{"report_id":"81240608-bf86-4b44-9780-c03f026fed5c","version":6,"status":"done","tags":[],"date":"2026-02-14T06:00:24Z","url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"title":"Keeta | Where Networks Connect","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T09:37:30.204848Z","times_seen":17952758,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-21T06:00:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kta-collect.xyz","ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-13T10:29:22.764226Z","last_seen":"2026-02-13T10:29:22.764226Z","alert_count":7,"request_count":7,"received_data":5298559,"sent_data":3009,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-02-08T22:32:21.331091Z","alert_count":0,"request_count":1,"received_data":760964,"sent_data":444,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"1.1.1.1","ip":{"addr":"1.1.1.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2012-05-30T07:40:31Z","last_seen":"2019-03-28T08:40:04Z","alert_count":0,"request_count":1,"received_data":586,"sent_data":438,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f1c31376079207145b5b97e908ac8417","sha1":"36afe36e20fa745e3170a07042e36b5a5700a232","sha256":"926de9825f54f9d26fc73d79cf190052d5c24716e37317d42ca816876532cf2f","sha512":"f1f1826be4380b552b8149a0683eea0e3a7bbdc1fe6c8955583a110dba2b9bd3a1991c4add4603d363453133135aca8a60b8341c2279ff6a929edeaf522a7e24","ssdeep":"6144:94Lv6qQtn7apCL6gwrwjg8KhgzrP3wMWaC/8hPg:uv6qQtHHg","tlshash":"3a347448864b5e27cf20eaa2723542c6c1623a5ac3dbbd40e1759d64b9bce7cc7f5831","size":241387,"data":"","first_seen":"2025-11-06T15:25:24.260456Z","last_seen":"2026-02-14T06:22:48.566195Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/fpbundle.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","size":45503,"data":"","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-08-10T20:36:38.759665Z","times_seen":753,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":760171,"data":"","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-08-18T02:24:58.664207Z","times_seen":3814,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/modals.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","size":52833,"data":"","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-08-10T20:36:38.765424Z","times_seen":755,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/bundle.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"29681f25e1e25a870bd6656b8d48646f","sha1":"7b8c8d1c3af639b6ec50c84660a9e9f0a3a2d3a3","sha256":"969be4f64afdeaca0568779c3b0f7291bc9a7185cc983a5104fbd90e4f901039","sha512":"69c94d52b83c5cfc9b4d86e042cf6b99ab9d00c1b9f417ed35f789a41b2d21a92606bef9e1a7a02e64622e31feecb9cdb451ed23f8fa7a69392a0575944867e9","ssdeep":"49152:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNrl4G1SE0BuuJpxHiRo6r3XOWxYrowVpaz:Qg+wyBgSxUKZTRbUajO9U7","tlshash":"abc56d907395a46c03b352d458771101f339684aa40d80ecf7ecd9e7afb998a897bf39","size":2510372,"data":"","first_seen":"2025-07-20T10:23:41.470184Z","last_seen":"2026-08-10T20:36:38.774189Z","times_seen":721,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"261fa5f948bd99fdf005f80595805744","sha1":"51d57156b1974322b3ba8542f48893082199d5e1","sha256":"1dcf3b0e1f92d593867169c5ee26771d2f3b77f552eee6c73beba961b91d61b7","sha512":"532ff30dfdd593068e7afc5f98cb1bc72408e594f297911c0a7c590c97a2ed6be6b91981322dfe3b3e90f21241404ae8692139732372f119279dbdf29f3ae429","ssdeep":"","tlshash":"a6015927222233707ce9d5dca8b6dd8e39bb501ae40a0090a09f944d1834bc644f7bec","size":847,"data":"","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-08-05T18:17:41.390527Z","times_seen":3615,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-18T09:37:42.664706Z","times_seen":421720,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/main.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1de6c37e5d9a1bff10d5bb4b98e50acb","sha1":"ce780f200764e4395586c6f5b4da4c2fb0b32442","sha256":"8e81b1f63dbf42d8ef1cda896c6e981e12378028c1742498c0bf82247f72ac18","sha512":"b80c8a23c290331be7e483a3c43e16c080a2ea57497adfef01961a513c8fcbfefea6fbe4b9373a9e50462ff56c49f68ae709c89d35cd4eed5ca4e829e7e76d32","ssdeep":"6144:6M1rqumpjPAnIL6gwvK5CskZGn/VtcGAmSR4nRx:lrqumplLx","tlshash":"73346248824b9e26cf20daa272354ac6c162765ac3dbbd54e175dc24b9bce7cc7f4831","size":245248,"data":"","first_seen":"2025-11-05T06:28:13.968276Z","last_seen":"2026-02-14T06:22:48.559856Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kta-collect.xyz/main.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:00.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\netag: W/\"690ba69f-3be00\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jVuw5MELT7jAgH5saMbWk2bbnpz0Q9hiBX%2B2Z0ZHZyBEcK5jjc8tD%2FGJ8EtKzqIPQ7rvJ4CABtcbD4DRRTc2BM8vq6wCiBDEU9LlyrPt0A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cda57be1e644e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":245248,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1de6c37e5d9a1bff10d5bb4b98e50acb","sha1":"ce780f200764e4395586c6f5b4da4c2fb0b32442","sha256":"8e81b1f63dbf42d8ef1cda896c6e981e12378028c1742498c0bf82247f72ac18","sha512":"b80c8a23c290331be7e483a3c43e16c080a2ea57497adfef01961a513c8fcbfefea6fbe4b9373a9e50462ff56c49f68ae709c89d35cd4eed5ca4e829e7e76d32","ssdeep":"6144:6M1rqumpjPAnIL6gwvK5CskZGn/VtcGAmSR4nRx:lrqumplLx","tlshash":"73346248824b9e26cf20daa272354ac6c162765ac3dbbd54e175dc24b9bce7cc7f4831","first_seen":"2025-11-05T06:28:13.968276Z","last_seen":"2026-02-14T06:22:48.559856Z","times_seen":11,"resource_available":true,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":321,"receive":105,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:01.608Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/ethers@5.7.2/dist/ethers.umd.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 5.7.2\r\nx-jsd-version-type: version\r\netag: W/\"b996b-tlFUVYf2JXNF3D3p3apESxDe3z4\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 3904871\r\ndate: Sat, 14 Feb 2026 06:00:01 GMT\r\nx-served-by: cache-fra-etou8220026-FRA, cache-hel1410020-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 168432\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":760171,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-08-18T02:24:58.664207Z","times_seen":3814,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":63,"dns":2,"connect":26,"send":0,"wait":27,"receive":63,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/modals.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:01.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET /modals.js HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\netag: W/\"690ba69f-ce61\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OhuUtxtL0U5MvI1pGt0715i9FGnhGGfb1VmBJh1lfagCGBzASLUuhRttYY2AAVhJHa7ryBnd6ZmA3FzhXxE%2Fh1CkLdIJrBW90GN5PcT1RA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cda57c20eb74e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52833,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (52831), with no line terminators","md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-08-10T20:36:38.765424Z","times_seen":755,"resource_available":true,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1.1.1.1/cdn-cgi/trace","fqdn":"1.1.1.1","domain":"1.1.1.1","tld":""},"ip":{"addr":"1.1.1.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:02.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflare-dns.com","organization":"Cloudflare, Inc."},"issuer":{"commonName":"SSL.com SSL Intermediate CA ECC R2","organization":"SSL Corp"},"validity":{"start":"Wed, 31 Dec 2025 19:20:01 GMT","end":"Mon, 21 Dec 2026 19:20:01 GMT"},"fingerprint":{"sha1":"F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59","sha256":"E3:B0:28:26:78:9D:65:3D:22:4D:3E:DA:CB:E4:E8:77:CB:72:86:FC:4C:92:26:72:F6:22:67:41:CA:57:AD:65"}}},"request":{"raw":"GET /cdn-cgi/trace HTTP/1.1\r\nHost: 1.1.1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kta-collect.xyz/\r\nOrigin: https://kta-collect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 14 Feb 2026 06:00:02 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\ncf-ray: 9cda57c93af7723c-OSL\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":259,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text","md5":"ff703787ba26369f3792ebf237b1d233","sha1":"cc0073f3f64ce4c469cb55ef6183946db0f43e43","sha256":"26935f90525e1d93059b6129484a107df41a868fcd382e0c64b525283d433f14","sha512":"18e4d57bdc2c66c8e9a7134f0eac22f74025b1888f72f9045edc22b4d391d3b60e199b6680accfd15fd98a4615de9d74f7d20dc242247bbb5606cf09d6d0c5ac","ssdeep":"","tlshash":"10d02bd7b21d0058182e544502ab6241c761452789ab7921fde10505ae4d2d714d9ae0","first_seen":"2026-02-14T06:00:28.961023Z","last_seen":"2026-02-14T06:00:28.961023Z","times_seen":1,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":26,"dns":1,"connect":1,"send":0,"wait":3,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:02.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"HEAD / HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kta-collect.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:02 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nage: 2\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eE12TfWldgatcuSzMctQZOSMU1k25FeXO6BHagEg4kV3yhg8Tl3TQk4fqND%2FFyGkR46mm%2BEFY2XnMwcwMw2GoJAcnEH96xIaT6EAh%2FXthg%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\ncf-ray: 9cda57c9185f4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T09:37:30.204848Z","times_seen":17952758,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-14T06:00:00.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 14 Feb 2026 06:00:00 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ltk4bhQRZk0BNTGb0LPbVbbbDDX5rNT6gV%2Fjj9OzIiGPhK%2FCSOK9r3j82HXRmPr3AvN%2FUqy4x4nLuMPg4WpEpjMIogm6HFVomaL%2Ff3bi4A%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cda57b99dd38be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2437525,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (42192)","md5":"3dc02a8d8560b762b02aa7c1505531d6","sha1":"3502daf07fad24234adceffab7f63890768186fb","sha256":"8744c044db211c227c22d3802c9b55cb772372ae1fc71035aef3e5f156197074","sha512":"5dc3eacbcfd1376b1645f293f652c434bbcd5084d4ed16e690c32f48b47383291c7df563641d68be81ce2d34991e090c4f4d97de283c626a33044654035c2368","ssdeep":"12288:YuZoPxVTbhWareWN2fWVW5AWPxVmbhKEreW22fWVW5A5PxVtbh6+reW/2fWVW5As:8NzBEeW5AywhqEeW5AdXHDEeW5AQqk","tlshash":"5c25ce36b619141e1e5a8ab1f9b41f0fde7a3ecb870c6388a7c904790ab55493ff950c","first_seen":"2025-10-17T03:36:16.720712Z","last_seen":"2026-02-14T06:00:28.962689Z","times_seen":8,"resource_available":false,"data":null}},"time_used":468,"timings":{"blocked":68,"dns":69,"connect":1,"send":0,"wait":314,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:00.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Sat, 14 Feb 2026 06:48:00 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ju136YFfiJLFQcJ6e9hfkmJcgZ5PEYm%2B667hJsuMI1%2FH0k4OVdyFo17n7aneNnI%2B9bWbso9bcUtumAQ3fpZinJMsWIwqBoAKBPNFY5FKlg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:00 GMT\r\ncf-ray: 9cda57be1e654e4c-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-18T09:37:42.664706Z","times_seen":421720,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/fpbundle.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:01.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET /fpbundle.js HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\netag: W/\"690ba69f-b1bf\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CotAFFYF8BtykJbVrQfi%2BJY4xOqxdDJuxMxAUeFzLGwHaygB%2FBXLXXh5tYZ9PhXiYH4shuOzq%2BNAVePpaGgrFe9zn5%2B5IMnF4TVGJhs0Rg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cda57c20eb84e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45503,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44961), with CRLF line terminators","md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-08-10T20:36:38.759665Z","times_seen":753,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kta-collect.xyz/bundle.js","fqdn":"kta-collect.xyz","domain":"kta-collect.xyz","tld":"xyz"},"ip":{"addr":"104.21.1.33","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kta-collect.xyz/","date":"2026-02-14T06:00:01.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kta-collect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 22:54:03 GMT","end":"Fri, 03 Apr 2026 23:51:50 GMT"},"fingerprint":{"sha1":"8A:29:06:77:FF:CD:1A:F6:08:A6:FD:A9:E4:3A:D9:8E:B4:21:DC:8D","sha256":"29:65:A7:2E:34:0C:6A:E2:43:54:79:8B:25:24:2E:28:C3:71:2E:6E:B6:E4:87:7E:71:45:AB:D7:52:A9:DC:4D"}}},"request":{"raw":"GET /bundle.js HTTP/1.1\r\nHost: kta-collect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kta-collect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 06:00:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 05 Nov 2025 19:33:51 GMT\r\netag: W/\"690ba69f-264e24\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G4cwVX6h5%2BVOmI2dqzglamDIUwy8m3Gd0u51n5bmtxjj6%2B9YloaL7gXvrsxAjS48rW4mUaRg5f5hYhsPiEjOyfR2dZSAzy7KzUAL0iSaZw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cda57c20eb64e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2510372,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11784), with CRLF line terminators","md5":"a579f43be016af96b1d14b0be3ab2239","sha1":"eb0403b0e34d6943a3242206f9845843fab6d225","sha256":"9b2c009690d8d43f3a351bc36362316b6474ce1fc03c24fdd1cf2ce2da5b2509","sha512":"64befe664a2fbf04844b475a8b918dd5feed48a9c77110963a9f589be8e19e04d3a98233a44ae343b1efe20fafe18770dc18dc10e39402e822bf37c63d081619","ssdeep":"24576:LREHMe8DbdUW4HlHZg+dY3yBgS6cUKZd3NlNUQ4G1SE0Byz5o:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNW","tlshash":"60254c9072a6f07603a755d864761101f2385854700d90ecfafc9debbfa988a867ff39","first_seen":"2025-07-26T22:48:52.272458Z","last_seen":"2026-08-10T20:36:38.763214Z","times_seen":683,"resource_available":false,"data":null}},"time_used":475,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"kta-collect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}