{"report_id":"81933131-70b5-43e2-a028-84b4e1ef7d2e","version":6,"status":"done","tags":[],"date":"2026-01-06T13:43:08Z","url":{"schema":"http","addr":"ivfun-migration.com","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"172.67.142.122","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ivfun-migration.com/","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"title":"Token Upgrade - Upgrade v1 to v2","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T18:30:15.702548Z","times_seen":17694294,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ivfun-migration.com","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"172.67.142.122","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T13:43:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"upgrade.arc.ai","ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-06T13:43:08.587973Z","last_seen":"2026-01-06T13:43:08.587973Z","alert_count":0,"request_count":1,"received_data":51795,"sent_data":435,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ivfun-migration.com","ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-29","domain_rank":0,"first_seen":"2026-01-06T13:43:08.5861Z","last_seen":"2026-01-06T13:43:08.5861Z","alert_count":7,"request_count":7,"received_data":4296405,"sent_data":3226,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ivfun-migration.com/","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f87f73519a0c26ffe9355f838d027773","sha1":"2e945caf193c66da949c495dedad577157446598","sha256":"1b7cab29c34ba916f80d83bca1603ac7ca2da401b081ab9832fc63df95a8eb30","sha512":"e0f7aa1aacf3916424d88d927c622904020c489c909fa12c53ae2c570394edbe6cf0c0c48e3730da7327b31144aedb787f7f7df34ce7a29b89072fb27b6174f7","ssdeep":"768:nlMa3caqANj678OieONWYGKMl/iohfTtMc5sJp/gJqBAnJc0NcVcecMHE5dTVbcX:GA4IGJFcspjxz0ai","tlshash":"136394d5980bd4e98d5224cdd43be90ae4680d23cdacf1a3ba6ceed2744df22845753b","size":72649,"data":"","first_seen":"2026-01-06T13:43:13.004153Z","last_seen":"2026-02-14T12:17:46.818538Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/angular-core-16.2.0.js","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dca266a8673f210505884188616eb2d4","sha1":"c8d01bd6f9b9e4ca5c68bd12862a443f42c5c43a","sha256":"4dab80233fbce5f8aa05df94ddfae8b1d25d4d89bdd10c3ee457369353014a60","sha512":"d9fd2727dbd505464c13effdb507ef68c59ccdce6c71b4231da98bcbddbbd6301d0738020c44529c4f1ebc347da3848c9e70c4b5d018f20a410ecc87463c2817","ssdeep":"768:2p0aHcMigtB3yAEqMMwMm2LBqcaVffr3VfXKc5UJp/gJqUkMZhc6cxTccc4HEfJK:rguAEqMfMXBSfr9ks39Vz4wg","tlshash":"f57393d6580bd4ea9e1114cdc43bec09e0680963cdacf193baacedc6b45df26844723b","size":75860,"data":"","first_seen":"2026-01-06T13:43:12.999669Z","last_seen":"2026-02-14T12:17:46.789317Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/3986530d-8260-4706-9b59-f3e52d274466","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f11bcdc7b7757c117a8de0db3a4c25b8","sha1":"962e4d08a960106c829d0f9d492d7b891927adab","sha256":"b60b89c0c92cf57329c8590a2c5540cece4def64e4e7bf04f2d39b8ffa3b2748","sha512":"7461553dadb09db423bda8c47a58f8cdade82aa710a0f4415cde912e7a88cd4471ea86aa58a2e5097c90e2cb45ac410104019c56a04c35955e827f0bb0796040","ssdeep":"6144:vkWGL6BSn5NGCk3zi0mCw8wLPNU2HZjGfty3:cjkSnv1k20mCwFnHRGfty3","tlshash":"1044810609ac4f7986ec22e015f72cc401794e0ad9dc3cbfb9ada1579e25bd6e0c279d","size":259964,"data":"","first_seen":"2025-07-13T03:04:16.940864Z","last_seen":"2026-08-03T13:53:29.153528Z","times_seen":5100,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ivfun-migration.com/","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T13:42:44.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:42:45 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B%2FBJwp16J0RzZ2uByFmlo3BCXMx3rWFx%2FJZ4LcT6PttEKKM8YE18oAtQartZDEmzljW6wKTj7EKE%2BRHH9aDfiWEjM3vwL%2Bl9PaPDJWOLDftQ\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9b9ba3f29ae30b4d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9552,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (781)","md5":"77cacb347f2df3982cce147822a030e1","sha1":"4a4d60207030ab311e36f42804bf849fd637ba9d","sha256":"d8492f7e5d60c43709e513343e51a76935bae82585f0fb722fdec9fdeab9e18c","sha512":"4da61c0185fa6218939d6e54316855ba173aff8192ac1edd49e8e68dcfd9dc6183a978b79772ffb142aad8988a8185e09bb2b70d63f68e8c5f4ab6bc62c1aff1","ssdeep":"192:JsYisCUlUHJQf0PBNHYRBtA3WBtA34BuCB183/pLnM:J7mHucPzYRPA3WPA34ECDy/prM","tlshash":"9d12406524f1553622a7c6e17ca9a70aae64ea1bd51b8548f7ec81e50fcfc43cd43218","first_seen":"2026-01-06T13:43:12.982669Z","last_seen":"2026-01-12T21:01:46.845305Z","times_seen":2,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":20,"dns":1,"connect":1,"send":0,"wait":262,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upgrade.arc.ai/arc.png","fqdn":"upgrade.arc.ai","domain":"arc.ai","tld":"ai"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upgrade.arc.ai","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Nov 2025 17:30:56 GMT","end":"Thu, 26 Feb 2026 17:30:55 GMT"},"fingerprint":{"sha1":"7A:0D:A6:28:42:3C:A2:65:F7:17:D3:3F:2B:F3:7B:99:42:F0:05:98","sha256":"3D:84:2C:65:66:02:4C:03:D8:5E:19:AB:74:A3:1A:7A:39:4F:F3:6E:43:74:3A:DB:85:02:35:7C:ED:C7:97:8B"}}},"request":{"raw":"GET /arc.png HTTP/1.1\r\nHost: upgrade.arc.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"arc.png\"\r\ncontent-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://vitals.vercel-analytics.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss: https://*.alchemyapi.io https://*.alchemy.com https://*.infura.io https://*.walletconnect.org https://*.walletconnect.com wss://*.walletconnect.org wss://*.walletconnect.com https://protocol.helloarc.ai; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests\r\ncontent-type: image/png\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ndate: Tue, 06 Jan 2026 13:42:46 GMT\r\netag: \"dfcaadc7f78affac7a0e2f37a5956010\"\r\nlast-modified: Tue, 06 Jan 2026 13:42:46 GMT\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Vercel\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: DENY\r\nx-matched-path: /arc.png\r\nx-powered-by: \r\nx-robots-tag: index, follow\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::qs7jz-1767706965956-e1b3b4e32dd4\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 50188\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50188,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced","md5":"dfcaadc7f78affac7a0e2f37a5956010","sha1":"b85ba38d8e66080144cc1a013b74d45786f30980","sha256":"f12bf820fb8ab49ff2b2d8ce7a440e8f9e23cd4888c946cfa35a77a3b0c9782a","sha512":"6663388a1ada3e1362bcc439a0e7dfdfa2eac6188a1679554481b42eae2264958626b8451944bf7c55216a4f695a50db5c2dce35db4290915b1845cc0f8e99f7","ssdeep":"1536:HjMfbNHA1UrvdtaYHavgzLirMe+ySoUVhnA:DYRA1OdtYpwVFVhnA","tlshash":"4833024b5b4cdb4410254eed696cbcbe32a47ec181670747fb708277864d77954bacc2","first_seen":"2026-01-06T13:43:12.986709Z","last_seen":"2026-02-14T12:17:46.79059Z","times_seen":4,"resource_available":false,"data":null}},"time_used":632,"timings":{"blocked":-1,"dns":98,"connect":1,"send":0,"wait":500,"receive":3,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/leverfi.jpg","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET /leverfi.jpg HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:46 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 6804\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\netag: \"6959b2a5-1a94\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=anM%2FGWvv81nQTWV8FzNwfBNuOge5t0Q9xfBkKuxuUeQTnaU8AgnQa8jV5JCBE702ONbqAL%2F8EMvwTjl1ZVLq%2B2zITeedXXs3y4ImeSpp7yawdK8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9b9ba3f868371525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6804,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3","md5":"41e023b39c4f6bcf91fda2180f95bf94","sha1":"bbcfa7d637e3bcc2bb747e35cc963a66ad77ef93","sha256":"86d798b69f3167094f9b5c16bdfc3e092c03c3215756382dcacdfa0bc99e1a99","sha512":"53bf274756d46b6caff446b68dee21ef45ad93dd311f62be6fdb6aada0fa9fab4ef5ec43b75d47cbd4527eae6e8496942907a76b85f1a6cf2cc8cab425ed357a","ssdeep":"192:sXy7DBX8v/jf/iSP+3jgIrYg6qTbCG16vS90/7gbbb4TiyB:seAjniSlqYg6qTrgdB","tlshash":"07e17f5362e50b17e45f82315e50b94ce3d24b11abe602f5e8b002bff78c58d8ea4e47","first_seen":"2026-01-06T13:43:12.989857Z","last_seen":"2026-02-14T12:17:46.803937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/Bg.png","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET /Bg.png HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 18330\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\netag: \"6959b2a5-479a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XIOdwbXQTfrbmPDt0JWdnxOtMzst2Ol%2FCU01tLF8oQ0FyqIFzIkndMpnogukjKggyfMJFCuG9lMa%2FwsTrG0vOfe81LduUb92xqwryg9dS1eDwVE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9b9ba3f8a8421525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18330,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 462 x 580, 8-bit colormap, non-interlaced","md5":"9a7b681aa321fbb5bf16b23f33cea2a8","sha1":"98548ea6cb367db6b5892c4b873902e3b1ad34af","sha256":"a5a2ba663851f87793219e31f667ebcb13b7cd85f419ed17b8e1a8b42c4bd35d","sha512":"5af63c8222a6ecb5cd6d5d42c5f8c939b61656d4c48c90cc322325a6b9fc1307f79d2643c06bfc60021af977d2543532e3210ce8edcbbe3967e5df5c940657f5","ssdeep":"384:zxC19EsxE9luA0G7PaMFqc5wiYtoQstJujaMgBvPaP3W1vA2:w19E9lnFqc5wt099BXayo2","tlshash":"d282e03928d260b652ff8f9f2f5148847d7fd992580422f426af904a3dc3e1c66e41be","first_seen":"2026-01-06T13:43:12.99409Z","last_seen":"2026-02-14T12:17:46.811243Z","times_seen":4,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":261,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/secureproxy?e=jscdn/getFile","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ivfun-migration.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://ivfun-migration.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"aaroq64koehll14igi6l\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-security-policy: default-src 'self', frame-ancestors http: https:\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eiQUoALZHs%2BJ5YQF%2BECSNI1%2FVHOcGI7tHr5G49zf1U59H88OZ%2FbmYcVKum1NCvQADYtIIM%2Fb5B4pF4aFRl0lRAuwJk0Wu0gZrm9BkzKNyNyvgA%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9b9ba3f8b8471525-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4135807,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"717c3a066bb2148e6ab54b3e28579507","sha1":"b858f0e04317c2cdc506c4879b998d686130f3ae","sha256":"e5869d849874077da55da5b86c525e098cc741a964a0a490e37d097142be4078","sha512":"6fc024cd1ea909273df765607eb488046f74314db0be2d16ba851992c88a8c63c1623a2681a01c762758b3a157c86e932ec1cd35e5512d97cdd484ddc0b3f29a","ssdeep":"12288:uXgjDeCu/lA+HA6c4f4exvEQckClUi4+4/H95BuPJpVST6M/XOnh2JMoHRApwyn7:uXgPeCu2MClUd5UP/qfGoMWAx1zqjcY+","tlshash":"f52512e62050f0d13a75ed26fae16cd9289d00ecf69917371a84ee44b09b0f587dcba3","first_seen":"2026-01-06T13:43:12.996914Z","last_seen":"2026-01-06T13:43:12.996914Z","times_seen":1,"resource_available":false,"data":null}},"time_used":675,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":280,"receive":395,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/angular-core-16.2.0.js","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET /angular-core-16.2.0.js HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:45 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\netag: W/\"6959b2a5-12854\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OOYQVa983Uy8vYMrOVJJCtQ2UE3aogYMc7b3wVS9pazTpy%2F8i6raFN6ZA%2Fyhh8hTy8Vt24QQMWQjHuS%2FIcBCEAJOqSuvM7c4o%2BrScwVUVbrbrxE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9b9ba3f5af781525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75860,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"dca266a8673f210505884188616eb2d4","sha1":"c8d01bd6f9b9e4ca5c68bd12862a443f42c5c43a","sha256":"4dab80233fbce5f8aa05df94ddfae8b1d25d4d89bdd10c3ee457369353014a60","sha512":"d9fd2727dbd505464c13effdb507ef68c59ccdce6c71b4231da98bcbddbbd6301d0738020c44529c4f1ebc347da3848c9e70c4b5d018f20a410ecc87463c2817","ssdeep":"768:2p0aHcMigtB3yAEqMMwMm2LBqcaVffr3VfXKc5UJp/gJqUkMZhc6cxTccc4HEfJK:rguAEqMfMXBSfr9ks39Vz4wg","tlshash":"f57393d6580bd4ea9e1114cdc43bec09e0680963cdacf193baacedc6b45df26844723b","first_seen":"2026-01-06T13:43:12.999669Z","last_seen":"2026-02-14T12:17:46.789317Z","times_seen":4,"resource_available":true,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/26626be5d1149d44.css","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET /26626be5d1149d44.css HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:45 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\netag: W/\"6959b2a5-8e93\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VsmrfzpLEnj8ZFiPdgDkBgDM2iUSe9RIwYIoXF4I2FNUOtlRxPrs3mB%2F8T%2Fhv7IiVfohYELTHbN9gw5VWuWLr54gpaES5KckU8hVBh5HmfjddZM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9b9ba3f5af761525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36499,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (34206)","md5":"64614ac312705232051442b0a5e6f79f","sha1":"ffe8c186a2011cad6d577bee5a57edbb62754b4c","sha256":"4f16136bcc5c33876afe59ecd780680670fb1aa805d0735ad55b6382293ce5d3","sha512":"65f898e1d5519a6d2c3314ab1f0233cc7da1ccba36ebaece3aaa3e994d466f4015ad1efa367bfc76d64e47bef96188ed5181b371200388f37cb668abc02c5acd","ssdeep":"384:GH1ww6DfgjoCFCl6wub+4r2oq2rrhovuDYEizn:GH8DfEoCFS6nLr2oq2rrh+Rzn","tlshash":"0cf2961daa55043f7c27c1f9d298e8eca116f0c0ee3a56e6bd825111ebe27f32d93640","first_seen":"2026-01-06T13:43:13.001992Z","last_seen":"2026-02-14T12:17:46.78788Z","times_seen":4,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ivfun-migration.com/leverfi.jpg","fqdn":"ivfun-migration.com","domain":"ivfun-migration.com","tld":"com"},"ip":{"addr":"104.21.95.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ivfun-migration.com/","date":"2026-01-06T13:42:45.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ivfun-migration.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 20:15:50 GMT","end":"Sun, 29 Mar 2026 21:14:14 GMT"},"fingerprint":{"sha1":"17:D8:FB:42:4A:33:98:FD:47:66:71:52:7E:73:DF:7E:2B:CF:9D:6B","sha256":"E8:C6:2D:AC:5F:1A:4D:39:69:0E:25:BF:80:6C:80:8B:B4:17:EF:B0:10:B7:83:D1:9A:6A:9F:76:6E:51:BA:EE"}}},"request":{"raw":"GET /leverfi.jpg HTTP/1.1\r\nHost: ivfun-migration.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ivfun-migration.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 06 Jan 2026 13:42:46 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 6804\r\ncast-mode: default\r\nlast-modified: Sun, 04 Jan 2026 00:21:57 GMT\r\netag: \"6959b2a5-1a94\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4SA4PaWWGvBoo%2FuC5DbYxqPPpTi%2BRvlWcuTj2aGVe7CVsrBN1JHXRZKubw1S8SUT9sPZ9YjK9EaO8y%2FEuSy4HAkeeYtJe4SNAwJ08%2BG4s4fZ9TA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9b9ba3f8a8401525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6804,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3","md5":"41e023b39c4f6bcf91fda2180f95bf94","sha1":"bbcfa7d637e3bcc2bb747e35cc963a66ad77ef93","sha256":"86d798b69f3167094f9b5c16bdfc3e092c03c3215756382dcacdfa0bc99e1a99","sha512":"53bf274756d46b6caff446b68dee21ef45ad93dd311f62be6fdb6aada0fa9fab4ef5ec43b75d47cbd4527eae6e8496942907a76b85f1a6cf2cc8cab425ed357a","ssdeep":"192:sXy7DBX8v/jf/iSP+3jgIrYg6qTbCG16vS90/7gbbb4TiyB:seAjniSlqYg6qTrgdB","tlshash":"07e17f5362e50b17e45f82315e50b94ce3d24b11abe602f5e8b002bff78c58d8ea4e47","first_seen":"2026-01-06T13:43:12.989857Z","last_seen":"2026-02-14T12:17:46.803937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"ivfun-migration.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}