{"report_id":"7ef7d180-b8d6-4049-807b-a1f81d1bcdb7","version":6,"status":"done","tags":[],"date":"2026-01-10T21:11:21Z","url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"172.67.187.135","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"title":"DarkChange | Anonymous No-KYC Crypto Exchange","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T12:07:10.599133Z","times_seen":17761025,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"172.67.187.135","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-14T21:11:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"darkchange.io","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":35,"request_count":35,"received_data":5475407,"sent_data":15791,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-04T22:17:15.216142Z","alert_count":0,"request_count":2,"received_data":23484,"sent_data":979,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-04T22:14:09.841371Z","alert_count":0,"request_count":2,"received_data":61852,"sent_data":1134,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"darkchange.io/assets/index-CjBsp-NA.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a59c698990dfcd544b4ebe49092f9418","sha1":"f7e19d615ed34a34f4ed056d007eee24236840a2","sha256":"00889a47e4c4455bae116fdb029bee5c4a27a674303264de68aacd0a3ab63cb5","sha512":"a98dab05cd5c051eb3fbd7017e09a6bfc13ea09f47ee706b8d5563ee9e46b8df4d63289412164185f7822a337e9d52d80cf46cf1900acc658fcf591ca4de256e","ssdeep":"12288:FBMbZLUk1FUakPil+Axmvt4Oncspg0GsIrPfhfFjRB5IW5Rf7TrjOyfGkBXmsi/:FsfDUakPil+AxY2Oncspg0GsIrPfhfFQ","tlshash":"3fa43bd872a9b1255be345e4407f0203b2392966740c88a4f13dedeb3a7544a51bbffe","size":469986,"data":"","first_seen":"2026-01-10T21:08:37.483545Z","last_seen":"2026-01-10T21:11:27.894906Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","size":403260,"data":"","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DvjNr9xF.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/assets/index-CjBsp-NA.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iGK7qUL1Zm1XHzN%2FrR%2BMRij9drYWul5%2FXbiBIdCZlFjngYOSy%2FQ24g4%2Fni1nPIoRHNgqHzcC3%2BM%2FkLUL69nhwRTZCe3oukuadp%2BHTQQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a103dcc783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":403260,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/favicon.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u41NlUXm4buV9MbshKA4i8SO7q929FTjgR9GhoMAfpmx8pZWALsMpN58fdImMv4k4HVzSTvAIj4%2FxmVgyGdnEQCnHrLp%2FwjUB3D%2FGws%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a105e2b783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1858,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d2335719348bb9c812b0b4f622787277","sha1":"b5f058f14768511b2c949d4f699069c96d6a87cc","sha256":"61218aca550c43131d3d086719e05a245199336154d09c80b182fa0c98d5dfb1","sha512":"15af176667eb411847d43e1db14bb747c96b289d951f5893c1b025b310e2fbb0f937cc450a0f31d6ccb4b9c48c037ae5747f27dc8cf33e1b9554c39fd0160cbf","ssdeep":"","tlshash":"de3144cd3f64954455dc8fe67f21e09c5d67e0a1498d0892c05c9f8c98c1c7e6a06912","first_seen":"2026-01-10T21:08:37.46614Z","last_seen":"2026-02-14T00:24:47.943935Z","times_seen":6,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/kyc-free.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/kyc-free.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OMqfFCmAqvusVBpPNhzfNkKGh4DLZ3HseWf6YCI7NhEFeJb6GPGUBQpXWK5Ch8XUOi0IHiEm4JWNHzlCM0yUNoVl9i6rWh8u%2F0jeO4Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a118973783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39513,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"0732b07759b2ce99b92292bf62a0e5dd","sha1":"79a5e9a75770778160fca3e7b2686c73d639494b","sha256":"686e3397d5e7ef040072386ea5f21bfe56da909b90ce6e8ff6572559560585a0","sha512":"4c3c94af79f3abc9fedf13658b111cb4ebd5cf775d8b517b29792ff0f8ae7303d47fddff25f79b21991fad88b5255245c675ea7088145309307712cd8be94923","ssdeep":"768:EqnAH3O900rYwY5zDZGubkEF/i4YyCINxG3n2kYyW1ZvhsWrcZNOm+K+psM:tnAH3Q/r1YTPwX9Iy27yoxhrraONK+pD","tlshash":"b803027113081caf6abf6f98cf935337b357109b51f42a9a387cc915ae40d6da6889c4","first_seen":"2025-11-20T12:33:06.986503Z","last_seen":"2026-02-14T00:24:47.938964Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/planet.webm","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /planet.webm HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://darkchange.io/\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: video/webm\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rIjn09UUBAhdl19L%2Fc%2BYZx267LCbPELKatA%2FKPqfscfgfgRFJ1w6CHIaxirxqFVwlk7b44AHU%2FRGnFvQ5ZGADE2n329SmxKmGHfa26M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12bcad783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2197425,"size_decoded":0,"mime_type":"video/webm","magic":"WebM","md5":"782b38402bfd341b844d25748287fe53","sha1":"6dfb80dd7cc04209d4d73279949a964048066ee8","sha256":"eaee575046e7c8a145a65b5256dce7071b05860a7a9bdfcd853a539db5caf7c5","sha512":"125708ee7f7a8d428882b3d13336acd091acd55f079d61b0440e603e30875b9d4d337653806661cf928004fc3b790bb1a5808feb8fa8301933ec67272bf39f19","ssdeep":"24576:yIRCPkr0sjn1Gi1Gwd7iGkNO7CwH8KavtnkPFJvLwbLyglwRL1:yMCG/n5Gy7iGkNOmoaRk9lMbvlw11","tlshash":"ff252391ec2168d3d49226f4c33b4aa84015eebb1659e12f5d71f27eab70f4dd30a263","first_seen":"2025-11-20T12:33:07.040223Z","last_seen":"2026-02-14T00:24:47.927406Z","times_seen":7,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":147,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/litecoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/litecoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cI0NrZM4XkuOItxi%2Bzxejh132eSDhT4bHJ7%2B7EnYQIjvvdTK3ZW4N%2F8%2B8d97Pcu%2FvNwSJSTR5rYnp%2BGBQahGfjtG8ueOXGS86PkfABs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12dd2b783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4819,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"77825e6b48e1aa0efdd6258b271c17cf","sha1":"156ed22cbc742ce08b21e358466b95f7eab3084d","sha256":"69bc6aa46f2bd505fa719611d811a1a96c721d8bdbd296d3f2034332cc1c8f15","sha512":"99f1ff5cdd396ade45ca737792e2cf9e4aadf1499f1164563d6078b51279ef85459f55c63eb40df0f6898247d6c0a24efd51601dace2e4fbc5ae653a7b8561ff","ssdeep":"96:jgLevluwiIJoRsnysUajHBpIGbfF5E/zQHa5B5m7y/rYAhfvKCBLjHCd:TvfmRsnTjHBpXg7QHaD5m74DEoGd","tlshash":"50a181e64fe4b9d8a801d3f0e82880b23e5f20fa7a51ddf5c391ef49b61549d4c88c85","first_seen":"2025-11-20T12:33:06.993273Z","last_seen":"2026-02-14T00:24:47.925152Z","times_seen":7,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/api/auth/get-session","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /api/auth/get-session HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: application/json\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gxKo8nqOWPQDPQuEgR80PHNCzKPCjPhzkEGISTzAXTVYmi7AEhE6cRgsYMpY%2B6ZxVrGA3CxjEO8wn%2F6%2Bd40odc1KJUPViLd%2BmcCPt5c%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a1499bb783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text, with no line terminators","md5":"37a6259cc0c1dae299a7866489dff0bd","sha1":"2be88ca4242c76e8253ac62474851065032d6833","sha256":"74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b","sha512":"04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f","ssdeep":"","tlshash":"b9300000000000000000000000000000000300000000000000000000000c0000000000","first_seen":"2023-03-07T01:02:14Z","last_seen":"2026-08-07T12:01:12.247059Z","times_seen":281980,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/planet-exchange.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/planet-exchange.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DboKqQvR1kEV05RT3GewWJPnrQdweJF7OwzL5cG%2BIrkwPRW%2FOzeWIWYc6CMqm6LscweUE99SGNIq88PFF5N6PgX88ndqjopEs77gZP4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a10df77783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25117,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9a0df7edba2e41113eac5480b22034f","sha1":"1d2e39df073e7197c43d1a796dd47880fec229be","sha256":"842537925bbbc84f2bd8ad4e76aea408d97941bebdb77ac1d63d07b7fc4832e9","sha512":"74b3dec52f555020ae25e6bdc034353ae5f407e428ee1bb893e5b69eb29f01918469828fa6cfa6c699b7b98e4365b84fbfdcb03c351875a9d7fcdf4d9f96c3f1","ssdeep":"384:ISXJ/bJeUL3VW20CFmkmKmAmMmcmsmpmb:IQ/bJeU7d","tlshash":"e3b2f46ab31dec36e254c68cdf96c4a4114943e7d981c1e582a67f5fa2388c7192f3f1","first_seen":"2025-11-20T12:33:07.00015Z","last_seen":"2026-02-14T00:24:47.920336Z","times_seen":7,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/monero-exchange.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/monero-exchange.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s39uW6k%2F8%2BuhUH5Slv1t%2FyaDxIyEI%2BdOMGsV3yVDf6dLyCvCUNDxe%2FJeGqoibaGlv3eCDs5%2FBObafRyjiyldL4boQSPdbhTSROOSV%2FA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a11897d783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48718,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"4e7271e4d05843ccbf6c2c98a3e8cdca","sha1":"cb2fc166d2af582ed84731473d4316cf4e95c41e","sha256":"2a572c6a0355c5218ccf69724a328dd0d1ea2efea18b4166d85035c00fb35fac","sha512":"e8d287557f46c998c5c9b80ab7770ef917f1fe6f6851aaa258a5e0fc59cf0cc65f0211ec390770d228ceaf729d92429fbd86d61202609233a40ffb82e81df82e","ssdeep":"768:vN4svRdiiKG2ChsW6y3puA6FmZDDZHm7fUQMTldqOWj9Fn6QYguQiU6AS:vN4sDvKSOpy5YMNtHm7f7OWxF6QYggUk","tlshash":"4023f1a6be38843bb9838f6025c21f4a153192d05bbdac07d105c97c3f5e27e7a69375","first_seen":"2025-11-20T12:33:06.969884Z","last_seen":"2026-02-14T00:24:47.932019Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/kyc-free.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/kyc-free.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pzBWC6uukm5eCHDMm5MsRH00vlTuQ2hckl1KkvJ2jlEKz0ULNnS%2Fu5zUZpKqtRXYfDCKtI38ZCBAEKhF3VKc%2BUjrxiZwnSBRk4j8V0U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a10cf42783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39513,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"0732b07759b2ce99b92292bf62a0e5dd","sha1":"79a5e9a75770778160fca3e7b2686c73d639494b","sha256":"686e3397d5e7ef040072386ea5f21bfe56da909b90ce6e8ff6572559560585a0","sha512":"4c3c94af79f3abc9fedf13658b111cb4ebd5cf775d8b517b29792ff0f8ae7303d47fddff25f79b21991fad88b5255245c675ea7088145309307712cd8be94923","ssdeep":"768:EqnAH3O900rYwY5zDZGubkEF/i4YyCINxG3n2kYyW1ZvhsWrcZNOm+K+psM:tnAH3Q/r1YTPwX9Iy27yoxhrraONK+pD","tlshash":"b803027113081caf6abf6f98cf935337b357109b51f42a9a387cc915ae40d6da6889c4","first_seen":"2025-11-20T12:33:06.986503Z","last_seen":"2026-02-14T00:24:47.938964Z","times_seen":7,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/planet-exchange.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/planet-exchange.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lc3JQncuBTH2IG%2BcG6bSfcDueFrjRWPYExeMIY5KiY3fuWg8abhOuNKYhusHTt0wxLd%2BFXLvBdfmzWihhowS59iujxOrTnaAMymwR14%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a119996783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25117,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9a0df7edba2e41113eac5480b22034f","sha1":"1d2e39df073e7197c43d1a796dd47880fec229be","sha256":"842537925bbbc84f2bd8ad4e76aea408d97941bebdb77ac1d63d07b7fc4832e9","sha512":"74b3dec52f555020ae25e6bdc034353ae5f407e428ee1bb893e5b69eb29f01918469828fa6cfa6c699b7b98e4365b84fbfdcb03c351875a9d7fcdf4d9f96c3f1","ssdeep":"384:ISXJ/bJeUL3VW20CFmkmKmAmMmcmsmpmb:IQ/bJeU7d","tlshash":"e3b2f46ab31dec36e254c68cdf96c4a4114943e7d981c1e582a67f5fa2388c7192f3f1","first_seen":"2025-11-20T12:33:07.00015Z","last_seen":"2026-02-14T00:24:47.920336Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/bg.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /bg.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1hN1UAbLNzYeMOjrW2zT%2BoJn3Gg9UUzNf9ZIWzbgLGfzAef8Mr3lfyS1oAVla%2F%2BIKbIgUopIAJ50m7bTywOLYPnNj5LfTad6WiqJW8s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a11fa72783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1279669,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced","md5":"8dd0a57d41112e0aedb0f3ff9254a7ee","sha1":"40f2e7e2bb886eff989c72b738dbecfc3e51c680","sha256":"8521677e417954ffdc67682cc6b2178b918da4c9fa477a7a7c34cedea8c18962","sha512":"aa4691282399ff0e815f53e381e77597faddb4efefb67843805f8f91d34d697bdd0b5145dfae001d83f2b55455aaef81a30888027688c1f3450f858ab84772d3","ssdeep":"24576:HQVUUnx4DaGYHJxZiARoiHkSmqa+NCisalCELNdXe:HQVUUnqZYHDZRnHkSmzKC1rsLe","tlshash":"772533acec06977f7c638b2c767840b28e7d495fac50de17068606e4963a4245ff48be","first_seen":"2026-01-10T21:08:37.478969Z","last_seen":"2026-02-14T00:24:47.922324Z","times_seen":6,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ND5BLHtZByswd2hC8S5KORWD6%2B%2Fubj4NImxkMFOKa3zOj7jNv75vN1z2s3xUnqdxP2ZiNm8K0R3ly77hNofNtxIn%2BN61Fa78Rg7hjo8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12bcbe783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8349,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"050fdc0a5ab78cf933e179e594dc59f1","sha1":"afe95b5ccdd7e4332452b89171bb3a88deaa6ce0","sha256":"bd0c7e456e93f58ba5c74eb81ab6a7a4cecf02312d18df49043238f72490193d","sha512":"2009e207bb237bd98d78850a48bbbac25cad7f177968478400decc01c1c392b16b388f0b1f2499cbbc4334c195029710d3c291c7345c24d34d1a5891a7c63b9c","ssdeep":"192:QHoe66M/u81vs6HbSVEyYP+u59xMb/IJKs2g3tsjVIxd:oWz/u0Mq9oMKs1iWn","tlshash":"c302b6f97796a3f4d402f3f5d8189415ba1f24fa6f65cae8c3576d8af0420ad9d88c80","first_seen":"2025-11-20T12:33:07.016233Z","last_seen":"2026-02-14T00:24:47.928057Z","times_seen":7,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=JetBrains+Mono:wght@100;200;300;400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"43:D3:3F:93:6C:4F:F7:67:58:9D:D5:48:20:4C:74:A2:69:DB:13:9F","sha256":"8C:DB:D2:85:E1:AB:12:7B:1D:5A:65:A7:EC:22:67:6F:B3:A6:65:01:28:29:FA:D2:3B:01:8D:10:7E:4D:09:52"}}},"request":{"raw":"GET /css2?family=JetBrains+Mono:wght@100;200;300;400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 10 Jan 2026 21:10:59 GMT\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18248,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"439fa0c3a18151951b917f4c066d4618","sha1":"6ad61049c20e54cfee23f8ad23b997432c6d49fb","sha256":"c0e8d4ce3bde4bf9a196d76cfde67bf9cec57b502fb9e79463f0471649e165c1","sha512":"6fe5619e74c58c8d79e94dac294052faeef911fb66bd92131aba3b4a7116b2470fdcfe09bb10f1c9f2708b6bcc117a6e2fcec2ec41be116e649163a54c1c03c8","ssdeep":"192:XpUnpWpI3SpVpWNp5UwXI3LOWmKUXwI3kNWFrU+9I3ZAWYEU9+I3qnWfNU0bI3HL:XWnE0SnGAb2vAHSrwjGvYnL","tlshash":"8882baa1042b9440ab472cd273cfbe355e5e61167081d6bacffe1898adabc360374b4d","first_seen":"2025-10-05T18:48:25.541997Z","last_seen":"2026-07-04T11:53:58.283429Z","times_seen":35,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/hexagon-network.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/hexagon-network.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qT6oUIRCuRB%2BrT6I%2FDTHZIlQb%2FM%2F5p5%2BKCNS3%2FDbR6fUoWpfldqXUSkQ9wPYi0TfGrALn1mHZpFgaWf%2F7%2BeVhulqTW0huQGBfAoHe84%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a1148c7783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":129775,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6e9ee331975c0d3743dd79824b2dfc92","sha1":"083bbc9fa832080c3fd1a036c0ec0aaeb2b881a7","sha256":"745b4113dd37d7bf4b348fd2c27588acf413c4e865416e59f0c28154497f8d3a","sha512":"07bc44670dcf0f36c297e95c90bac8bdcb8e3d1ca8f30edea4bd1e7f5aa0e5c071b79edebfcbb58bc531be2071c94f3dab0a1b35da784efe34ffbed1e8cfdd16","ssdeep":"1536:nS5PTpMs3/ZMGfMGnMGrMGQMGjFQojGxU:aK","tlshash":"0dc352adb764ac9edb99c2c8ef80c4a9161e81b7e5c14180c35c7b2f5878d85a93f2d1","first_seen":"2025-11-20T12:33:07.021041Z","last_seen":"2026-02-14T00:24:47.937981Z","times_seen":7,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/tron.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/tron.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bwfjOz4nUd4Dv9eokHuWRMKdUUcosPeAegc0FZBvdzSmTO6mxX2TNPh70Cv3%2F3lmnWAlWqnw39EyUVqITFLuZ3QZxONc84l%2BFJpPYeI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12dd2f783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2111,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"50b335796a43739f53b9732e9b167c99","sha1":"c26fd4cfa54526cecb12424858e57976b46f379f","sha256":"bb42d2e24070425d1df58e434487095c19880bf0279137eee2948ce03854016b","sha512":"3904f93cae000daa5ca9599468c2b9f2fe40069d34c12152bcac406f5d2a3b2b264b7d1140797d80f36eff8807680b3f14fefb08a65d19d5a74c427a19b2407e","ssdeep":"","tlshash":"cd4105a94344a3d84901c7a8c83c5961713f31ea7fa4cea1ce52b74ba21e19e1dedcc0","first_seen":"2025-11-20T12:33:06.995862Z","last_seen":"2026-02-14T00:24:47.928876Z","times_seen":7,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-CjBsp-NA.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.553Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-CjBsp-NA.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:07 GMT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xxczu4xpzj4tuy%2F0cwM7ap9HEE%2F0YLZAzI3rTOhqe0YbtTc%2Bq8IxnMlUdXbm1MLa2Egyh1awgh1kc9vCIdO%2Bm6LxKiSvrXPre%2F9ZDKM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a0e48c1783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":469986,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (39664)","md5":"a59c698990dfcd544b4ebe49092f9418","sha1":"f7e19d615ed34a34f4ed056d007eee24236840a2","sha256":"00889a47e4c4455bae116fdb029bee5c4a27a674303264de68aacd0a3ab63cb5","sha512":"a98dab05cd5c051eb3fbd7017e09a6bfc13ea09f47ee706b8d5563ee9e46b8df4d63289412164185f7822a337e9d52d80cf46cf1900acc658fcf591ca4de256e","ssdeep":"12288:FBMbZLUk1FUakPil+Axmvt4Oncspg0GsIrPfhfFjRB5IW5Rf7TrjOyfGkBXmsi/:FsfDUakPil+AxY2Oncspg0GsIrPfhfFQ","tlshash":"3fa43bd872a9b1255be345e4407f0203b2392966740c88a4f13dedeb3a7544a51bbffe","first_seen":"2026-01-10T21:08:37.483545Z","last_seen":"2026-01-10T21:11:27.894906Z","times_seen":2,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DKSPX2TN.css","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DKSPX2TN.css HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:07 GMT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Iu5SMrwDsYztXqVe80Oj9fmt6VET4%2BNrfc9AD%2Bj1MCBflyiFxPf7%2BuBYW4phixy98B6tD7bUD4szbeYOW4qXNuf5gLrc5pbT6vi9Z4g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a0e48c6783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100444,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"89719c98189efe351b650ffca8cdee64","sha1":"6d058c9178604026ea851ff1cbe569ae30f94efb","sha256":"516a25388c9dd5497ab5d322db3fd2261dcba27e5e0b7093367e0e01311765da","sha512":"1a829bf01ab5078102428dad541f82fe8ef71811fb446caf4f4041bd34eee0f190e604be1c9cc821b932b146e96449dc1eaf546f5348edcacb9f7fe43e1c0f55","ssdeep":"1536:OFSkIaxhvG8cjWHRCWaFsEh6/QPudLAO0uql83K5ah2w:eIaxhvG8cjWHRCWaFN6eudLAOxql8a5g","tlshash":"6fa39360f225d53bbd23b9bd63acf44ca21aa1c1de5297edfa22601153c36f62863614","first_seen":"2026-01-10T21:08:37.484893Z","last_seen":"2026-02-14T00:24:47.929519Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30092\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 10 Jan 2026 10:57:43 GMT\r\nexpires: Sun, 10 Jan 2027 10:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nage: 36797\r\nlast-modified: Thu, 04 Sep 2025 17:26:18 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30092,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30092, version 1.0","md5":"fa41c43a3d8e68fafc0ec15acca8b6fd","sha1":"adbdfd9a78699a96a9705fbeb3470c2c653dedf0","sha256":"2ee17598a98d8a59e4df8152d015bec9ab8e4d5672cc0ab42bef806b568e3971","sha512":"936da7cff6f59919a72f564c6f1d3b78e1a3be000fb1ca712abea3266687846d53c25dcf1d1b78221c985d4e96dda91ced26a221d85e4521e3d661c71affa216","ssdeep":"768:eHpJRc2xEL2BUo6ulIYw1wXomue+I4oOf8oSY6fg:gp62Uo6kuOYmuTaOfwYmg","tlshash":"ccd2f18a71f9a1f874695de0b8ee9b54bf8ee3221ae7745610d10781d6e13083bbcc35","first_seen":"2025-06-04T20:20:25.58114Z","last_seen":"2026-08-07T11:48:46.320255Z","times_seen":2973,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":109,"dns":1,"connect":8,"send":0,"wait":14,"receive":2,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30092\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 10 Jan 2026 10:57:43 GMT\r\nexpires: Sun, 10 Jan 2027 10:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nage: 36797\r\nlast-modified: Thu, 04 Sep 2025 17:26:18 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30092,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30092, version 1.0","md5":"fa41c43a3d8e68fafc0ec15acca8b6fd","sha1":"adbdfd9a78699a96a9705fbeb3470c2c653dedf0","sha256":"2ee17598a98d8a59e4df8152d015bec9ab8e4d5672cc0ab42bef806b568e3971","sha512":"936da7cff6f59919a72f564c6f1d3b78e1a3be000fb1ca712abea3266687846d53c25dcf1d1b78221c985d4e96dda91ced26a221d85e4521e3d661c71affa216","ssdeep":"768:eHpJRc2xEL2BUo6ulIYw1wXomue+I4oOf8oSY6fg:gp62Uo6kuOYmuTaOfwYmg","tlshash":"ccd2f18a71f9a1f874695de0b8ee9b54bf8ee3221ae7745610d10781d6e13083bbcc35","first_seen":"2025-06-04T20:20:25.58114Z","last_seen":"2026-08-07T11:48:46.320255Z","times_seen":2973,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":88,"dns":1,"connect":8,"send":0,"wait":15,"receive":11,"ssl":79},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/CircularStd-Book.woff2","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/CircularStd-Book.woff2 HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cQc%2BzCdpWLLUxy2cYhm2ZIDFsWoKyOm0HkEid5L9%2BtMClh4%2BK7RribKUmu%2FsZprRcYlJdJ2%2B31ofKEX6h220EzZUfqLEQXF4htQ2V6E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a124b65783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/health","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /health HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: application/json\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q66AeQ6ZVrRqE9zJUKVaebx88V9ScSbCMgnjgqHl%2BYwW63Fu7eIWeZOyfIVgd870VlOk28VPJLa6ENP7J04rlXPpEqyxmfsh52GT4zU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a125ba1783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1e35f54a965c9179a663bbb635c4c6d8","sha1":"feeb9a4faf9b0e6b4ba3744b020bfe8b4e079a84","sha256":"928a770b73d9bb8076013f79c8e586e7e196564b2e63630bd627dce2b6e35dc3","sha512":"b6bf0c7ed30e73933bfba94c4066bed0d794e909cad7c6a45e309df707432d75f4700ffe7ac9783fc7bb80938f84435b3fb46ceac58c3f059ba42736185f1a3e","ssdeep":"","tlshash":"bcb0120112154cb5eba1812905013fb54d3d8133202610e4617ddb91003008a412f05b","first_seen":"2026-01-10T21:08:37.475516Z","last_seen":"2026-02-14T00:24:47.924403Z","times_seen":6,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pe6AVp4dBFB9r1sD%2Bglr3dvBDHU1CgH%2BzxPS934uJCpReiLsWXNi1fXDoFAtsGS%2B64VAipYYjFt1X4V76ZpSIihLzSSfnczaQNZ6eWA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12ccd6783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3562,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f2ca19ff8f70bdb98f8a23295c6554c1","sha1":"a92bedf94c89c359648204c82bbb969522c9844f","sha256":"9dc52b168b3878f38917328243b9df5715446b989a406257dae21d893063d2a9","sha512":"6b5265fe0b74b33ba788979a6563cc444f974e54da072107bc6aff6dc0f5505960378284b2fa58ab70e71f68d9414e479d5526c7addfd53cc1d4cc04b7922f6b","ssdeep":"","tlshash":"4f7195f99b5441e0a48adbbafc38d92b312f34f67dd58dd0c295fb05a4820af8d458c0","first_seen":"2025-11-20T12:33:07.027055Z","last_seen":"2026-02-14T00:24:47.915178Z","times_seen":7,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/solana.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.277Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/solana.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qn2z5fHERwskrdANVryjl2CR8AB2VEfVY6zvQZPz7G62obtMF53zF5l2HIC5pLjpoeF5wbHFpuUaneZRiuxrkVu8GnpWmd5XjKZt%2Bs8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12ccdc783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5991,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"416fc35cacf9a777fbbe7cd78d916289","sha1":"d13c9d2926450fb919ee86b6e8cad8ef483e8597","sha256":"181a3cbcc13de2a013f631adf6184cc935126e368c1ea1c2648abb45d9d2c19e","sha512":"e9b6a847d284183b6c0953af1ac0361745981dcaa416c2451b56172974efe9992d53071c2ed12dc4fad76fa58f138ecb4a70d648fdc6d37db4584f5e97e2c100","ssdeep":"96:etKqfj51GhuQt2MdDBTz5ZYrUxZ+DYydOYWLM48Nd/z/BYsHOoICXL:et7PMdDBTz5dxZQd5SMpbb/ruoIEL","tlshash":"4dc194d9774473f4a90be73ada2951b6f62b3cfe7f398e90c3049f166015109c464ca8","first_seen":"2025-11-20T12:33:07.017571Z","last_seen":"2026-02-14T00:24:47.917578Z","times_seen":7,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"43:D3:3F:93:6C:4F:F7:67:58:9D:D5:48:20:4C:74:A2:69:DB:13:9F","sha256":"8C:DB:D2:85:E1:AB:12:7B:1D:5A:65:A7:EC:22:67:6F:B3:A6:65:01:28:29:FA:D2:3B:01:8D:10:7E:4D:09:52"}}},"request":{"raw":"GET /css2?family=Instrument+Sans:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 10 Jan 2026 21:10:59 GMT\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3864,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"dca43b277460c23e27a9a14c5096cf81","sha1":"dd378607f32336115432eea3c36284f5672ac5ea","sha256":"107a699c736cfab5d0c7232b782bea6c67a51d69d0b9ee6edfee559d0ab5133c","sha512":"f91060a7721fc81e286cad521858489ca7e1dc89e55f9cd874a88854697b28c528ccb651e40add13996449f23bca3843ea8cdd2d48cf043291a836984259dd2f","ssdeep":"","tlshash":"a581eda0042fa1149b839dc2239e7f36ae1ea1603441dc259ffa24a8fc5ed794372b4c","first_seen":"2025-09-19T14:45:38.484925Z","last_seen":"2026-08-07T07:41:02.146821Z","times_seen":223,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":114,"dns":2,"connect":27,"send":0,"wait":45,"receive":0,"ssl":86},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/Gilroy-Medium.ttf","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/Gilroy-Medium.ttf HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: font/ttf\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uzEoWuQ72KUbYrwI5I0xIkA3i88ZNq%2BXj7kapShA%2FDvnXWs7IUhjM9pyBivmCJmerPVpr3ihI2o6PkuXvmHVabdqOoxaapgPirrvuls%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a122afe783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":143724,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"FFTM\", 22 names, Macintosh","md5":"c83281ae1ca703d0741a770ee7e7c091","sha1":"d7f893124bd4fff78805e69df31385ae113368be","sha256":"7b3c84352c6a0d8a3479b528b8d8336ddb1cef0da8b81dea0e41a930d56523fe","sha512":"11223ee72a122c347c1d2864676e8a05cff295c8739133aa3cccfc0cd64d73b7730b33eb94ea83bc32feb57b041ed5cba78eb8c65545f4f1e8983115eb087fa0","ssdeep":"1536:vYERginzY4PwU0Wll/wDLufOG89gTjtlqaIgjzpe74nf4wk5bzovhlUmDRXxMQnj:qinzYrUvyPuf49ytcjwktYwnnIdbRd","tlshash":"d8e33892f645735dcf535c358961d2acdfa19d3fedc807f7ae823a6201404b88aa1e8d","first_seen":"2023-05-08T14:08:29Z","last_seen":"2026-08-05T06:19:02.28663Z","times_seen":593,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":5,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-10T21:10:59.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jSduzr6mCq0Kyn66yfNIS08mE8lMmGF58afUA1RAVnyLaU9xjv19jnMUXzeHacuGz9Ag1gmZ3fgAdGra%2FmNKaLVEqlhot3c5ydaOLb4%3D\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a0cef3f35a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":14,"dns":1,"connect":1,"send":0,"wait":68,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nyJLlvjRz3j2T7zO%2Bn9x8CCzL0o%2B%2BFsevgCXIm4oYpfUx7zxRWWbsV8lgoZnLscmFpbwyMVMMPqF9XoF3HNMFpAQlY1Edaz0ytKTW08%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a10cf58783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":684,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0464d3fc8854d5aac9aed51e4dd925ab","sha1":"4310eef588596e0c745868e6726795c055bc29a3","sha256":"01359ad46a5603d37dcb4c061717ee9e9d5bcbd56f86b21ce170f98d6531cdd3","sha512":"1a2648379029e852f88cef0ffd133ca87b89efa4ef0837381393241e08b407ed68de18b1d7e03c85a1ebe3927e89d48ffafb56380c72b2f092bf2b93f4afdc87","ssdeep":"","tlshash":"83019ee073980f1cc71647bd4f0c297957feb1efba6e5480b9493557a98c03ba8c9880","first_seen":"2025-11-20T12:33:07.007615Z","last_seen":"2026-02-14T00:24:47.926149Z","times_seen":7,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UzhDSkinA4L4Tr0mxpmUECd4UaN5DXvEdIKwrazWoVI3i8Qb%2Fmtpukp1O1pEvw02Xi07Z4nND%2BOxbW%2ByS2ooVxHeniD0mRweDSAi3IE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a119984783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":684,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0464d3fc8854d5aac9aed51e4dd925ab","sha1":"4310eef588596e0c745868e6726795c055bc29a3","sha256":"01359ad46a5603d37dcb4c061717ee9e9d5bcbd56f86b21ce170f98d6531cdd3","sha512":"1a2648379029e852f88cef0ffd133ca87b89efa4ef0837381393241e08b407ed68de18b1d7e03c85a1ebe3927e89d48ffafb56380c72b2f092bf2b93f4afdc87","ssdeep":"","tlshash":"83019ee073980f1cc71647bd4f0c297957feb1efba6e5480b9493557a98c03ba8c9880","first_seen":"2025-11-20T12:33:07.007615Z","last_seen":"2026-02-14T00:24:47.926149Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BGWzMKxVyq3ubz0AaF6diqPzH4H3AiOZUPEqbOxUvHNJ8%2FZlQulxFBZmlobFoRDlDWL4lHYw%2F97D2v6Xt0nQL%2FaE9rOyAuUil0%2BmZWo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a119994783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8b8ebabff78fc0e1e27c86e0acd5689b","sha1":"362e6b1262d4bbf6804b7b20416f8defea0225c7","sha256":"2e74fab94b80eea9ac10b062442b5c050f1bf201d561eef1839cc37ff8b723b1","sha512":"a79ae1df58409deb5051280b378bad6edf5e3c6d3401f5c3c3e2db7c7b1728f801dbcbdae3669fd17482a1ae40623354265d4430dc091cce65495c8b7cfcda5f","ssdeep":"","tlshash":"aa3151ffe7c061f0d64ac378ee2684f8b84330792b6717da48906e9a63b115885cdcd0","first_seen":"2025-11-20T12:33:07.038409Z","last_seen":"2026-02-14T00:24:47.92679Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/ethereum.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.272Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/ethereum.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HvvBtPMgZMqdvPKxEGk40o%2FmjIyw52KrpkImLXIDcss4GAw8Aq1285QxqdFIcrzh5KMsUmB5dt7DrI3FJa9Y8RY%2FR48%2BW%2Bl4PM1GvGM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12ccc7783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11160,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"194c83272509ee55248bf772722da969","sha1":"b8e4eb50f1449f813e276e171d4ccf8b7ae25f31","sha256":"a438bfc96dccff9e92900df18ea93fbdf20fb7715f0f53c0e7f42e205031c9e8","sha512":"114e96c7ba0c62be2fac53119485facfa13138bf2c63d62aa22d27619b15efc04730dd0355bb09cccacd5c08f6810ca82ca3f7bb0e7e9fe641337d4aa2b75df8","ssdeep":"192:8j2pGCmkTOI8YwMm3izQs3wC5DgDTVlU99VO9BnT9NquStI6/F+nurqtJ2Jcz2d:8SpJOKw2Qs3wC5QlOVWP+3+GJ","tlshash":"0e32a5efb794e1e8b406f3f4e51684a57a6f34fd6a37cf60c3a52f59ea5204c9844880","first_seen":"2025-11-20T12:33:07.005366Z","last_seen":"2026-02-14T00:24:47.930845Z","times_seen":7,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/ripple.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/ripple.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xLrEqSRNc%2FdnJJlrbGXbBpGKp31CyEf%2BBzSgYTwpaYMek2kQbLUGME7ypbz9gSd%2BRGUQ13Dgx%2FHsW%2BZAxg2y9VG4yIZlNL1w%2FPHxxes%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12dd33783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4270,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4e05bccf04ecd98be3a59326d103dbe","sha1":"e40759c1f0454a81273e624f0eab54b10205237a","sha256":"87c5676201090480e1bf438de5826015f16ada0769f4696fccad3c2ca383d0a4","sha512":"e958fc96d1e39c836f93af7da52d6ca97c437c2daefa75093bfef068ebf99f38338d0fe325c4919f43bc02ab5b47f4d77c4fdb9b9bb02a2ee22a267ffe472710","ssdeep":"96:C9sF5AfyV2MK2Pt8JAjjSkFEkK2Ct0DTR+NmwMPceTY:CenAfyVJt8SSkf9TmMNTY","tlshash":"5091a4f15388f3e0750bfb91d438112ab9af74f9af22cd958a76be49630c028099ccd0","first_seen":"2025-11-20T12:33:07.036288Z","last_seen":"2026-02-14T00:24:47.933431Z","times_seen":7,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/usdc.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/usdc.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I%2Bryg9kYMkDm4klorf2x%2FB22we%2FMg%2BwebEvERxRLy8lOJ6mpgAG2SVGJGY8ZMiMBRQUZX%2BkwRinL6Ak1sHu1DWLv2kMSkNDOqNCNbLA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12dd34783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3efa829825e0aafe584dc38340df3521","sha1":"419b9a5a76c7514d53b6a8bb28166596a240073b","sha256":"ff91257f6dbb041edb366426d8212025de30e743d12551b138a661ef3d79d51c","sha512":"f6409425daf0e428dad695ecf183a7c4ca3bff043c5214e796eac65d8db5acecfedb3465ef3d5629fc5be9dad00de2f0b21c8b51633f8b65e8c03486eca641f3","ssdeep":"96:Kj7E2ORa823AvAL67FCkEc/Pa6jmWx/nCWyTKhtjd3J7RCIhd:KjY2N823AIL67F/Ec/Pnj9x6hOhtZZ1p","tlshash":"32b176e163e4b3f4960af7e4d9189425797b24fa7f92cfa4c365bd44a15101e88dccc4","first_seen":"2025-11-20T12:33:06.972648Z","last_seen":"2026-02-14T00:24:47.941773Z","times_seen":7,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/exchange/estimate","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"POST /exchange/estimate HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nContent-Type: application/json\r\nContent-Length: 75\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":75,"data":"{\"fromCoin\":\"xmr\",\"toCoin\":\"btc\",\"amount\":\"127.43\",\"provider\":\"darkchange\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://darkchange.io\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2VcXDV7Zg%2BZhMMHHDT9RuHbuk3HUH1lvqnJwTPrzucAE%2FrRiLK%2Brx6%2FeBf7B4glIJPk12Hi2U75i80FymKLPZtHKO%2BzinZ%2FBQlN3jCI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a1499b7783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":188,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4074c1dce17ec5554c4015cfe0e1cdfc","sha1":"8d539e5d517eceea6ae6a9c7f303b18b6c912300","sha256":"c2707e96574fcb4f94bdaafa89f76180fdefba233c3faefa07f8688b166c096c","sha512":"aa5e01660e274a970f4f611a3dee19ab82996f8b6b2f71700f4c54a06dc4d89f2d66bc33364ee38e600a6bb1aa5fb4f4877e8679004bbc5ce0aa5a4bb96dbcce","ssdeep":"","tlshash":"27c0121825152822cd0905d5e9be023439d6523574ad5ea8cc4a8de641d16964a11958","first_seen":"2026-01-10T21:11:27.911303Z","last_seen":"2026-01-10T21:11:27.911303Z","times_seen":1,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DvjNr9xF.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I6R7mE4VPSSI0DJ6ujemCGALuI99pVncl%2FqWIdJczU1AffsZkzG59gTgiemVlHaaKU6BqllfcHMaIcKitkJp4FqpMQ91HmyMxm5JC8E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a102d8b783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":403260,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/monero-exchange.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/monero-exchange.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tbzkt0P9HP69jej1V%2FBpclhVbCI9fK1StFxZ0Zj2HaYc3kQCc5O60091KNmUQADcJYxQ%2FuEWY1oQ0N5tGxeZ4%2BJWngp6%2FRPzxxG2IOU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a10cf44783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48718,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"4e7271e4d05843ccbf6c2c98a3e8cdca","sha1":"cb2fc166d2af582ed84731473d4316cf4e95c41e","sha256":"2a572c6a0355c5218ccf69724a328dd0d1ea2efea18b4166d85035c00fb35fac","sha512":"e8d287557f46c998c5c9b80ab7770ef917f1fe6f6851aaa258a5e0fc59cf0cc65f0211ec390770d228ceaf729d92429fbd86d61202609233a40ffb82e81df82e","ssdeep":"768:vN4svRdiiKG2ChsW6y3puA6FmZDDZHm7fUQMTldqOWj9Fn6QYguQiU6AS:vN4sDvKSOpy5YMNtHm7f7OWxF6QYggUk","tlshash":"4023f1a6be38843bb9838f6025c21f4a153192d05bbdac07d105c97c3f5e27e7a69375","first_seen":"2025-11-20T12:33:06.969884Z","last_seen":"2026-02-14T00:24:47.932019Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z84mahR2KqDKqOXv3OJiG3eaFEeOkddOezqFDFartGx5rsLi0sd1dekWzAnA3ZX40qv2ftKvI7D4YUDEIUlVDnXilw%2BKsEijzTkLM58%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a10df75783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8b8ebabff78fc0e1e27c86e0acd5689b","sha1":"362e6b1262d4bbf6804b7b20416f8defea0225c7","sha256":"2e74fab94b80eea9ac10b062442b5c050f1bf201d561eef1839cc37ff8b723b1","sha512":"a79ae1df58409deb5051280b378bad6edf5e3c6d3401f5c3c3e2db7c7b1728f801dbcbdae3669fd17482a1ae40623354265d4430dc091cce65495c8b7cfcda5f","ssdeep":"","tlshash":"aa3151ffe7c061f0d64ac378ee2684f8b84330792b6717da48906e9a63b115885cdcd0","first_seen":"2025-11-20T12:33:07.038409Z","last_seen":"2026-02-14T00:24:47.92679Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/tether.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/tether.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0ZRneSS4tz738OeIxusVgGaki7Y5OvrlHRB%2BfXhkNIVql275McrHmNCncUY2VHtKXDzlDIfbym6bREv1PPKJKGrhK20s2hZjwYp4z18%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a12dd25783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3420,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b60f7fc09c30618d450cd0a206e22f34","sha1":"452f2af4562d1d084945b428ad654508711ae3da","sha256":"467f52b6fada63828bd64854b5efe930555a35110cf460fad57f083a7f16e106","sha512":"7de0358e8647124bed8c49f9e5168ccbad1ac0436d0beaa34656b9fb19d44713311ab40f885d090b66b009df457f1fd28a1ec6c6dc8fbc945bf9fec51d325311","ssdeep":"","tlshash":"da6152ca57d563d09907e3f4d49458f0792b24fb366b8ee48733af95b61605c4c8d8e0","first_seen":"2025-11-20T12:33:07.006575Z","last_seen":"2026-02-14T00:24:47.940733Z","times_seen":7,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/CircularStd-Book.woff","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:11:00.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/CircularStd-Book.woff HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:11:00 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4JY1WVTymhN5uU3C5mbf29yjsUA4BU0wDQ0hS76tiZGJ%2BOInR9rVGmuWNltPuAjg5HrtJDRY%2BEhLqkduP%2BQwS7IukHqggKBCahdRT8M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf2a13cf8d783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-2b9-Tkam.css","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:10:59.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-2b9-Tkam.css HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:10:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 171\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0cBnLy5Zg5CfTcrlGAVuDF7Sb%2BRyM1IkFcCVe%2F29RweeXFG7trcTAMFuKJWc3vBTGEAHle0TccyULBKcDglEM28fZ1dDRP9gh7X%2FUmE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf2a101d64783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3181,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3180)","md5":"4d1d6a3c5e53a9faa397fde719a038a9","sha1":"b53005c37f44ff8eac7267b253cddce7a95b2524","sha256":"ef23ae16e9454304b622b839e4f47868208f4dcd684ec219f4f86ff81760e286","sha512":"94cceeff62bcac7eba062ae6b9d81b1f87fa5892adc8ffdd972edb1fa35cafae479239669c351ff44d3e9cbd92ab55510af65a0449f2d207e7cdd465472886f7","ssdeep":"","tlshash":"d761712d890e2cedb533e55ea5dba558c124d183985e073673b2523c08c317b22bfe17","first_seen":"2026-01-10T21:08:37.479994Z","last_seen":"2026-02-14T00:24:47.943023Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}