r\netag: \"11287-64f989513f3c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PvC6CEYiOr0WotenXYq2WZg6NkIHf7f4RY9ETpLi1q33hG1RxXGSwLTCg8evQERTadSMyQK2sJ8S6ASKNx5OjVBpUSQEpn9Llt1K2r5DVLDrofFpfcTW7c57mDQaK8DV\"}]}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 18358\r\ncf-ray: a0918aadfde4b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70279,"size_decoded":19102,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (319)","md5":"c465195fb82acbf4178fe47ec327ce47","sha1":"6afeeb927db7267aeb2e5c6fe2a4b7278f2c4992","sha256":"c61977af984b8a1f9ce8dd367c43d245e0ec4c598e2e9d3580db3c67f1ef5add","sha512":"dc018e8035b70103fa2879aae939a682a9b6398ae176f472bf587a104c71cb6da1ba593f59b8e406f0bce46488c3768da09d0641294be234a2437e46e8383dbf","ssdeep":"768:LgOeb9D/LQ3XnvbZ61NYsiXyeZQzgbw2Uf7L17GtTdYutKwBlLjAlkQ+jjz:L+7HYsZcKgbw2Uf7AtRDtKuVjAKh","tlshash":"5963d50712cb3331097223afa91de2e59b25801f5e657019b468c2f82f9e52fd3769f6","first_seen":"2023-05-18T00:24:29Z","last_seen":"2026-07-24T19:34:26.226627Z","times_seen":245,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton.json?_dc=1781022845281","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.283Z","timestamp":1781022845283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/black-triton.json?_dc=1781022845281 HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 25 Sep 2025 21:23:48 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hrD4JMfAK1SU39YG4qktVbu3Wc9xCqD6JQ45g71w89Myhzn%2FVHw%2BUgKWGg%2Bz8uMS8ytLo6byYtTg23Aj9GzJUf9h0yyi0g0ASpdHVJp43rpnHeSeyplJTzXCbFq%2BqDWi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-encoding: zstd\r\netag: W/\"9e0-63fa6c8e78100\"\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0918aaefdf3b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2528,"size_decoded":1425,"mime_type":"application/json","magic":"JSON text data","md5":"faf1ad5db9692b65ee6e85a3cb3779b7","sha1":"68b6a7815e06b91574096f70a62f161ef08c7110","sha256":"f028ee822a4bf282eabae8b0cc59228365da96c961e7e253d93ce6752b01f621","sha512":"62d4958c378236e5179ada07ad840633689bd627f5df9d52ea56febcdb8668aaab1f44bbf88583eb108b69081c9db64af618bdc335b1dcd00e8e593ec7844ed9","ssdeep":"","tlshash":"cc5136404012deb609af43eb68417a65eb383166df8135cdd44d4b1484fb94f2513f9f","first_seen":"2025-10-21T07:23:30.536377Z","last_seen":"2026-07-20T20:55:16.858785Z","times_seen":8,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton/resources/MBilling-all_2.css","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.477Z","timestamp":1781022845477,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/black-triton/resources/MBilling-all_2.css HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all.css?_dc=20250925182304\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 25 Sep 2025 21:23:47 GMT\r\netag: \"292c5-63fa6c8d83ec0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WsZh0fqzsyoX9A6Ma36aDUmv1gaHXaM4EHuadypyrvl%2FvEbyz8gNBdeufnuGE06CNwBh6zwRynqZasZJbMLX4yTcgyQgA8fpdfXJyM3K8rPqLzmkrjR5c%2BKU4ZCchEGB\"}]}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 18277\r\ncf-ray: a0918ab03e25b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":168645,"size_decoded":19018,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"807b8b9ba119797bcb42216651ac1079","sha1":"143bf63820b2e4ad8633c2a4628b7b97ba815511","sha256":"dbacbda6df807ca70e84f1c53ef4959c713d64bab1261c67c8d0110b35d6a400","sha512":"96babb68040ddee773d95fd3afe543a9c810fc12efb2b8cb6371cb092a178cdb6c4547fc1b0da929c9a8968766452570d6d1db2c4eaca243688f5b7980fd8f35","ssdeep":"1536:+wrUTGBThlu6WW93Ex1y47lM4GFKRC5F/7QiVpdmY7+g+PDHZCcK/tQOwEQ/SYnp:6a5dVi7","tlshash":"acf312a6f0d901eb132bc10bde846b2f967ba345f1039d94f596bba843c16c61372b1d","first_seen":"2025-10-21T07:23:30.538714Z","last_seen":"2026-07-20T20:55:16.869714Z","times_seen":8,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/locale.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:04.972Z","timestamp":1781022844972,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/locale.js HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"6ec-64f989504b180-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CRI6YfufPkoPcYSwH%2F%2BZuvpAUtqLxFwpgzhW7GA3bPEQtVSE%2BtoENSjHs752peQEOGjQhr2aas2Va8ZPHXDuSySKPqSHmWI1%2Bcl3VfqxwGXvIK%2BgWpG3ivkSYGPwpBTZ\"}]}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 590\r\ncf-ray: a0918aad0ddab4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1772,"size_decoded":1340,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (353)","md5":"f3e17c5b027303bea5a626602ed8b8e3","sha1":"dbcc328578939308ae9a7d9251f216c00c8ee864","sha256":"6b7a10b0fbffc97be20f0d99e27ddcf57d251ae05831e8e9f089552570d2a5db","sha512":"0c33806fd387f2e9f7d07afc35959917f4fa92be738623419c4a356cec70c1a79d02a4808cfd0977e0c2d8707958512bfd0b993a80279cce4f0ed4d596630c42","ssdeep":"","tlshash":"ae31cd1539e23253115b73d043bf6619a01a32877120d8e8feecf2146fd5a2748b69fe","first_seen":"2023-03-12T15:35:43Z","last_seen":"2026-07-24T19:34:26.225224Z","times_seen":266,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/images/logo.ico","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.336Z","timestamp":1781022845336,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/images/logo.ico HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5yiaA8t%2BUq8nhxIrh3TeRS0FVyHgv7QDqc4uoiOV4RpcTJKccXjxaXEljwdubwF%2F4Aoh0tyJDbbLuf5t0%2BJ%2FOreKfJEFpBrjRMloqZ%2FQgAaqhOs5Swj61uggmUUzYnVv\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: BYPASS\r\ncontent-encoding: zstd\r\ncf-ray: a0918aaf5e03b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":279,"size_decoded":817,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"099f5f3799d80cc8dbedb6681c592d16","sha1":"0fb20edd74c9267184f11de53ec246e0cb865b30","sha256":"44022e86159025b6f3661e2238eb97e037f7928ee87fcd3d68b99b79226b1aae","sha512":"39de02cc8920caae928ab222ee97752a0fe1136be1ed78119b1385acd8a5482bdc66fbd5735135408a9615ed05c20a6ae80b5ccf7fd037c9ff944a11c5e32115","ssdeep":"","tlshash":"ead0ebafa00f202d0e1323802ac22980245910f4e08748cc9a4ae48382d42ba8a0ad8c","first_seen":"2026-06-09T16:34:37.176504Z","last_seen":"2026-06-09T16:34:37.176504Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/black-triton/resources/MBilling-all.css?_dc=20250925182304","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.340Z","timestamp":1781022845340,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/black-triton/resources/MBilling-all.css?_dc=20250925182304 HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 25 Sep 2025 21:23:47 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pucUI0SaLqqqhTXtkvG5WcxdviaFPDCeauBfiCMDkXuiXdD%2BSKcXezxXD755Dpb1wZFA6n2zTTuQp30qQkQSRUEglXgkniswz8a5yPczLgHlhFDXNo8nX5J%2BdTuizPAt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncontent-encoding: zstd\r\netag: W/\"3c-63fa6c8d83ec0\"\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: a0918aaf5e07b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60,"size_decoded":722,"mime_type":"text/css","magic":"ASCII text","md5":"e4fc6cc6be63df1646e93541a99e502a","sha1":"9f1f9d0e8782a00f1a58da2f5b3c2a8b7781f379","sha256":"018e0c7b5f04314d091f574d9b46cd5c00c61216d1daf7f0f11cead3ab7e979d","sha512":"f74bce261a7571b2b377eff6ab64cf848cb75cdeb938014978e64ad9c6076240a48b2000c2b7ef896f2c981f8517db3d1476785405232b8cf61940fa3f0e112f","ssdeep":"","tlshash":"37a00206881c9a629282a38806b7221902a491440e213332cc0883b2ca02a0c3810288","first_seen":"2023-05-18T00:24:30Z","last_seen":"2026-07-24T19:34:26.237003Z","times_seen":275,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/index.php/authentication/check","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.075Z","timestamp":1781022846075,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"POST /mbilling/index.php/authentication/check HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 107\r\nOrigin: https://web3agree.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qRamY9JLzC0Dhrt6blylMCvT%2FLNy0Xwz4%2FLBIP%2FvPkS5nlEZ%2FpsFLTmhMZuaOpIWnvnk3gSBsEpePmjfB6AaIolv4lm%2B%2FEMYBzcSEP%2FWn2bC0vWGWoJEgjge2OeKPnxY\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0918ab3fe60b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":755,"size_decoded":1094,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"e9ca6f745405189b71fe1f48e7f7c0c2","sha1":"e9095e59dc065a166fb2470c3373ba602086a762","sha256":"f980beb182dbbc8e142ac503803f23209db5006249e0137d7a7b47b9a48e071c","sha512":"767d9e11a6a9a42d304dfaa8b0502a50183b20c8bf1688dec43695ba07c7f040cb852f6f3624aaa6055e2d03f48215d612419c47287aaebfb53c31ec4283c02a","ssdeep":"","tlshash":"3f01d81e136aa8ffe2a343b0e20c4a4c534d0a35b6803e04e8780f1c38e31e112f20ab","first_seen":"2026-06-09T16:34:37.195266Z","last_seen":"2026-07-20T20:55:16.873953Z","times_seen":7,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/index.php/trunkSipCodes/read?_dc=1781022846112\u0026page=1\u0026start=0\u0026limit=25\u0026group=%7B%22property%22%3A%22ip%22%2C%22direction%22%3A%22ASC%22%7D\u0026YII_CSRF_TOKEN=Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.115Z","timestamp":1781022846115,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/index.php/trunkSipCodes/read?_dc=1781022846112\u0026page=1\u0026start=0\u0026limit=25\u0026group=%7B%22property%22%3A%22ip%22%2C%22direction%22%3A%22ASC%22%7D\u0026YII_CSRF_TOKEN=Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zITHaUYzCh%2FBipfGvnr1DkjUsaPPVXq01jTNqxx9LgrX%2F8C7I6Jz3iqC3WZTRDkBKlXABIqb2QXdB2Tdvw7T2XffTW0Aokk0rs15LLb7xqTHUq6fWWyqkejjnqQZKyQO\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncontent-length: 42\r\ncf-ray: a0918ab43e63b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42,"size_decoded":730,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"81f295c32af81c6b8a0d15f8cdb7169a","sha1":"d9e2299e4dfe1e18a05231b33966379ee8b79139","sha256":"792ff70139220b4d9bb90f0ce3fd51d5c333dff7efd27c238fd487d5d8b939d3","sha512":"de10ba3b8fbf079f4d95f9770a910bd2226eb692b00668f85f70934c6e139d1fe0cb73b5f7238e9540306864b0ddf510be36276df34aa8229675bd6409ba9ccb","ssdeep":"","tlshash":"f790040f74357053151713c3f01d40313d540055d33c07cc450dd0440f1417471d3400","first_seen":"2023-05-18T00:24:30Z","last_seen":"2026-07-24T21:34:49.443984Z","times_seen":280,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/fonts/OpenSans-Light.ttf","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.237Z","timestamp":1781022846237,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/fonts/OpenSans-Light.ttf HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all_2.css\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=af73vcxobEjIWlzvLWDqFkUYIq4AmWt5IDsHLntB4Dg2xmqg9auiMwlNkCtBtPVT4UNb89seRZQIg7O34ZkNAITd9IpD5p0rREK%2BP5WZbrh0mIFpuPtLMk8b96k74Znj\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: BYPASS\r\ncontent-encoding: zstd\r\ncf-ray: a0918ab4fe68b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":279,"size_decoded":809,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"099f5f3799d80cc8dbedb6681c592d16","sha1":"0fb20edd74c9267184f11de53ec246e0cb865b30","sha256":"44022e86159025b6f3661e2238eb97e037f7928ee87fcd3d68b99b79226b1aae","sha512":"39de02cc8920caae928ab222ee97752a0fe1136be1ed78119b1385acd8a5482bdc66fbd5735135408a9615ed05c20a6ae80b5ccf7fd037c9ff944a11c5e32115","ssdeep":"","tlshash":"ead0ebafa00f202d0e1323802ac22980245910f4e08748cc9a4ae48382d42ba8a0ad8c","first_seen":"2026-06-09T16:34:37.176504Z","last_seen":"2026-06-09T16:34:37.176504Z","times_seen":1,"resource_available":false,"data":null}},"time_used":746,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":746,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/font-awesome/fonts/fontawesome-webfont.woff2?v=4.4.0","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:06.239Z","timestamp":1781022846239,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/font-awesome/fonts/fontawesome-webfont.woff2?v=4.4.0 HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/black-triton/resources/MBilling-all_2.css\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:06 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:15 GMT\r\netag: \"fbd0-64f989513f3c0\"\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wdFwQX1a7KM6GWWrGqFiuWKgf5TAIprjlHADB0%2FfSklXqyH6c%2BXQrlFJsHUWx%2BwwRWF9gbt46JH%2BYB2cgNr5%2B6qE2KI5GemMFY60X4hWi2RzoBJqpQ8EorDvZUgOsPVz\"}]}\r\ncontent-type: font/woff2\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 64464\r\ncf-ray: a0918ab4fe6ab4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64464,"size_decoded":65160,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 64464, version 4.262","md5":"4b5a84aaf1c9485e060c503a0ff8cadb","sha1":"574ea2698c03ae9477db2ea3baf460ee32f1a7ea","sha256":"3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019","sha512":"05196036c41398616c077925fc4bf252e81f11b6ebef8745047d75cb2c8b80441b8c3593f4d5b2617089e9f3d8d957f9edcdf8e43993661a277be8f4b6a32111","ssdeep":"1536:wOhGmmMET1VwoQNDerkOtxhncPvaAAGzw9jD8RlhANsK1q:JhkhVINDerkO+aAAGA/aANX1q","tlshash":"a753f162a0233101d19918bb7d39ffe22b01c1cee34659c7dda62c5338e5d5472abe2e","first_seen":"2023-04-05T03:42:19Z","last_seen":"2026-08-02T16:08:40.499509Z","times_seen":25989,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-09T16:34:04.612Z","timestamp":1781022844612,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/ HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:04 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:18 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=06H9pTRUfLQ8g2mGGSd4e8xvzzbXjUZ9rrDcaGa1HnNcBhSQKBxtmdwW4wDqlu4c5Cp%2Buoi%2FsietV8a87qBUykM5RNggJeGuOtqvwBNNutRB5bb1H3cB1oMY45e5cGWe\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a0918aaacdafb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38663,"size_decoded":12897,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (650)","md5":"4cc07d5807f52db97c386936f7c96c90","sha1":"c9e789ce8397d70c3f0daee3d2351ce6a8244e04","sha256":"f9ad064528ae750d57fe8b7b320b328fc5a255f49c1f15558cfa98f077dd104d","sha512":"2759850e92d8d346db026b3271a1810896791daf793a6e260e77c06a030cf4a2de4958584d02bd8d945e8c9ea83bff0a18e35e2531d973f2184c13c91d97ecbd","ssdeep":"768:tECyZBaFHK3w7X/K93OqZwjKeBa4ZeIVNb4s8dpi+q8QdANKaP:tECOstv+iVjZeIVNb8jqhKUaP","tlshash":"0803a44623e6a2398607f0b49e6fd850b1385a072685dc9db91cd0d8af7097c45beefc","first_seen":"2026-04-26T15:51:19.674433Z","last_seen":"2026-07-24T19:34:26.232075Z","times_seen":44,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/index.php","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:04.979Z","timestamp":1781022844979,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/index.php HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nset-cookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; path=/\nYII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B; path=/; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8IQPyafrpeqICQUyBhY3afl0iZ7lzLDjRtI8b1hV9ENd0f%2B99ZV8qQcoEvMHNt6dxrebLFq2mzyD1p4A97znTwkGBmtn3daTS2pYFKAVrM7Lt9rGs0UUrgwIIqsRxG58\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0918aad1ddcb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":817,"size_decoded":1422,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with very long lines (662)","md5":"79ae7c20541a4d572eb4f48e12d94cbc","sha1":"20e90d2ccb0038a98612e51c7cab67ad2ae6053d","sha256":"ee85d2756ee367c1c87328c7fa118e1e75078975ef571dc39bdb02e11965800a","sha512":"2d8356f2f4bfeed87ca4fb6b26a6a7b1d1afbb8407212fb87713d493d82c9722de62a0b354074f9e59651d523071cfc822ec178ae5f2cb6b0450ec52463ed255","ssdeep":"","tlshash":"03012c3aa05fac0530b06170d383bb0130a8ae88526026e43baa00787c45c0bcec69f2","first_seen":"2026-06-09T16:34:37.201242Z","last_seen":"2026-06-09T16:34:37.201242Z","times_seen":1,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/init.css","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:04.981Z","timestamp":1781022844981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/init.css HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:15 GMT\r\netag: \"831f-64f989513f3c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OXkrk5MxIhVMXd0AKxUsuGllXJ6yI25vvQ7ugFwjUxhygeftC5BGWzA0BQ6zTP2s5DhnB%2B8Ma35RrHLrYXI8ai9Hco4f%2B8n5kp8O4KhsPMP7lHt8ZbvhFLBBiflyLWK1\"}]}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 4666\r\ncf-ray: a0918aad1dddb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33567,"size_decoded":5405,"mime_type":"text/css","magic":"ASCII text","md5":"dd5687f27e37f3dc182cf6ca973f8859","sha1":"749637809bccfbdf2e1996905c4361f266e26711","sha256":"a8c4355cd8ad56abfccd12c7bfa9958e948ce694188958d98fd70098a915b6fa","sha512":"41559bf59e4653e670e7a78f6213b6907a8f5e0d84ce39a7fea6fd72292018e35ff1d315f8f2be2237b3cac2c57051f9f4bf70ec623fde47a35b6fa5dcd8714e","ssdeep":"384:KFM98C/dxLy4+BOFm25V3jlC4yh43y0PX57l7ug2VWttvyT:KFMHdxLyjYFmE5jlIEy/9p","tlshash":"ade2eb02e6fbaa872129a129b13ff23c6e6c49c6c759df3d73ad32f48f515918071468","first_seen":"2025-04-06T09:20:24.52543Z","last_seen":"2026-07-24T19:34:26.239774Z","times_seen":209,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web3agree.com/mbilling/resources/locale/en.js","fqdn":"web3agree.com","domain":"web3agree.com","tld":"com"},"ip":{"addr":"172.67.223.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web3agree.com/mbilling/","date":"2026-06-09T16:34:05.118Z","timestamp":1781022845118,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web3agree.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 01 May 2026 03:47:59 GMT","end":"Thu, 30 Jul 2026 04:45:42 GMT"},"fingerprint":{"sha1":"20:F8:78:C7:E2:7A:15:9E:65:41:DF:A3:59:7C:68:23:35:BB:C6:7A","sha256":"24:84:8D:93:7A:EB:2A:07:7E:8B:52:63:D9:3A:4A:88:B4:F3:1E:9B:92:18:18:0B:4E:0C:74:E9:9C:9C:C6:D8"}}},"request":{"raw":"GET /mbilling/resources/locale/en.js HTTP/1.1\r\nHost: web3agree.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web3agree.com/mbilling/\r\nCookie: PHPSESSID=uq3gtjbac668j5ai2p8glatpvh; YII_CSRF_TOKEN=3dc213e18ddf376578d425ecfeb49e8d6bd0ef69s%3A88%3A%22Qnk2SUhMSmZvYTlqaE1Pb0JpR2RoMVhaRUY4M0N6cVrieYHxP6XYGtFnuyvg1hFsw4OOw16SOjLPNUcPhbyGCg%3D%3D%22%3B\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 09 Jun 2026 16:34:05 GMT\r\nserver: cloudflare\r\nlast-modified: Thu, 16 Apr 2026 19:10:14 GMT\r\netag: \"754f-64f989504b180-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ga7Qq2b8Uio0OqOdIAYGbiP%2B7qRInYrBjTdjASnk8yUShlriCkmK%2FSwnLwdVGxTEf2KW9VS80yI5%2FgvShwt6qAy2qSsnkHbd7coTppHoY6FPP%2Bgjo45D%2BQWeQMB%2FrIeY\"}]}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-length: 7494\r\ncf-ray: a0918aadfde5b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30031,"size_decoded":8248,"mime_type":"text/javascript","magic":"ASCII text","md5":"9b9374b6f4b06d36c41bf24e913c7363","sha1":"f1538ad0de6608e34b3eb59c84172df203dde8fa","sha256":"524144969164c3940cd61a9fbac2a650827573c9bde22b18319e9eeeba82310d","sha512":"10a5e41b83a074cc511027a4691a4eab20c071b76ebd24e5599aac5ca8c4e6f86aceffbce56b1f22535d84c622d06b370e6944e3540e04475b096f64f10b9843","ssdeep":"384:mUtE4s/QHedOpNWnAdUzZPmsk3QXGeC630RJwYWLUBC5tP:mes/QHedOpNWzNhk3TKUJWLG6t","tlshash":"8ed24ff1891323214e844a9f653dee5031995277eec23167b46e9e182fef30e62f6436","first_seen":"2025-10-21T07:23:30.542475Z","last_seen":"2026-07-24T19:34:26.227239Z","times_seen":175,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"web3agree.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}