{"report_id":"8270708a-f1e9-408e-ad0d-4a2cd7aab384","version":6,"status":"done","tags":[],"date":"2026-02-01T18:25:09Z","url":{"schema":"http","addr":"hyperliquid-detect.xyz","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"172.67.184.18","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"title":"H​​​​y​​​per​​​​li​​​​​qui​​​​​d | Por​​tfol​​io Tr​​​ack​​​er","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"hyperliquid-detect.xyz","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"172.67.184.18","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T18:25:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"db.onlinewebfonts.com","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-09-28","domain_rank":91976,"first_seen":"2015-10-20T18:27:41Z","last_seen":"2026-01-30T07:41:55.09418Z","alert_count":0,"request_count":2,"received_data":29729,"sent_data":1024,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"hyperliquid-detect.xyz","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-29","domain_rank":0,"first_seen":"2026-02-01T18:15:47.855001Z","last_seen":"2026-02-01T18:15:47.855001Z","alert_count":42,"request_count":42,"received_data":11632226,"sent_data":19683,"comment":"","tags":null,"fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-25T22:17:37.642954Z","alert_count":0,"request_count":2,"received_data":9230,"sent_data":978,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"flagcdn.com","ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-04-05","domain_rank":30920,"first_seen":"2020-04-05T08:17:33Z","last_seen":"2026-01-28T17:21:14.469762Z","alert_count":0,"request_count":8,"received_data":9268,"sent_data":3472,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-25T22:14:35.458366Z","alert_count":0,"request_count":4,"received_data":125619,"sent_data":2214,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn-icons-png.freepik.com","ip":{"addr":"23.36.77.72","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2010-08-04","domain_rank":547661,"first_seen":"2024-02-06T14:41:55Z","last_seen":"2026-01-29T12:29:50.577858Z","alert_count":0,"request_count":1,"received_data":18416,"sent_data":462,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.hyperliquid.xyz","ip":{"addr":"52.84.50.92","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2022-10-15","domain_rank":745076,"first_seen":"2023-08-21T22:32:32Z","last_seen":"2026-02-01T10:28:56.92626Z","alert_count":0,"request_count":2,"received_data":1083,"sent_data":1063,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"auth.privy.io","ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-10-07","domain_rank":406771,"first_seen":"2022-11-01T05:18:44Z","last_seen":"2026-01-25T22:06:44.836093Z","alert_count":0,"request_count":5,"received_data":7210,"sent_data":3610,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"fonts.cdnfonts.com","ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-10-03","domain_rank":50661,"first_seen":"2020-06-10T09:02:17Z","last_seen":"2026-01-28T17:07:01.464052Z","alert_count":0,"request_count":3,"received_data":274314,"sent_data":1504,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/widget2.html","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa27277536d6b470e1e71e9281a5e1b2","sha1":"9caf90315eb7a8a6de5659aa439c04bbfe01594a","sha256":"c7d1549bac63fa64566bf762cbf8f61b347fe1e2b1e9600f5e9231aa43b01c55","sha512":"b78a6d7c3dad677ef3b072e95f62b7d33244f74722463cd784f79b41db807a51cd92b39ca7f7d2a49e737e91773c5b83f8d0e6dcca2f9394a064bdf44f2eae00","ssdeep":"","tlshash":"4231194bb2962029b416586472433bf93cbd141399359878f20da99ddfc09f3c5b6b6c","size":1860,"data":"","first_seen":"2025-11-26T00:18:39.209744Z","last_seen":"2026-03-18T14:00:27.463054Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/0f54e782-fc76-4171-b693-b67a818b9a72","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7df73988252e4e56e97ba60a379b1adb","sha1":"71fcb419a05752a6816ec8cb8d6ff66f2b286575","sha256":"795b58fa3e79ac5f0fe3f40fd1a8780febc568757a02fb88cece17317ec0a0d3","sha512":"76bbb9908159d4a89749d84c7cfc019cebaecb2a738e68d09f3e7194cd362e8991548472274377a2b829abdeccdd6a077443dca3c4c9f205ccf78d4a3568702e","ssdeep":"768:FVX6Xl2NCM1idz41CAr7cC2Iq5a87XZUXfl2rsi14UcCs+Wl4:FVLCl","tlshash":"6ca333131cbe346b048f4b63f5295e47af5ffa43da16624cb2bc26852fb7d56c982204","size":107243,"data":"","first_seen":"2025-12-16T18:55:46.047375Z","last_seen":"2026-07-18T23:39:45.24889Z","times_seen":465,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/effects.js","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8907e7ac4435cb0d6ffcd50ed59f9f9","sha1":"16740f889a30683124d1735fbcf44a3ed17416f3","sha256":"56816d420f34ca51067379a149a0b758307831aaaedc3679c5cfe39d517428b1","sha512":"fb3fb6e593de9e545dc68f01648f80469095c7d4f709a8030cbbbeeba9b0e8281beca0abf57f79a99216dcf554d38278efeb7ead7a2732b2309c6e315ada33fb","ssdeep":"768:SI4W7cxh1N3KVYNsWfgYVmkBxqSvErYncPcCIcL6meiXcUucncKcRcyc5cGcjcj+:k1dKVwVV5BESvk6meQfnYxswShho","tlshash":"6b9395c6554bc4d58e2110dde473e818e4682a63ceacf0a3ba6cddc2b45ef66c44763b","size":91734,"data":"","first_seen":"2026-02-01T10:29:02.005223Z","last_seen":"2026-02-01T18:25:13.782961Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1159f4250e7555f723427cb297b6a447","sha1":"4733026c8125e59870d174752e8c7f79ea3ad09f","sha256":"46f246748bf2f61420da19c837ca47561075447a5cedd1d23c36f3f7c3c9392d","sha512":"00fd8d44171ee691f5b8f42b34996b11cb0d3b27dc3c9e5074b0e7dc13bf846752bb22e9b305f7d382344068440264193f1d69e766f5776ec57dae41f05ac4d1","ssdeep":"","tlshash":"97c0804c9957420380d53c579995300711728066487d4503114d9f0896d7667416fd5e","size":150,"data":"","first_seen":"2026-01-14T23:35:49.336139Z","last_seen":"2026-03-18T14:18:01.002253Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"72fba25d8cdc73b49414a4f5b5a60a29","sha1":"1d2ae6c9aac94ae1fe6b45a0855262b8acbd2e7a","sha256":"4b80dde4819d601ccf673191f4acdd46a1332a824b57c4f09b2019516f320642","sha512":"3d0684f0d74e5929a48cc6eaae72a98fa9cb0c5d8e3271f62649b41ad0c277075e26a91b5d3e0c5018d54da0dde1ef09b41faf7d7f31c191ac091d6e44f15b9d","ssdeep":"768:3YkWbcDh5tlhUSHnO2XUcFcBl97EUNuVvIr/hU/cPcoOcLA2sO5c6acncKc9cycJ:x5vhUSHO2XUDloVvkA2s0VnYxkkSP1","tlshash":"f58363c55a4bd4d08e5111dee473e915e4282a23ce6cf1a3ba2cddd2b45ef22c48763b","size":88206,"data":"","first_seen":"2026-02-01T18:15:55.622179Z","last_seen":"2026-02-01T18:25:13.933418Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/widget2.html","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"65a97aeb1547ceae49fe455f4661e113","sha1":"d36baaa8af9039b4bdfe6738c2806d0cda05f38c","sha256":"71325c52cc5c33da6c0eab559d39f2c3d9d06aff0bfde0299e98a0cb17d49ec8","sha512":"2891a15842058054995c15d1ad31cfad24eb34ceae0e55514983c7d9c4b667d6f22f2cba86626aefd2c870658900d3e98bd42482d169d620b4ed6b884fab6a51","ssdeep":"192:EpNGhezh7VjqumnzUosdL78vn2qbClU/mJjhJz3PytT:LYFVjXMzUNdYmlrXzsT","tlshash":"4412235423fb3136a06220a9e2cb25501138204bb832c4ddbb5dda4e5fc6651d8fbfec","size":9397,"data":"","first_seen":"2025-11-26T00:18:39.221873Z","last_seen":"2026-03-18T14:00:27.46584Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/widget2.html","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1824b36dbd0c5c15ff92080927cc2be4","sha1":"57d0a64afaf2ced9240978bb81a67acddf734a4b","sha256":"517ac508e9711af1c51bf023dd8dd653c155c7d9bf07c627f76866503978c130","sha512":"4f932bfc5ad8c1e5e856fe601d7a6a9e1d7410249fb41db8c10428e8df7cad2126cc446dc80ae3298a909766b3338a28b5f189f0f449facd74ffe07cd93d36de","ssdeep":"","tlshash":"8e0126211e731035e0534a4d938ba654ab51f147fa0eded93719c2ca4dc3528c2ab6ef","size":793,"data":"","first_seen":"2025-11-26T00:18:39.224248Z","last_seen":"2026-03-18T14:00:27.468742Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/static/js/main.6d043f69.js","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"156ee009612add36f2938ec120fe0f62","sha1":"4bbebf25fb04765e08eaa272ae5f02e0043fb5e1","sha256":"823c460a58104d1db8bbe705613888842180ff1c7f1efb26ed4bb1a639041662","sha512":"7f571277da37c6b876050b7bebc90dee92029876024186638d332431456aa0b2162b0b1583283cb0a00d9aa072e319af1b07000fc54cb17147326242152ad2a5","ssdeep":"49152:UZ3LWBZM3Jx6+jOFO+GY/Z0Qymx3ecYW/wkpTuQmIt97SPK3qXfswl:UGiS97Sewl","tlshash":"7ad58dc973a1b0a197d755d9943b0009f23da81d740d806cf3adecea299ca88b53bf75","size":2996961,"data":"","first_seen":"2026-01-09T00:03:52.616707Z","last_seen":"2026-02-17T15:12:24.572676Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/widget2.html","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"21be5a38a92f649de5d4b8b9e3f20c24","sha1":"632065e61edecc0de2a840ee55c3fe61d30f4349","sha256":"dc4611c4acd7c333f6aaa25886ac13a91ec854d7f7ac1f02b9ae5f8034c39077","sha512":"96afebd54ab50a4e359dea6d74bbaf50dab7a3d34b5dccfa2a0e268c0c1c95dadcc3df7a4241a98951faf557bf10a788328b7e8a40b5a18df999a4b2a1a04b74","ssdeep":"","tlshash":"0cf09eeca67535b4a07691aca2177b503d65508364065870ed09c18d8fc5829c1f6efd","size":480,"data":"","first_seen":"2025-11-26T00:18:39.227437Z","last_seen":"2026-03-18T14:00:27.472786Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/d6ae884b0a2f1a5346717fc160db2d28.woff","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 22:43:00 GMT","end":"Sat, 21 Mar 2026 23:39:25 GMT"},"fingerprint":{"sha1":"40:88:D9:AA:10:BE:9D:1B:7E:AC:DB:D6:14:FC:6F:E6:79:79:51:19","sha256":"AF:49:70:AA:7C:0A:4C:C7:BF:A6:11:E3:2A:88:F8:B4:87:46:2B:23:29:AF:4B:E4:1B:F2:81:6B:C4:45:AB:CA"}}},"request":{"raw":"GET /t/d6ae884b0a2f1a5346717fc160db2d28.woff HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://db.onlinewebfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: application/x-font-woff\r\ncontent-length: 27008\r\nserver: cloudflare\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\nage: 562\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nlast-modified: Sun, 01 Feb 2026 18:15:20 GMT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g2uUtNmQwAAk36DAerb7cUEnZ7LuY%2BR55NZjaVTRJFTlcq87F9l5gK8h%2BB7di1A%2B8LXWyEGVdAFG3%2FyEcrKL6r6kL033HqdkzXNNgsUdu933cIc3Mg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cc26b1b120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27008,"size_decoded":0,"mime_type":"application/x-font-woff","magic":"Web Open Font Format, TrueType, length 27008, version 1.2","md5":"e268bdba1a8d929c3fcbf0e82715314d","sha1":"dce4df6fd3b44a6517dba02411188863fdf74121","sha256":"0476a430debd224899e40502a2d3222918ad9215e29a74c901507506d137b9e0","sha512":"7242698b0122f54ae2c2fc367a29f8639044b355b90bf01d00111ce318b42f0c8c6d402078f25df13536930c425ed11545b2357ea821521d6766f5bd12294d20","ssdeep":"768:wPa+GIuGrPVafePrg4DY031BDIFYts9zh:Z+GqpnTg4DY6QF","tlshash":"7cc2e1315fb4a4b5ce1e97eec8b3776496b0b22c35d10a0e17e0d2bd4d0a2d5085ace7","first_seen":"2025-11-26T00:18:39.195731Z","last_seen":"2026-03-18T14:18:00.973531Z","times_seen":56,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":20,"dns":1,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/static/js/main.6d043f69.js","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:41.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /static/js/main.6d043f69.js HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:41 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:44 GMT\r\netag: W/\"2dbae1-19c09f3e2cc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 563\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7xq53wO8%2ByrIS5W0bh1LyT%2Fnwq1A9w6rTIkO4iYfUaAlmGYtzm7wek3s%2FjGa%2B8tQr5tFeU3RP2KiVG0THcyGEBkLVT1F%2FH6g7ZwM91PNKlZ92kNxMPc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cb4ff9d783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":2996961,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3256f8604aeeebd9a80abea5c5e2295d","sha1":"a21caae1b62896cb18926966d62b47679b59df4a","sha256":"31b8586c01d4467701818c42d62a88510bc3145f0e6580ba92676fdf54ce22b2","sha512":"4a44857a57ba69a7158225c8c904758baf5fdf77f33cf5030f457f07e8ebb19acd677582277ba541dddbc8fa6bc088a27b78ff04f6584f62aaa9859980682cfd","ssdeep":"12288:gxOYYl+ZTDeYiLhBdnMhKhVHC/+Kt7bFxb+nV:uOfl+Z3LWBZMMhE/+Kt7Jx6nV","tlshash":"16254bc47391f06647e791a6403f1007f3396929780d846cf768ecea7d69989a23bf39","first_seen":"2026-01-04T19:06:41.320572Z","last_seen":"2026-03-18T14:18:00.993677Z","times_seen":41,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/arrows.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/arrows.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"97c-19c09f3e154\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=02X4qmVPkTPH7pJuTe1eggYN8jNe78y7876IMgNUJZsvvHT5g4%2BuP7xaBs6NfVzoi84oxkXP%2B6g4I3PSEAcEgsosbxj%2B0AMk5AM9KQgmKdkLkgAvmU0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcf9ca783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2428,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e0fe79e7e45e6ab72a200058537aab61","sha1":"6dd6cc2d67a439869cdb2c3138a918eab97a5dc5","sha256":"a0105ec6578596bd1360cdbef110a620ec095e9463f05ece85ccb8a6c0722586","sha512":"56b34dde1ef8d53315491d35d11bc31d57a5a10a02d37bd5ace85dba47d819b1241682411c972ecd59de199299b1300e583dccc2d707894f242f5ffb1008648b","ssdeep":"","tlshash":"f84150cc33be35f8e846e0b5c711a41c669f24fe25018eeac346081d9a99c946c1ace7","first_seen":"2024-12-24T09:00:30.365488Z","last_seen":"2026-07-21T14:05:53.743887Z","times_seen":96,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/cross.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/cross.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"d29-19c09f3e168\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C9h%2Fj9XUe%2BQ%2B%2Bl2E06Jr6RxkJNP3a%2FJK0HwDxDeOejAchNqSSNlydWgkog3AO6D2SNxi%2BRS8cIestuQbKzkhVNMTNPfI0Wxaxp2gU8m8dhCvBiTR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf862b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3369,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2be6009f566db2b00b2354b27e8a1038","sha1":"bec4b18b685cfb94766e50de043ff57aced66921","sha256":"332a945cdaa366b3caf09024c108e23d45fff1e2e651e72a1468f2227d874990","sha512":"64a99df77353a1b0304a21252be67b8d1b171c2e1a034d5e00a83765fa017ebeb774b144420de68198646e8e7a21dd3a70b46db54370a9c3c070af0308874c43","ssdeep":"","tlshash":"6c6164cc77dca3b9f416e4e9d7072494598abcb803c40564cb553e069d2e8c8ef9798b","first_seen":"2025-05-13T10:27:03.882817Z","last_seen":"2026-07-21T14:05:53.755398Z","times_seen":95,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":90,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Outfit:wght@400;500;600\u0026family=Onest:wght@500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css2?family=Outfit:wght@400;500;600\u0026family=Onest:wght@500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 01 Feb 2026 18:24:43 GMT\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4024,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"6af9c8f9b578005e11a7b59887d63297","sha1":"d6a908c832717c57dfb6f2fa2f4b0ee819a98f86","sha256":"d30249df41112105d33ce9823af3a4e5db3246df992267903aad8ec54c46d10f","sha512":"1a1eae0b259ea17dc94f333cad7494bee0facc38418864f2501e6bbb5a38edec2a505a89daa476d596646deadf66bf689275477012b0ee7c6939c0143570d2a8","ssdeep":"","tlshash":"e881caa1042ba504df871cc223ce7e27ee1f62516840d975affe1898acbbd6a435670d","first_seen":"2025-11-26T00:18:39.199822Z","last_seen":"2026-03-18T14:18:00.99829Z","times_seen":56,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/3.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/3.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 12329\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"3029-19c09f3e14c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2FL9w4vL6e4MmQgZA0BFae1OgUr43m6AGIhUDruVkr7A7d3kl8WpnehLmAi1TVhIkLPUMQH7HgA3pGR2nMHgydr%2Fk2KEcHTZv4lRp0GatfBwCp51\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cc23d15b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12329,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"ed1b652c3d97e133a3a52caa573d221f","sha1":"995b39aeb3336a7503445318628a270fcc13aa9c","sha256":"5ba214e8b1730813b64caf4e03100d0cf7023ef5685c3b533a60857b98b8fff4","sha512":"23aca4f38ccab82e3ebeb649021377310877f2bf7a02102c0fcf08d396d720babba4b19269d94b19990816b0c2cd9d19948717e0a59f4efb228665c08a104661","ssdeep":"192:n7kFvPG2wXmfdwAeU9QcnPVriuMxtSjtt3ZDEV+yex8MXALE7fgppPPBmKWw16f:nKG2w8dwAeUlPVHKSjfrx8egbNM","tlshash":"8d42c002d7425ee089f2d3790d00f8b66ecd167a7f371525198376f1aeef4829422d13","first_seen":"2025-11-26T00:18:39.120505Z","last_seen":"2026-03-18T14:18:00.976875Z","times_seen":55,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/static/media/inter-latin-400-normal.9698cc7dbf147ed363b6.woff2","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:41.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /static/media/inter-latin-400-normal.9698cc7dbf147ed363b6.woff2 HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/static/css/main.215ebfc6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:41 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 23692\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:44 GMT\r\netag: W/\"5c8c-19c09f3e2dc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i2Clwfi0kj2LiR7o4BYuIJ2%2BkqsP39ontXr9k30RsOcgG2jGFrnY0rO0LNGAVOl0EHRI9Yi52TNcda%2BJLKQOhQrfi9PhmVnv5C2vpLe91OtnJr2FsKM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cb5694c783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":23692,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23692, version 1.0","md5":"f837d382a885a07c34a3d4bf4f49373d","sha1":"68ddceef1d164a48d9d01d4a74f26b7897323229","sha256":"dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33","sha512":"ef010d89971c4f69af7bf541430364c56245a5b63ed730fe628e49f48fa9e201c7f42b1e104eb14c3193bf79dd7ce20244f6b963e9996eb8308c0d61f444ece6","ssdeep":"384:rfabeuzsqm+MAlOitodpHq9WS5TO+cig4RKuIc7OhiVaCcHKLgFT1GS:rfEeuzM+MFSoHqgS5TOjr+QTUVPuSQ5X","tlshash":"85b2e177a100a48ec93cc9ec53b1ea7b736f7941f02e5fad41fa50361c7e580a19a0a6","first_seen":"2024-08-02T10:23:33Z","last_seen":"2026-07-23T14:20:25.095869Z","times_seen":7999,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/effects.js","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /effects.js HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"16656-19c09f3e134\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 563\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TsKWW0pvQQm69q8OlNJ%2FslV4HsMvhsAGqkF6VIf6MekFhq8BngKy7ChBYf0cAGno2LDm8Ll4ka1BhPwDztqf2orxmnAz6WcUjEbl9CI%2Fqf%2FOGwbElEw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cba68ad783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":91734,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a8907e7ac4435cb0d6ffcd50ed59f9f9","sha1":"16740f889a30683124d1735fbcf44a3ed17416f3","sha256":"56816d420f34ca51067379a149a0b758307831aaaedc3679c5cfe39d517428b1","sha512":"fb3fb6e593de9e545dc68f01648f80469095c7d4f709a8030cbbbeeba9b0e8281beca0abf57f79a99216dcf554d38278efeb7ead7a2732b2309c6e315ada33fb","ssdeep":"768:SI4W7cxh1N3KVYNsWfgYVmkBxqSvErYncPcCIcL6meiXcUucncKcRcyc5cGcjcj+:k1dKVwVV5BESvk6meQfnYxswShho","tlshash":"6b9395c6554bc4d58e2110dde473e818e4682a63ceacf0a3ba6cddc2b45ef66c44763b","first_seen":"2026-02-01T10:29:02.005223Z","last_seen":"2026-02-01T18:25:13.782961Z","times_seen":4,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/blob-dark.gif","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/blob-dark.gif HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/gif\r\ncontent-length: 533111\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"82277-19c09f3e15c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VbFdccIax1VZoyzkNyFTe%2Bu86hbeUkvuk44S3d7ubTlHO02RPTKLskQqvJARbzyn58%2B7AogT3fUlr56hAMjFKz7ky3mNpvahQUBIiU5zEfsZ%2FTgy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf877b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":533111,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1200 x 1200","md5":"4b89c04f65112f96c8f3ec9f0ff1b1e6","sha1":"c312edcabbac8befe2c76f21bc79c76624521210","sha256":"e716ea780e082380a41d3413af124c8511ba8d04af20237a09604359915d7b40","sha512":"41325c22e372c3ab18312b49ab693c0f36655ee7c1c349a958f0354c21da1abbaf5128044f5b7ecbf2df884d2370eaed6456d2bd95f8abd5c44403356180868c","ssdeep":"6144:vhUHdZZv3ibtMqFbTWzIQxfgpR/YrLaza7P/2kpQ:vhcZZv3ibtMqdyJORwr6a7Hhy","tlshash":"e9b4c0cc8ba78c217921e59408e8c89ec1f595fc22b892b3ff497f60365ec96dc3554a","first_seen":"2024-08-19T17:12:45.420342Z","last_seen":"2026-07-21T14:05:53.791657Z","times_seen":108,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":85,"dns":0,"connect":0,"send":0,"wait":40,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.hyperliquid.xyz/info","fqdn":"api.hyperliquid.xyz","domain":"hyperliquid.xyz","tld":"xyz"},"ip":{"addr":"52.84.50.92","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid.xyz","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Thu, 31 Jul 2025 00:00:00 GMT","end":"Sat, 29 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"33:BD:50:89:D6:4D:E7:95:1B:3D:33:94:1B:27:5C:F0:50:79:ED:12","sha256":"CA:1E:6C:6B:EE:C6:41:84:60:4A:36:EC:7B:1E:C4:03:1E:42:BF:E3:32:7F:27:A1:E7:EE:F6:7E:F1:68:CF:E4"}}},"request":{"raw":"OPTIONS /info HTTP/1.1\r\nHost: api.hyperliquid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://hyperliquid-detect.xyz/\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx/1.22.1\r\nDate: Sun, 01 Feb 2026 18:24:43 GMT\r\nallow: POST\r\naccess-control-allow-origin: *\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nX-Cache: Miss from cloudfront\r\nVia: 1.1 d229ccc15dd984a81023d1b57fa0adbc.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: OSL50-P3\r\nX-Amz-Cf-Id: H_uYe-ZzMUwLvdeKcKpRIQHTr7cqWm1ebQ1ajRTcORFChTe1P0Q6_w==\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":462,"timings":{"blocked":85,"dns":54,"connect":1,"send":0,"wait":290,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ch.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ch.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jymFIhvEILxAxN8FBbPftGKA4HOWB%2FpKwa0mUyWQqoLwPkTAZUlHqlYQjSIm7yLfKvaxwL8wr25vWgi3pavXKp72HWNXuidvIA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 736329\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-b7\"\r\ncontent-encoding: br\r\ncf-ray: 9c737cbf58e756c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":183,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2acab683421eae9cbe5ac6555c999db7","sha1":"a573d5b5e766510d10568a13a7be82bb3db20cdb","sha256":"a5ec3bbf0f3e686ea05ae17f51e8f3a287ad332217b679bbd393842b7d427859","sha512":"a8af45d203b5123fe964882e386b5478cdfba39c541f59b4e3af1f26c1e7e56703fe7d769b6b24bf80fbc2df6b57ca28fd1a6330f98943712c02ed67fef3dc69","ssdeep":"","tlshash":"95c012b4945e9547841d4b701f5cb52644bb51d5714809eda5901a0022676e7f861bd8","first_seen":"2024-12-30T23:46:01.888722Z","last_seen":"2026-07-20T13:30:45.828972Z","times_seen":299,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":70,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/logo.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/logo.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1cbc-19c09f3e180\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1ZDYiJjdlljaYQey9a7Ouya3NsLR9%2FT0WdRV3kHRWcyeIeE7RIL%2BlQy8vCZp8SOH1ei6Q1I%2FmAicjPNku%2B5oUcdoWFhV697Jf%2FYQ6KUQLs7P8siYNtU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcc912783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fda28f684fde04ab162b1c77437fba27","sha1":"82b0c3a51dad8809043f36a8cbc25c959846a9c3","sha256":"9284325a68c5c57693cc097f46c4dfcebda802a013774fe46a4e785f08ac7b3c","sha512":"1ec68fd2d4626399a1d2ad22ffbe36147bbb7e9f550c25eb549a40ca4529d0f5462c85149a7195e7a749cf197335b1f746341fafcd145b745c6dd2e95ffbe893","ssdeep":"192:L81ZDrGWzUggauQt7q80VHIQR8nDhFmPsmp:gZDrGWzrgauOq89ntFC","tlshash":"d6e196de7b9892d0fc97d7f0dd1a00693a1f68fa0f81c570c3998e48b5972adc489c88","first_seen":"2024-12-14T09:51:47.786813Z","last_seen":"2026-07-21T14:05:53.687738Z","times_seen":175,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/titleLogo.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.070Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /landing/titleLogo.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/blob.gif","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.294Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/blob.gif HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/gif\r\ncontent-length: 128403\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1f593-19c09f3e160\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t7MgPUH8m5KXZF28Moa6p95ZU%2FONj%2FFpAymI%2Fj%2BBbBXPdO6vPCerfQ6BCAl5Y8V%2FtDOevgmX8G7Rzfu6icE0%2BAL3Oclb%2B2zhQ3SrvrO4oF1y5937\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbe9912b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":128403,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 200 x 200","md5":"a99c245ec131a05a3e2873c63eb0560b","sha1":"6b48fa7b2de0e6d0a26978081256af8dec85e92c","sha256":"ed38d4c064ec376d3645a155c301953d3de30212d0b0b25cabf40bb6d1e6827c","sha512":"167f0c86c86ea9f537c1b7c296fddf71f920bb7b1677fc762c00f7e9fea5e24992aa55c341bd9174b07b3b6192f34a7f63fec2fe6d6ef257303cf454128e739d","ssdeep":"3072:7WdpI/qi9scSyxJrYGcV2yaIIbXXjgg/V31uDNRDO9lYAlvc9l3J2UFrHJUa4Fs0:yrI/qksJyxJrYGcpaIIbXXjgg/V31uD+","tlshash":"4bc39f3ec5355b63da2a8eb3211f80c5130e5f3685712da78904abaf2e1477770a52fb","first_seen":"2024-09-19T22:52:05.905151Z","last_seen":"2026-07-21T14:05:53.707087Z","times_seen":323,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/c/d6ae884b0a2f1a5346717fc160db2d28?family=Roobert","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 22:43:00 GMT","end":"Sat, 21 Mar 2026 23:39:25 GMT"},"fingerprint":{"sha1":"40:88:D9:AA:10:BE:9D:1B:7E:AC:DB:D6:14:FC:6F:E6:79:79:51:19","sha256":"AF:49:70:AA:7C:0A:4C:C7:BF:A6:11:E3:2A:88:F8:B4:87:46:2B:23:29:AF:4B:E4:1B:F2:81:6B:C4:45:AB:CA"}}},"request":{"raw":"GET /c/d6ae884b0a2f1a5346717fc160db2d28?family=Roobert HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: public,max-age=86400,must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P5PFHFof1sJmAx0JP%2Fu1Y6X0Ubo4CAZRF%2FNpKYqWoLnluMJX8xjYGTOnygA3w6fiOkINTAAp9rIGvJfpbYc6UKSDhj6Rn0C9kYEfht9Zbk3SXb8%3D\"}]}\r\ncf-ray: 9c737cbf58beb521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1113,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"b529b194775d85ae8f26cd417d4704d3","sha1":"619b4b5e216843b19f41b360b98cf706139786a4","sha256":"8c0471be970fec7ba6ee94be1ca95704901dd00b1ebc8a700dd6e661bad2e2b9","sha512":"e82215bdbaa2b5a8ec2aa4ad64d03b2970519092d7aeb1cd669fc5b54dfeabf04de062e14c0643c5c71ca955334379cbb04bd2b40e606512b9bf84c6daf2ad54","ssdeep":"","tlshash":"da213b8ec601983497b4060c3bf3e954e883011f9c34aa86b93d9d55efb4a2da151b3c","first_seen":"2025-11-26T00:18:39.192284Z","last_seen":"2026-03-18T14:18:00.967961Z","times_seen":56,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":78,"dns":29,"connect":1,"send":0,"wait":196,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ae.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ae.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jo8wqR0NhNHh3EocsIvSepbMTVfkeS4NHPsqeESRS2JQIRlYjfl0JcFURS3JPZRyUAlyjCwOTsv4ravzFZM%2FW72E%2BSqT925E%2Bw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 917046\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-e4\"\r\ncontent-encoding: br\r\ncf-ray: 9c737cbf58e856c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":228,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cf8785787f9b5d09eeb392a3c57d616d","sha1":"c5e54922f80425f875e9c2ee6175cd42492d7c7b","sha256":"8db8bfc3d1a711967e44fbe237a52d75cd03a3dfbcefc9d78febd61c2973915e","sha512":"471e9b2e8bd7aba4eb0fe4b308e17dab29c3c37d82693c7d71ed9409b9de18d362f34296a24ef0b0570f88e8e59241c11c86daeb0775080a701c8a6e1e3a0662","ssdeep":"","tlshash":"29d0a9e192bc34040c0343b04fac70c380d3308b724a02dcf1440128225e78bbd41a59","first_seen":"2025-07-05T23:55:45.268447Z","last_seen":"2026-07-16T04:17:52.717414Z","times_seen":189,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":72,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/1.jpg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/1.jpg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 2948\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"b84-19c09f3e148\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kIcuDJoS8lNPv534qcvJ5uWnVnupYgJQKyps5ZOScVvknSXAIR%2B3qlxbL3uwGRxFU8kBiE89wRql464Flno3vLGA46LgRrBoY%2FdsVdzpUzp%2BTZT3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cc23d0db4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2948,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 100x100, components 3","md5":"8297af4428a06e1aed012d357b056f97","sha1":"12e8d42d563c90e55b31c3d7822b07466ca66e7f","sha256":"64096b87ea94fef11abfb7afd1e731397e8c0ff54baf4a85884a7e7ae94b0fd5","sha512":"023e48b1f6d7ea2dbb919a45864f60e7d00688b69f88d1732b157e9444b6d239a3dbf1a5515503a04f1e03f8948e783c4cd1bed801d9e753e18d6d03e33fbc71","ssdeep":"","tlshash":"75514dd3bde1206aff3c9c7a94e41268d64642e1b896bf9a580301ac879f447344f738","first_seen":"2025-11-26T00:18:39.150097Z","last_seen":"2026-03-18T14:18:00.986527Z","times_seen":56,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/largeLogo.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/largeLogo.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1a12-19c09f3e17c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NpdDS39cOdaSP5nGJZEHVNrOLPHyGtq1A0HmW6WUIeH15C714vuJALBOaq7ys3lxPFt2Za7YShc7RAYdMTAmVXLfuD1KfgGpzrdQzPoYjGX8nLHi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf874b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":6674,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"44fc299106753ea66e88cc2f29e9820f","sha1":"504adcacf65299c9551da2ace79dc3913c9873c3","sha256":"2660b8d485828e9fa4d801511d9488233525964235e8615c810082f5105b2995","sha512":"13e1ef1d03492aa088df3f2d5ff84a4ceb1c800eba8517d7359759470030cdc5a999e13e02fa5dcbda8b4d62fdfa92709c2c827fca23e8f824b8146d3c274b20","ssdeep":"192:teREWY5JIaEv5hDlz0ytK9yS5Bcx0nfYvD8qBgU:tXgJVRttSD5w0gvD8LU","tlshash":"73d163fd3b604ad1edc943c79f1601e86e0ba5ba89c5c645c508bf1928978ac984dec3","first_seen":"2024-12-24T09:00:30.372018Z","last_seen":"2026-07-21T14:05:53.752185Z","times_seen":95,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":85,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/favicon-16x16.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 443\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1bb-19c09f3e12c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 561\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VFqtWqEsDMjiQ5DBTx2V6gaouTfO71cDpSWAECEBnhW8WfjwNXW%2ByiOyPrTry%2BLOE20ycr7UNX0RqwfB3xndV3ueUecj7N12XAc40o2aOXJlKe5HEjE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cb97dc1783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":443,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"8b790f9419300894697b539cb22a3ea3","sha1":"a5a9c3b6f255a28a502820a1caf80d1e2b1df859","sha256":"1a5cef82cb2430c4f7ea7ec377e4b96ff01b27a6e258a7ec594f5213f58ca069","sha512":"f55ff8e6214b22d41b7b042f635f36cac45c0001dccc5ba76957bb7ec898ba8a4869ba2d3e65cc9e7b67d792b639c9016bdcccf77d4495eb2503a52ac9ccfffa","ssdeep":"","tlshash":"4df02bc517a77c73dd4c6716b34f5548851b831d4b05143d55063c65549c74c5054d8b","first_seen":"2025-11-26T00:18:39.106691Z","last_seen":"2026-03-18T14:18:00.987644Z","times_seen":56,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/wave.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/wave.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"7609-19c09f3e1d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KRm3Rn9FaqTU0kWU4nghslw%2FwUTzmaWM9Z4Ko0cdsKtIUwfWFHO7y7%2BJZUOt1tiNjo0zaNhcSDwxXMh1L5b72ZWOcfdtrfQDNdkYg3FzZ4mAX%2FU6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf87db4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30217,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"452472b80636e3d91196d67329928606","sha1":"fa94dd3e17e4b6d623f84cfacbe71b674b563473","sha256":"409ac461d71dd443c330b5be3bff5e30d38558fd8aa957a49c6bf97e0ff7dece","sha512":"67500fe1077c2da09b900a1f9d5415e48036dcb255d430a7df97776c8d163538dfd133ef6636a6fb15f1621560f74d925ddb0c464713e672f9f481020bdab0a7","ssdeep":"384:LAc7ilOrs4A2h3nj4l0h90I62AgYMGBqB8J5W1HMSUzlH/zUApyO9I5WDTKEZg63:08+2NMl0HF623YMGBqqjWTqH4q9I++I","tlshash":"f4d286eeab119ce45ec8c1d6ee11c1d47b0fb03f5b6b8761c048ebf9780ac98895ad54","first_seen":"2024-12-14T09:51:47.810301Z","last_seen":"2026-07-21T14:05:53.784851Z","times_seen":104,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":79,"dns":0,"connect":0,"send":0,"wait":51,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/fonts/Teodor-Light.woff","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /fonts/Teodor-Light.woff HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: font/woff\r\ncontent-length: 48544\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"bda0-19c09f3e140\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M7IPEfOpAUXKFlZm0sqPFqy3BdZb2vhhwq%2FwuxUX%2FPF5kfCqymEOvZSu%2FvZqpOsopki9515xho9Tnr5vaBO7moK1Jk4pYivHA0qeptui6RV6ss64\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf861b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48544,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 48544, version 0.0","md5":"9230afdd48c386f422f322498d06e9d3","sha1":"acec13841c56a2a5f60efc19725e80bb21a34940","sha256":"3e52268c028380759b5b74c7d16997c3c74f67905d237eaaed7dc7dd978c93fa","sha512":"a25c72c30d05b32a597f44621eaac4d54e14b2c36de4fc03985fb18b2e4d36662c3882b4e39282c7d09c7dceccd31722680eee5807e0e3a92c1d1a9adbb9c1e6","ssdeep":"768:d69IdRNJrtIssppRsaYxLX3vadbF/krLhqEzm6LoCG11cgXy5Vd0xn/5x0:dnvKssppqzLvEbFwlmjP1I5ih+","tlshash":"432302b7a425b023967752f200ef6f7475a09a4f905af0523e139b0f826d1e39dd1d2b","first_seen":"2024-08-19T17:12:45.41721Z","last_seen":"2026-07-21T14:05:53.695694Z","times_seen":111,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":75,"dns":0,"connect":0,"send":0,"wait":28,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/blob_green.gif","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/blob_green.gif HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/gif\r\ncontent-length: 166809\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"28b99-19c09f3e164\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kP8BOZYNWBWgdAs2Th91bWVLvfn0W%2FQizv20kx3YnvRbnO9OqGgkXxu5GUoRoKLJkGzv2%2BscfMuHS8Rqm8kMNrxF4b4j58NZh5awojoYcq5%2FJM23uZo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbcc90b783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":166809,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 300 x 300","md5":"da09864f233ce0bb00e2da394736f38b","sha1":"cc8f254febea95a81016d2d52300f7bc4772fcaa","sha256":"c6c9e3823d546a595b18684fa9b48ecddfe656e7ecd8e5d81d5c0ef6bafdd00e","sha512":"6bba7e22baf01c7e294a9ed4cb6949e405d523000776dee2ccc3f8b53898c3c83300479b4ff867bfeab753ae6b4c1e0f217c0899930fd67a98fc566d961243df","ssdeep":"3072:rh7H9HfrW3rkxJKsS4cKVBiCkO7WWmEfAunjMX8v4gzIbN+t6Yc2Q:9FrW3rkx0sS4cKVBiCkO7wunjMX8v4gI","tlshash":"45f3c02bc22687b796238bf6545ee1ca158eef7f856528f30c1053b31949fbe30145ab","first_seen":"2024-12-14T09:51:47.768581Z","last_seen":"2026-07-21T14:05:53.732792Z","times_seen":154,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/us.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /us.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-2fd\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1093146\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0d6nseyGDyXaJPbJXg%2FzKHKuFlyAa824YTM7XqDNFtaLyvxzvechnxTN%2B6DlNpxemD3wN5i2lKUMTUETeDuFLMhpuX6IqFXzDQ%3D%3D\"}]}\r\ncf-ray: 9c737cbf58df56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":765,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"95cabb26729b10db04ff2cf3452b06c1","sha1":"aaad0f734694625c31f69fc3d5e205a445b263b6","sha256":"e1792c011daad918fdbd99a21f7f46fd71018ffd052af5a7d7faf9954d593e31","sha512":"174b15e4297e500e85f9fc3e5265e256e03a09326f66af485ca6add8afa13b2c1e85822bccf2d7fbd4597e7f5a2257b6a1d6035c02f7e390cbe967ca9ca8e12d","ssdeep":"","tlshash":"d9014982946e070d921873fcd2b8f0e9c0137866229f0daff861b659a17e7566e92d18","first_seen":"2025-07-01T18:36:10.386523Z","last_seen":"2026-07-23T14:12:00.690154Z","times_seen":1173,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":76,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/twitter.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/twitter.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 749\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"2ed-19c09f3e154\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QEHxHkD3T4kkgjJOtP%2B6ftN7lmXua1C7PhjCT0XH2wEQqoAn7YaOuX6oX7za9gqrPjR7TNJbzGf1kV7%2BLSY3v74ijnon4aeywt8MUsB9O9kJCXWI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbed970b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":749,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit colormap, non-interlaced","md5":"08c4467b40ac461b7cbf2de4d7d667bc","sha1":"1ee226ef3c17de10dd9b84593fcc513a62a65117","sha256":"6a020db454d2b7ebf65e8538611edf1188c9ea83a675b8658a152cfc85905d29","sha512":"0e8f53fd07e0a9badbb18755c1878fe8c6fc782e8175088623b00d6a188b1f4ad8489c4c436113b54c272c2d4923457c765cd726271823c883469a1b9a4e12f9","ssdeep":"","tlshash":"910165fb6b0b9d35ab9e9ea2284dcae399624542ed2150e153104c5535c498542e5f60","first_seen":"2025-11-26T00:18:39.160676Z","last_seen":"2026-03-18T14:18:00.996252Z","times_seen":56,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/apps/clmv1d6am07asib0fs4ss7w2x/embedded-wallets?caid=152afc78-2f7f-4819-accd-a6dca3e1bfd4","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"GET /apps/clmv1d6am07asib0fs4ss7w2x/embedded-wallets?caid=152afc78-2f7f-4819-accd-a6dca3e1bfd4 HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nCookie: __cf_bm=6VvEQuytapLkg83vyZjAGwpPUIMQcTrd_n9eVLcRndI-1769970283-1.0.1.1-ANVj6Euooyl526D2ILyawM03EGSbgrBg9qVfUzMngf8guTH4XK1MpEsyFXRy0gzpeR_kkYh4mIrffRRA2QZA90Y962RexMafFOYK0gKxi6o; _cfuvid=xDiR8kyaLDRwlxK1_7JIKGnu4ZEUJ1N6rpz9ISprwmU-1769970283232-0.0.1.1-604800000\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\ncontent-security-policy: default-src 'none'; base-uri 'none'; frame-ancestors 'self' https://*.hyperliquid.xyz https://auth.privy.io; child-src 'none'; frame-src 'none'; connect-src 'self' https://auth.privy.io *.infura.io *.blastapi.io *.quiknode.pro *.rpc.privy.systems www.googleapis.com https://api.apple-cloudkit.com/database/1/; script-src 'self' 'unsafe-inline' https://auth.privy.io 'nonce-MWI2MmE5MDctNzg5Yy00Y2I2LTliMDQtZmU0NTA0NmVmOTg4'; style-src 'self' 'nonce-MWI2MmE5MDctNzg5Yy00Y2I2LTliMDQtZmU0NTA0NmVmOTg4'; font-src 'self'; img-src 'self'; manifest-src 'self'; report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3ed0be16dcee00054d67fd118ef8a00d\u0026dd-evp-origin=content-security-policy\u0026ddsource=csp-report\u0026ddtags=env%3Aprod%2Cversion%3A0.0.3;\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=63072000\r\nx-content-type-options: nosniff\r\nx-matched-path: /apps/[app_id]/embedded-wallets\r\nx-robots-tag: noindex, nofollow\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::jxk2q-1769970283761-c6a9882b4972\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nserver: cloudflare\r\ncf-ray: 9c737cc14fa14e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/zero.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/zero.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"483-19c09f3e1d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xuoWgPC%2BJI6vweXNUKOE%2BIq8UmqOdpcC7dihxVgQfR4gl2HWNJBqjVa7kW1BY3o%2BzBw18ixvEZsszZ7QwX9IMw5Iul63DZtJWHlogY5fCcXQOhFL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf864b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1155,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1c311da40a7129b5b16febeaeaf942b7","sha1":"01a714ba38c2efc972fe688a71eb95370c6991c8","sha256":"32c93176a69c5843267495d593e9483e113e7c3ddfab6bdc6fcfc3c32b9baf55","sha512":"b3dd48a921c8393f11d557bbb94914481928540b7146639a16bf10e579f271db203f4ac13ff6879a1118dc778aff2d2e00b8b2841bb392030aeea125db773dfa","ssdeep":"","tlshash":"7721e14c574c2732e8e687e4df49e2180ea834bac3415fe8c61129249e7f888d857911","first_seen":"2024-12-24T09:00:30.374728Z","last_seen":"2026-07-21T14:05:53.715602Z","times_seen":96,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":91,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/apple-touch-icon.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 7456\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1d20-19c09f3e12c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 561\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ifbhDtfDaLbiF2wvWlurIBfyv7rMby0rmP8ntrjAcxP59KengAsg4IRPkNFRw7nJTz0keX6iecTFkZ2VFqd3dRR4DiybUsFLyCyi91wv4fZAwwmFrdA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cb97db9783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7456,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ac5d8f07916cbfc01c04f466a4ad26a5","sha1":"788bc9e5f9427b97d2f12472bc9c7bc25d1467b2","sha256":"03b6e88cd148cbd0163b8858e9969c07ef64a436ec52988e1adddc02a9639829","sha512":"371c0c77cb8350def95415dd6dcac0a39d8002d695486f2fc1e7360c030ff924f9300d85bd24b8f5d422a6d13f0087c2fd95c7cd8b79143f34591d361fb0f3ec","ssdeep":"192:Pye0YNI6K1EC40TvzxrmF1KV0uDdd+TPEyleLmMiijS0m:agIb1E2TvtrmH80uJd+2mDijS0m","tlshash":"a6f1af438b7e12d188bed4576f4b3a8e1329b3088545f5cb1a5fb43f56206f84ac3953","first_seen":"2025-11-26T00:18:39.104051Z","last_seen":"2026-03-18T14:18:01.000259Z","times_seen":56,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/mask.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"6f4-19c09f3e1a8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0H3Kc4jtzLO2t9cfkH4KdDUzz6stBaoJ9EcjJMGD5WAlc61Zb0g3dXghMEqeWbD4KM74%2FI6HxAyT9bW%2Bsli97J9HGv8PgEjupmhYgGDADCYvmSolbn4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcc90d783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/screenshot2.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/screenshot2.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 155629\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"25fed-19c09f3e1d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lakUGZA%2BeKAA9Ftht7F3eRRl%2Bw%2Fw%2B%2FUeoxQ63MmaGz01dxdnjKtPALPP7e9T3IOhiFbrTNLFr86WguLZOF890wITPwkfGFVqOhuQISeTSCETTYMZBRE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbcc92f783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2879 x 1464, 8-bit colormap, non-interlaced","md5":"58c1a83c57b1bfee45658469ee5f6e1d","sha1":"0a4ca1dcdf9a9384ab709db94190bc6595a5d5da","sha256":"109b5c7a7680201d38c08d23b63e80bb6afd451e7b38d70839821bf3101faee0","sha512":"00ed75731c42ef6f9a1b0fd863853e1db6a80558630774adcf317c478f4a6b5c4b7ebc9cf282eb6144da0d00459646c52af7e86f82f10758b29df14b219f1918","ssdeep":"3072:slFYnKZEca1YKjldd0CZZFO9QgCkKoDUSgpSL5x3blZQW77y/JALXg3vrCSx3jyO:oF0UX6jG2m9QwDUJpStxL97iSLw3vOSN","tlshash":"1de312f195a62590cf1f0f7bb588991e0b2a9ce5c5128e7f97188e26275c14eb34f313","first_seen":"2025-11-26T00:18:39.173626Z","last_seen":"2026-03-18T14:18:00.984723Z","times_seen":55,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/de.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.337Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /de.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ndGtzHF5VEXswc9xRXCC7Ip507KEe1ZzLOrO6h1VfXqrAIq4ZMgutsgHhEWeeJx1KM7KcQinCIUYc%2BhkoH1mqPIg6of0lG9wxQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1077805\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-ba\"\r\ncontent-encoding: br\r\ncf-ray: 9c737cbf58db56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":186,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cfed9f984610e26dac5ff281c0329bcc","sha1":"b9ecc2265d397c12111fa819ad51892842eac8ac","sha256":"595d7718f6a22e5ea9de0cbbcabd857ac1892f4a6c81beb1ef936050193d9323","sha512":"a0f6fa22c59331000a426862c9953458e98c9e1b358efdb471565338168e74ba97c9a5c396aa00df307188ff5a99117230830ecaa231d848aceb5e02b46fab46","ssdeep":"","tlshash":"53c012d584ac3904cc1583720e9c65ce52977046614401dce4802619138d69f7c51ad8","first_seen":"2023-08-10T23:55:19Z","last_seen":"2026-07-22T15:44:30.077822Z","times_seen":993,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":75,"dns":27,"connect":3,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@400;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@400;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 01 Feb 2026 18:24:42 GMT\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3854,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"d26543f025bcc11228dcc6abc937fde5","sha1":"15a4c6e6a591d1882d1de0187151bfcca542ca00","sha256":"79aa70267aa0ed514c62a5a45172d93f6ddc48e9a04ffeb4502fb485f96230be","sha512":"59d38efa15a1ec680537b78442220a9da2d3bfd71f90fea2cf9cee5be84c1bfca2da7eb937a5e6b40b581eb4364cd58adb911d7237aa2cdb1aac96dd865111d5","ssdeep":"","tlshash":"2f819b91105ba500e7472cc923cf7f26dd4e61627494c57a6ffe2ca8adeac224325b3d","first_seen":"2025-09-05T12:08:59.10937Z","last_seen":"2026-07-23T22:13:00.356229Z","times_seen":1221,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":99,"dns":1,"connect":20,"send":0,"wait":38,"receive":0,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/apps/clmv1d6am07asib0fs4ss7w2x","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"GET /api/v1/apps/clmv1d6am07asib0fs4ss7w2x HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detect.xyz/\r\nprivy-app-id: clmv1d6am07asib0fs4ss7w2x\r\nprivy-ca-id: 152afc78-2f7f-4819-accd-a6dca3e1bfd4\r\nprivy-client: react-auth:1.79.1\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9c737cbcc83a4e4c-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://hyperliquid-detect.xyz\r\ncache-control: no-cache, no-store\r\ncontent-encoding: br\r\netag: W/\"u4xz7fm3gr1gi\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/apps/[app_id]\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::2x6l9-1769702986016-fd8c5f8fa33b\r\ncf-cache-status: REVALIDATED\r\nset-cookie: __cf_bm=6VvEQuytapLkg83vyZjAGwpPUIMQcTrd_n9eVLcRndI-1769970283-1.0.1.1-ANVj6Euooyl526D2ILyawM03EGSbgrBg9qVfUzMngf8guTH4XK1MpEsyFXRy0gzpeR_kkYh4mIrffRRA2QZA90Y962RexMafFOYK0gKxi6o; path=/; expires=Sun, 01-Feb-26 18:54:43 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\n_cfuvid=xDiR8kyaLDRwlxK1_7JIKGnu4ZEUJ1N6rpz9ISprwmU-1769970283232-0.0.1.1-604800000; path=/; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1890,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c22e0eba95246acc0cb313a09fe58cc3","sha1":"334ce0a6e4f3e13024847b9d42c158d32741c044","sha256":"745244afa98c6641d679febd66c33517b26f35cfa0ed7e313ed8d850807cd9b5","sha512":"5bb19a9db24d15c97398fc1486e9756d3496ce453459fabcc9b6570ec61801ce53f6f17bdd3222e1d9bbef6dd38422ab28afcba991f40ca0b339665ed9a7e89a","ssdeep":"","tlshash":"9941ec3d461c06bec884c641cd257ac28bade02b30657d78d2e4962cf5d3ed0233596f","first_seen":"2025-11-28T00:57:32.413937Z","last_seen":"2026-05-05T00:47:20.519482Z","times_seen":202,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":-1,"dns":21,"connect":1,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/analytics_events","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"OPTIONS /api/v1/analytics_events HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,privy-app-id,privy-ca-id,privy-client\r\nReferer: https://hyperliquid-detect.xyz/\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 01 Feb 2026 18:24:44 GMT\r\ncf-ray: 9c737cc21cd1568e-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type,privy-app-id,privy-ca-id,privy-client\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://hyperliquid-detect.xyz\r\naccess-control-max-age: 300\r\ncache-control: public, max-age=0, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/analytics_events\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::hbqng-1769970283880-4074b72fdcdb\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=RhwFaerZNkUhl7N3.eIo6NaOOz.WE.iAK9MtnHxAkUk-1769970284-1.0.1.1-VVURrpygsvZOgX.otk4Q0kF7dNHdRPee02ZXqmLa8Chnbv86R_E..N5gUuddjY4zJF5mwE5PevyFXYk3nN5jOu7Ja8wpYtEp8n2lxQNqIyA; path=/; expires=Sun, 01-Feb-26 18:54:44 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/cross.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/cross.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"d29-19c09f3e168\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=91OMFKvl0Mj8VZC53fJZbdhSwgwVhBKSkCFVqqia0GEwGvrBIYOzo90iH6jliiNqa7giHD%2Fw0%2FsaM1MhUqyXV3mkkZmKrl6MfHzaKbRfznSVtMPHaRg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcc92a783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3369,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2be6009f566db2b00b2354b27e8a1038","sha1":"bec4b18b685cfb94766e50de043ff57aced66921","sha256":"332a945cdaa366b3caf09024c108e23d45fff1e2e651e72a1468f2227d874990","sha512":"64a99df77353a1b0304a21252be67b8d1b171c2e1a034d5e00a83765fa017ebeb774b144420de68198646e8e7a21dd3a70b46db54370a9c3c070af0308874c43","ssdeep":"","tlshash":"6c6164cc77dca3b9f416e4e9d7072494598abcb803c40564cb553e069d2e8c8ef9798b","first_seen":"2025-05-13T10:27:03.882817Z","last_seen":"2026-07-21T14:05:53.755398Z","times_seen":95,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/titleLogo.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/titleLogo.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"19e7-19c09f3e1d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kuJpLqKcxHfxaKSJ7BSOy5uhXdxj1m%2FBkCzaZ%2F1ZMGyy4eWmag%2FUz4tfjdLz7tbtHP139WUaJStab6YarG7tO%2BTFUpClK2mqd%2BI0WnfGz8d0lM6A\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf871b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":6631,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3487d0cad26270542d237bd0e319fe05","sha1":"fb698b6d33b086fbc74c39d0e63eb46acf5353d4","sha256":"8c3aa09dbd5ac3284e3b42321d01b6b98a521f2523af9ad362ebd2fcc506ba21","sha512":"3cfaf16e3e3212afa1283e892799109e3605b4399b9e81db85a4b40e9a5279043a78f54a1fa05ad28da2b792b9a8b9c26363e8f5c2b0040b0f2b619b06c7dda3","ssdeep":"96:/8FE149AZhLR6qAQh+NRuNQqfzKDuUURcFRduBSwhWbXb9X+/0+fp3Jo:oqrM5wmaUURcrdukwAbXV20OpZo","tlshash":"29d1c4e927215afcf085f3fa9e07507835a3f8fa76959215c7954e4a780288c8944ecb","first_seen":"2025-05-13T10:27:03.878152Z","last_seen":"2026-07-21T14:05:53.721565Z","times_seen":95,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":86,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/main_video_edited.av1.mp4","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/main_video_edited.av1.mp4 HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detect.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 2356137\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"23f3a9-19c09f3e1a4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=POb%2FB%2F%2B0YDfaIVjqAzJywiPBKsE5ECHAtvLnwf4ykmP%2FDBKSRHhtI5GGRkD5FUxhiR0qGPxCv4EaEKDpfn0XGDARO8PM81YM1wHD52bpzISiumhQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf86cb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2356137,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"9ddd10a4130e6f93a1ee785ee3d440b2","sha1":"35b2cc01128aaf2f564399d5d12ac0015018aec9","sha256":"e9efff972c6a4b7831939e3e2e48b31d8416959884b2a62a245117e25a3362ee","sha512":"49c5626200f12cb17c7bab1b452b89694b83bc4d59e88358f3d8b44b7d0390a7a1045ea9935ebd1b893eb1b912e28d78f37527f3d230910eb782ce3d0d736c9f","ssdeep":"24576:g3F15cvkaBPM/ZXeXeIjGHJWx9HoEeYBFzagcmwQyn:AXMk4kRXOJks92YBFzHvyn","tlshash":"832523801bb5d4a9e29882bd5dfbc3143f52c94a4317ab4b2b113745fefa7a3c5808d5","first_seen":"2025-11-26T00:18:39.156854Z","last_seen":"2026-03-18T14:18:00.997293Z","times_seen":56,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":42,"dns":0,"connect":0,"send":0,"wait":36,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/lu.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /lu.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pL3q7spZbKjj%2BRwMH1qDrrTgK%2Fe3D39o7Hk5SenBc6L%2FMaN0epUGjBqCwxZByNXcPJjhb9D7spSZ5hmVGaZeVMhSj8uIqkAUyg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 313112\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-ca\"\r\ncontent-encoding: br\r\ncf-ray: 9c737cbf58e456c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":202,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7f0dfa41b55ecd5dd0c742bd992e6139","sha1":"c5640a362e5cd5262ce24e9daba20853fbe21358","sha256":"23c57bfe462e31f5655923c458bc77769dc62679e69750f6bf96371f62287f70","sha512":"9abaa14737a61ec4ec90139cac406c68a2a885e45836fa8924cbb1e2ca51839b6d72fb696b9be832d63366f3cbe367c2bce045223cba33759ae08e06e6c15b67","ssdeep":"","tlshash":"32d012ec506c3104d519437e9fbc7cc2608230dbd15606ccf46014e5e70db9bbc50a19","first_seen":"2023-11-19T13:30:45Z","last_seen":"2026-07-13T01:25:20.783547Z","times_seen":244,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":69,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/secureproxy?e=jscdn/getFile","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detect.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eppuprsummeotp2qufzt\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2BXb6atX%2Bvr58o0H1IyIMX%2B%2FCGj4LKfwUw9SYtDEoo1P1Lr1BwfFeIxkJQ%2BZpjvjxlvVzrS0xHhL3TbWBboRsPWTDplu%2B6BpIvqZbYVK0Xl2kg%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\npriority: u=4,i=?0\r\ncf-ray: 9c737cbfea97b4f9-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4095923,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2221582a3db076e8977d736f35a4676d","sha1":"8e8e581c602165b949930c0d86f6bb89d82adbad","sha256":"26fef6c81335c4501a8857c0a1e5acbf2f10c25c9683d068197142a2aa85023c","sha512":"1019bf6f167c273b2b20c70611354feaa432743f1abba5576047e1441f8b3fe3b1a1bd3603c6e99f5579e2a0ee52da545e4011321edad129d47ce416e8749535","ssdeep":"24576:uU8QnFDau6lSQQNeK3enrJvFNF8MxYnmzYZCVymivwCidE1mW:Q0Z6VQNT3entHF8Mx8mkZCxCW4","tlshash":"0c2523dae42280c13f57d42cb6d60dcd29e9448d9a760bb1ae4dbc46109b47dc6f8ed3","first_seen":"2026-02-01T16:18:00.168791Z","last_seen":"2026-02-01T18:25:13.876815Z","times_seen":3,"resource_available":false,"data":null}},"time_used":825,"timings":{"blocked":48,"dns":0,"connect":0,"send":0,"wait":341,"receive":436,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/mask.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"6f4-19c09f3e1a8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6TXELbrzje1oKIkWy3w7%2BsYcb7%2FP4Omuv2E%2F1PhC4aOlQPwzrjtwrozvIhIp0FJVW3a9zfCuK2pyhAtWh0%2FDmdP1nrLnqjYAlsPvFsdW9P%2B%2BvrDO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf87ab4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":94,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/logo.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/logo.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1cbc-19c09f3e180\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yD%2BJ5HCt0P84vIVh9f4TBP4wAsTGLbdSuegNt9eru2EkQ3X9N2NlX1KlfdeJVPs3BkL3dUeamMJKDT6OYF0XDon6y%2BxErPStjDZuHZR24fi0oLkP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf878b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fda28f684fde04ab162b1c77437fba27","sha1":"82b0c3a51dad8809043f36a8cbc25c959846a9c3","sha256":"9284325a68c5c57693cc097f46c4dfcebda802a013774fe46a4e785f08ac7b3c","sha512":"1ec68fd2d4626399a1d2ad22ffbe36147bbb7e9f550c25eb549a40ca4529d0f5462c85149a7195e7a749cf197335b1f746341fafcd145b745c6dd2e95ffbe893","ssdeep":"192:L81ZDrGWzUggauQt7q80VHIQR8nDhFmPsmp:gZDrGWzrgauOq89ntFC","tlshash":"d6e196de7b9892d0fc97d7f0dd1a00693a1f68fa0f81c570c3998e48b5972adc489c88","first_seen":"2024-12-14T09:51:47.786813Z","last_seen":"2026-07-21T14:05:53.687738Z","times_seen":175,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":93,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/logo-privy.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/logo-privy.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1cdd-19c09f3e150\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bDTDiWlUNjuMV1FRc6d9Om4xy8hzMHPgJ4XM%2FUikcNPHNz7a84MBqZlgeyu%2BzdP1ViWVvB2%2BYHICXhim8QjVNbKFhccnzU9VvSkJj3P1X%2BqTBsPYZAs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbb3b44783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"766f2387956b714ed1187970e6e993a9","sha1":"e84d850478d7cf66241b7789eb6361e79cf25a71","sha256":"639d8879178dcef27c985ebc8a8682fd45fe70642948aad298a3f827d0f3119d","sha512":"b0542709b9c518694be9b86d3cb2473d73595ade80ca898c62f6c39c201cd148fcad56b9e1ea6c43bb5252e2a8fcace1e5f385531b2a880c4ca3bbf98a92caa6","ssdeep":"192:niL+w9lkDvs9r5VoGGckX7NoBpJKPPzruVvx17avPz:niL+KlkDmYL6BpYnzq/Vaz","tlshash":"6ae1d6fa35a453e8c502e3f1ee17b4696e6f28fa3bc042a6c360ed9567250798d4ccc0","first_seen":"2024-12-21T19:32:48.64242Z","last_seen":"2026-07-21T14:05:53.771405Z","times_seen":328,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/zero.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/zero.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"483-19c09f3e1d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eCxfv4MC6EE1AdDUW0ycaE0FvDPS0xNd33F32xm1AXPlhfnOs8FVtBb3Te4JbCWpI9aDokiqaMotDZ7PbCOt3GCOGuFBRM1B0WxmOKq%2F%2F2X9jXe8S3Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcc91c783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1155,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1c311da40a7129b5b16febeaeaf942b7","sha1":"01a714ba38c2efc972fe688a71eb95370c6991c8","sha256":"32c93176a69c5843267495d593e9483e113e7c3ddfab6bdc6fcfc3c32b9baf55","sha512":"b3dd48a921c8393f11d557bbb94914481928540b7146639a16bf10e579f271db203f4ac13ff6879a1118dc778aff2d2e00b8b2841bb392030aeea125db773dfa","ssdeep":"","tlshash":"7721e14c574c2732e8e687e4df49e2180ea834bac3415fe8c61129249e7f888d857911","first_seen":"2024-12-24T09:00:30.374728Z","last_seen":"2026-07-21T14:05:53.715602Z","times_seen":96,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/s/59278/SFPRODISPLAYMEDIUM.woff","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /s/59278/SFPRODISPLAYMEDIUM.woff HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.cdnfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: font/woff\r\ncontent-length: 136108\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 05 Feb 2022 02:00:54 GMT\r\netag: \"213ac-5d73bbcd1367f\"\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 563\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OF0TRxqCkPhZnqELGjRaAkH6wjFd4%2FnMk8djBI%2BgK9gPRvy4tELinS675gJ0D3shEC%2FgPo0ILLhNeeNRY5i4XBXzAU1Qy%2FjoNZ9W41Nle%2BLWCQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c737cbda8f7723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":136108,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 136108, version 0.0","md5":"6b0b578068963e37736d9ea7c04a4138","sha1":"b585e56b8c3eeef511d2c871009d090a27acf6f9","sha256":"d2c8f9696699b39621059896e051637731eb5efd10e04eca55181be50b974eab","sha512":"91c6f6e1198547862f1375d8c4ddd1ff87e4de796d5b22ba5f5ffe8b6918561aaa86d8645d353f82df8b0529ca69b5f21925fdbe727475332a2365abd6bdda36","ssdeep":"3072:pSWiLj93sZdwJZBc7nrczFdxTknitA03ERCSlnP0:MLx3sZyBcMzFdxQIA03ERDh0","tlshash":"f9d31296db3576e6f151ebbc4530c9c14d5402a2c39ebbca1d72c6c2280a732a33ce79","first_seen":"2023-06-17T15:43:01Z","last_seen":"2026-07-18T13:00:42.390992Z","times_seen":153,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":15,"dns":1,"connect":0,"send":0,"wait":10,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/gb.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /gb.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-229\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 992117\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y8hmCpW7w2L12QYqwMML%2FZaUz%2FrWCBt1Gx17mvjMZ49O7mHrHZslNg4oaTwkOVgHGXz%2FFPmceJ4NoSBhLPsw7DS4KHgqXsOJCg%3D%3D\"}]}\r\ncf-ray: 9c737cbf58e356c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":553,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f0487cd502c5e2dbdee5be26ffa835c9","sha1":"e6c2ff948790e5d9aafd3530e49171628248cf0f","sha256":"42f04826dd7a76e4ecdc9a55fb4a774a26e03a425ca1363628bb1c6f6ea1a87e","sha512":"6df8ddf15b8886dcf672dc1dc7eb7dc54385738425651a76d588c2c7e1253e8af588ded8ad1e1c7fc8e728ca9f46e55d18be4e8e422600ef20e08aa9f7421ae1","ssdeep":"","tlshash":"49f02b1d22286926e22b4354dfbc74b4013f24de2388100cb8443378c51973f79b7aec","first_seen":"2023-07-18T00:24:02Z","last_seen":"2026-07-22T19:48:24.636831Z","times_seen":1059,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":73,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.hyperliquid.xyz/info","fqdn":"api.hyperliquid.xyz","domain":"hyperliquid.xyz","tld":"xyz"},"ip":{"addr":"52.84.50.92","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid.xyz","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Thu, 31 Jul 2025 00:00:00 GMT","end":"Sat, 29 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"33:BD:50:89:D6:4D:E7:95:1B:3D:33:94:1B:27:5C:F0:50:79:ED:12","sha256":"CA:1E:6C:6B:EE:C6:41:84:60:4A:36:EC:7B:1E:C4:03:1E:42:BF:E3:32:7F:27:A1:E7:EE:F6:7E:F1:68:CF:E4"}}},"request":{"raw":"POST /info HTTP/1.1\r\nHost: api.hyperliquid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detect.xyz/\r\nContent-Type: application/json\r\nContent-Length: 22\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"{\"type\":\"globalStats\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 83\r\nConnection: keep-alive\r\nServer: nginx/1.22.1\r\nDate: Sun, 01 Feb 2026 18:24:43 GMT\r\naccess-control-expose-headers: *\r\naccess-control-allow-origin: *\r\nvary: origin, access-control-request-method, access-control-request-headers\r\nX-Cache: Miss from cloudfront\r\nVia: 1.1 bb489e045ccdb24c55a720f2ea03e7f0.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: OSL50-P3\r\nX-Amz-Cf-Id: zzkdlHhFKaGLaHKIhevvCW3SBdDIJ-ZnJUqDPYmFZEt-IbPpX7A7uQ==\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":83,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"da0677ceb50785540eda5c70b9d7e597","sha1":"1584c6ffba9c010c67f97f67df0deb1e8c24c88d","sha256":"1d85867cbc611a6ae7ab002b4e7de775cac3cbbb95b9c6b44ac4d0fd9e9444a2","sha512":"77fd0bbf3616bf59500eef0543cacf81313dd280c85aae51dae9424f6aee47ac16f95a04ef52fae49317ec2a5fe86d4a0bec5589218241ffd17fbadc9c380a86","ssdeep":"","tlshash":"e5a0220802f232c0ccb8e30000ca22e0c2ff03c3e0ecc28c230b2cfe808082a308202b","first_seen":"2026-02-01T18:25:13.910031Z","last_seen":"2026-02-01T18:25:13.910031Z","times_seen":1,"resource_available":false,"data":null}},"time_used":787,"timings":{"blocked":-1,"dns":55,"connect":4,"send":0,"wait":254,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T18:24:41.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:41 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xyljl%2FkyWgCfuoxIEvOW96EKH%2F6f8VeksgZbzDSzIm9zpSJTxavMK9KW%2BNGdbeOb43VG5cnhftts9JSMMy3%2F2j3O8ftsjt2OeqYQl%2FLITAB0pozU\"}]}\r\nage: 564\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c737cb3c8a2b515-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2155,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"20c4c448ca03de9139bd34fbaf41da34","sha1":"a31853f73cf4366bee2ce8ea5d71aca584e76977","sha256":"1c3fd57e25e95f68da10ad344b2860ce8537d22ac5280f5cf8d6405bebb9e40e","sha512":"6f94decb27c2691c1955573090f6c7f776c2c8074dc247ce37a77160fd16c378ccaa83e1905ca940a1afc04a93c5a1743d110088ac9c46c9cbe8f1edcf399ed7","ssdeep":"","tlshash":"014113639a319c0d62348958df46b004cd69ace6cd656d40a0c8edebcbd1fd4c273677","first_seen":"2026-01-13T14:56:05.376716Z","last_seen":"2026-03-18T14:18:00.99977Z","times_seen":35,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":28,"dns":6,"connect":1,"send":0,"wait":15,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/screenshot2.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/screenshot2.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 155629\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"25fed-19c09f3e1d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1PKFYlUuNRzGLpL8GFMPq9RC0VDlqxeUHDHEtUJuoejtwgLCgTDioXhK6%2FUSkQ6nTYFbv0Kx7Xk%2BfSPDk7GKm2G1OE6u202gPA9VNb47Jo4TUu01\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf86fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2879 x 1464, 8-bit colormap, non-interlaced","md5":"58c1a83c57b1bfee45658469ee5f6e1d","sha1":"0a4ca1dcdf9a9384ab709db94190bc6595a5d5da","sha256":"109b5c7a7680201d38c08d23b63e80bb6afd451e7b38d70839821bf3101faee0","sha512":"00ed75731c42ef6f9a1b0fd863853e1db6a80558630774adcf317c478f4a6b5c4b7ebc9cf282eb6144da0d00459646c52af7e86f82f10758b29df14b219f1918","ssdeep":"3072:slFYnKZEca1YKjldd0CZZFO9QgCkKoDUSgpSL5x3blZQW77y/JALXg3vrCSx3jyO:oF0UX6jG2m9QwDUJpStxL97iSLw3vOSN","tlshash":"1de312f195a62590cf1f0f7bb588991e0b2a9ce5c5128e7f97188e26275c14eb34f313","first_seen":"2025-11-26T00:18:39.173626Z","last_seen":"2026-03-18T14:18:00.984723Z","times_seen":55,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":90,"dns":0,"connect":0,"send":0,"wait":21,"receive":123,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 28 Jan 2026 23:23:17 GMT\r\nexpires: Thu, 28 Jan 2027 23:23:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327686\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-07-23T22:41:00.148633Z","times_seen":542080,"resource_available":false,"data":null}},"time_used":749,"timings":{"blocked":365,"dns":10,"connect":30,"send":0,"wait":8,"receive":8,"ssl":321},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/telegram.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/telegram.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/widget2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 780\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"30c-19c09f3e150\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g9kWWgroXlAqf%2FUWBEhOiVOgKW710dOsMzH1Y5s4ZyEbEDnSoN1au3mO37%2FbEtZnyApJUQaZf4MblIt7kDXQdRk5h55BkatqCOdxJSEJkMRypYJE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbed96eb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":780,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit colormap, non-interlaced","md5":"54206d2b6e21595393eb1a1a95129305","sha1":"989c819a58b5d5addbf7335633ed8394b3cbdf91","sha256":"ec19cbf91e65101ba4d0cb5d2eb9714249ee3e94b570ff330058d9294daede87","sha512":"aa410da73e0c6db91306d106439adc32364f0388762346bbe7ce6633f4edbefa4c8db32e59ece815db5bb6af9b6ca857772c2b7261d25a20b5a1bbfec87a7f39","ssdeep":"","tlshash":"8101205edea8ce3adc58e0f9572620829712cb382bf560c849fcc6058cb320ff0d2615","first_seen":"2025-11-26T00:18:39.091838Z","last_seen":"2026-03-18T14:18:00.992684Z","times_seen":56,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/fr.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /fr.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sHP684GTU1%2FFdX5nuO8OEaN3FjZV4f3pzNaJ9BRRahZHNZ0AzaYV4BxzCerAeaY800chOo%2BaDREwk%2BKE6X01ZHJahiBZhm0PTA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 237644\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"6864014e-bf\"\r\ncontent-encoding: br\r\ncf-ray: 9c737cbf58e056c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":191,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"348ad62f3469cdf68fae460f38fbb05a","sha1":"1b0035428d1028228af43f32edbcce344df05dcd","sha256":"09645c97a47436337d63cd54625200542c65e0e1c83b774a58c9d28d0555b0e7","sha512":"2b9ba447cbbb910f7d31a55ef6a2ece913fd53c9429913a451c7946ae2088d7135b583eebc2fb6006c4c9b96bc67f88479d270d580edbe81252acca34fd002d7","ssdeep":"","tlshash":"4ec012de90ac2348c91883b95bec31e20182308fa15d02cef0842860e20178bbc9ab69","first_seen":"2025-07-01T18:36:10.396471Z","last_seen":"2026-07-22T15:44:30.10576Z","times_seen":706,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":71,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/onest/v9/gNMZW3F-SZuj7zOT0IfSjTS16cPhxx-ptRtN.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/onest/v9/gNMZW3F-SZuj7zOT0IfSjTS16cPhxx-ptRtN.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14660\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 31 Jan 2026 18:36:08 GMT\r\nexpires: Sun, 31 Jan 2027 18:36:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 85715\r\nlast-modified: Tue, 09 Sep 2025 18:53:43 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14660,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14660, version 1.0","md5":"8856bcf43a6e084bc3e1957d7837c0fb","sha1":"ef1886481636ef5e963ddc8cbf8b47d2f0718fb2","sha256":"7c1e312df6aa912caf5feeb738623cf42b48f330f6d22608a5d6185648d5eba0","sha512":"96a01e2d60129e3fccee9da8854a19b1c8f3a995dc524135891aeedfb47bcc762ec19a6b5b06d11f3f00725e178b2c875f33e49b2d7a8a161404b1d97c4eb580","ssdeep":"384:GT+rbS0lfisJdXVX8qt9YJkjCISep8LgYnu:Vm0laQdFsqtmJkOjep8UL","tlshash":"ad62d050aba01d0fe9f310b5e53a57821a7bec851a055a1d2f7b2cdf1306358cdb6b1b","first_seen":"2025-08-16T20:35:30.701889Z","last_seen":"2026-07-21T03:38:27.964595Z","times_seen":77,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/eyes.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/eyes.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"6a9-19c09f3e16c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QwYq04uou%2BrxOyNyfewvmXWnvsmsumfRJ%2FtekRnBUQlPTOw%2FKB%2F6w17vlDX6BNy4QE5mX5Tg8tME4uos4QZ37Y%2B7Xjj51DlIBVBdr3UNC%2BczPY3i\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf867b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":1705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23531ca79c9f5dc2be0b39b28aa7524c","sha1":"fbc92b54469e04184464faa2d50c5872da5277dc","sha256":"6d76143b39d23013125c7baf0108a0e80eea7f497e91682f8df1bebd702e7482","sha512":"1b8857d1cb472b308344d22485c476c00fe73bb25fce81a8fd49f713bb9b0259b864b9acb8a9a4b75894a8b4b8638e2dd763e63f21b6382984d99b550fafcdc8","ssdeep":"","tlshash":"e931f28d2b4c51f5e16082d6db098228b84770fe5140db7dc35a3d35999bbdd6c2b885","first_seen":"2025-05-13T10:27:03.894079Z","last_seen":"2026-07-21T14:05:53.701352Z","times_seen":95,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":89,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/arrows.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/arrows.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"97c-19c09f3e154\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OLnnd7VM7VnOsMoASf6XYRCohdd8SRoQf0DV9H8qohx8nSr3RSQ9fh5A3VzjqbVi55ddDWxeQkqch%2Bjt%2BqGxOP51AWdjAB%2BpE%2Fp2MWgZIqnK7amg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf865b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2428,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e0fe79e7e45e6ab72a200058537aab61","sha1":"6dd6cc2d67a439869cdb2c3138a918eab97a5dc5","sha256":"a0105ec6578596bd1360cdbef110a620ec095e9463f05ece85ccb8a6c0722586","sha512":"56b34dde1ef8d53315491d35d11bc31d57a5a10a02d37bd5ace85dba47d819b1241682411c972ecd59de199299b1300e583dccc2d707894f242f5ffb1008648b","ssdeep":"","tlshash":"f84150cc33be35f8e846e0b5c711a41c669f24fe25018eeac346081d9a99c946c1ace7","first_seen":"2024-12-24T09:00:30.365488Z","last_seen":"2026-07-21T14:05:53.743887Z","times_seen":96,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":87,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/mask.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/mask.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"6f4-19c09f3e1a8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P6m4z5JlX5igwvqxjFi4VC5sIkUWNEvtNO5snXmIWPD3LLtu%2BHwpBtC9GqqLer2wuXd1F8%2BNQR2MsbwUzmyE7MZWI%2FAI8taimraiJs9ZovfLLJ99\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf868b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3504907ee0bb6ebdef7910a493c04e89","sha1":"685a9a346db187a4cc7c141d864296ec81044249","sha256":"dd953536619c1bb33f3adaea7f919ad3a494751d89b816e452cb7a2a6c618d5c","sha512":"ad39b771d2a6d880c97e14945313cae877a0102094c620f9bc79678e56bfc0e6fa8ce0f9dbf2c8627ce5a871cd86cf8e769f9bfb21e10aa1859c4c05d60fbf94","ssdeep":"","tlshash":"4e3173d81f67e2215188ca18b774248c8737b08b8b3382d0f64c1c5da66847e1b68eae","first_seen":"2025-05-13T10:27:03.905573Z","last_seen":"2026-07-21T14:05:53.699313Z","times_seen":90,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":80,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/landing_video_background.png","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/landing_video_background.png HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/png\r\ncontent-length: 664265\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"a22c9-19c09f3e17c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0iy1z48Q4lNnb0btq3K98e9TFRXEkXsGuU3m694Z9dnsK4D8P0WXeGx9SVUpm4XAY2m0zRpIX5qzcgbG%2FjJE1cjtLe71fOxwu8zb3fgl6FcNNXLq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf86ab4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":664265,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced","md5":"817f7b3f823e6b829936d143ec711377","sha1":"83a24f9993fe449abb5517758399897bd9765ba4","sha256":"3564ac6e86b7a2db3264a97093c4b7535c677821b02b6ebdf6e350a2d5660ed2","sha512":"ab287bb7ec71fa1bc0fc046ac7fba98ed31261879f13dd9d41f8c55de31431ecb050ec46a74bbc050b9ca31a1207d0d49873d62eac16ea8817ecebebcfc33803","ssdeep":"12288:PnBf0slBwZfk0xpty9KCqX1j1RWiG+y2Rlvv/POIdFMIFsISWczn2JXT9o8YWK:Pnq4BYrnLCIDNvykl+IdFMIFtvc0xo8C","tlshash":"87e423538d1f8e479883359c621d9353001d99ea09af3b5a65ec98e5d07b8233f9f82d","first_seen":"2025-11-26T00:18:39.184387Z","last_seen":"2026-03-18T14:18:00.975708Z","times_seen":56,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":79,"dns":0,"connect":0,"send":0,"wait":34,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-icons-png.freepik.com/512/9307/9307950.png","fqdn":"cdn-icons-png.freepik.com","domain":"freepik.com","tld":"com"},"ip":{"addr":"23.36.77.72","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.freepik.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 02:22:50 GMT","end":"Thu, 23 Apr 2026 02:22:49 GMT"},"fingerprint":{"sha1":"C0:B4:F8:4D:39:27:04:41:5C:4B:20:FE:12:17:4C:7A:A9:B9:0C:0F","sha256":"D7:24:91:56:CA:B1:9F:78:CC:A1:96:07:EA:A0:CB:AA:73:D5:06:11:4C:6B:0C:75:21:48:D3:CD:A2:38:40:B6"}}},"request":{"raw":"GET /512/9307/9307950.png HTTP/1.1\r\nHost: cdn-icons-png.freepik.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 17878\r\netag: \"159520e52bc2f48f276ebb680e3195cc\"\r\nlast-modified: Tue, 15 Apr 2025 23:34:27 GMT\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\nalt-svc: h3=\":443\"; ma=93600,h3-29=\":443\"; ma=93600\r\nserver-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc=\"1769970283910_388255044_381986381_598_1165_0_19_22\";dur=1\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\npragma: public\r\ncache-control: public, max-age=31536000\r\nx-default-rule: YES\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":17878,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"159520e52bc2f48f276ebb680e3195cc","sha1":"30c051c13eb32cf44530f2c70426beba4a95a129","sha256":"d65b21f9cfaf0414936f4472547830608c5635e1a01434cccc2f7dd68d7ebfdc","sha512":"e508d05a69f4a231ca1fc372e087d044328e139c4cb8f1cdd59562b58053f4ee0e5cb5cfa4901f354b59644e150fe79b1019b3d9c16648bbc70b3a51a6d623cc","ssdeep":"384:hTOwmab+6HcvbDX5eQOLdh+gYMZyaZkKMmpqlxH9cv7rQ6k1ucqKGZgh+N4tw:Tb+swb1RO5h+gYMZyaZkNmmaHQ6k1BJW","tlshash":"e382c01d63eb09dacdecf170028d84fcb9b8417017e64555eaf469891e30e2e7b5e887","first_seen":"2025-11-26T00:18:39.099009Z","last_seen":"2026-03-18T14:18:00.995204Z","times_seen":56,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":51,"dns":33,"connect":1,"send":0,"wait":10,"receive":1,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/analytics_events","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:44.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"POST /api/v1/analytics_events HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hyperliquid-detect.xyz/\r\ncontent-type: application/json\r\nprivy-app-id: clmv1d6am07asib0fs4ss7w2x\r\nprivy-ca-id: 152afc78-2f7f-4819-accd-a6dca3e1bfd4\r\nprivy-client: react-auth:1.79.1\r\nContent-Length: 286\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=6VvEQuytapLkg83vyZjAGwpPUIMQcTrd_n9eVLcRndI-1769970283-1.0.1.1-ANVj6Euooyl526D2ILyawM03EGSbgrBg9qVfUzMngf8guTH4XK1MpEsyFXRy0gzpeR_kkYh4mIrffRRA2QZA90Y962RexMafFOYK0gKxi6o; _cfuvid=xDiR8kyaLDRwlxK1_7JIKGnu4ZEUJ1N6rpz9ISprwmU-1769970283232-0.0.1.1-604800000\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":286,"data":"{\"event_name\":\"sdk_initialize\",\"client_id\":\"152afc78-2f7f-4819-accd-a6dca3e1bfd4\",\"payload\":{\"loginMethods\":[\"email\"],\"embeddedWallets\":{\"createOnLogin\":\"all-users\",\"noPromptOnSignature\":true},\"supportedChains\":[42161],\"defaultChain\":42161,\"clientTimestamp\":\"2026-02-01T18:24:43.562Z\"}}"}},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Sun, 01 Feb 2026 18:24:44 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: gzip\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://hyperliquid-detect.xyz\r\ncache-control: public, max-age=0, must-revalidate\r\netag: W/\"105rjpkrbkr1i\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/analytics_events\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::2q9hc-1769970284045-6a862ab125d5\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9c737cc31e064e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef61636d36a48f545e4a2ce75b5febcf","sha1":"efeee36fd1d8d99eb9a968ca0cb9d79e3b6d0e51","sha256":"ed76277a4374e438733db8fa1addecea3e48d3406f4ff32c1ea0066268ab6ba6","sha512":"e7fb19b5c564001e80690769e8cf9a33302daf54f2e51dde0c0da947400b0e648cc594157ae5b79dcb4c55ecb998d3fcb7e5f05372ce7c093992da5d1a02aa04","ssdeep":"","tlshash":"4a90022d2356842a6a9707d41e4a4c0264e5316069629b901c1101bc03c57654e0200c","first_seen":"2025-05-24T18:07:58.401304Z","last_seen":"2026-07-23T17:58:51.447577Z","times_seen":1265,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/static/css/main.215ebfc6.css","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:41.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /static/css/main.215ebfc6.css HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:41 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:44 GMT\r\netag: W/\"b80-19c09f3e298\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 563\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u0uAedvhE24XDMbNBXV0FSrnY9U8eq0z9dTHfXL0TXvrcTepQNdkZEBTFyFwupPWPBP5pB0oaJD7%2BQMoAoPzN49b2v%2B0JUYFyIAdXG8vAcSvjeLMDVE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cb4ffa0783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2944,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (2944), with no line terminators","md5":"04a6031e9fca9384a65178866fb4e26e","sha1":"3314b181e49b2c04899c991ad02488c3f377c253","sha256":"6b90434a75d9ad370e21784cd06ae519d58d828214564b4f9e9c6573b9742a6e","sha512":"2f4f361bbcd2330932bd3db346950804ff191d265b0cc6f817151d5af208c2c9d3b253cbe35b2c67b1b97b8a7e73fc7d31db0cb3e26181a1c8edc74aaa813ac4","ssdeep":"","tlshash":"5351ef104026164ee0a3be5236ce6f131d3a285515e91a03ff1d9e658eebc7773a1f2d","first_seen":"2025-11-26T00:18:39.190397Z","last_seen":"2026-03-18T14:18:00.977504Z","times_seen":56,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/images/logo-privy.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /images/logo-privy.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1cdd-19c09f3e150\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F%2Fw7hSUuzAUXBq3jF3FPAx1N74SZAsObfDClzDrTLiBgaBx8pHbwzO8TPr1wnEWTXNhspOgyL%2FhnF7iCyWuPxVn0cXLag5qmzzqgQTRjy4Zkb6RAzRw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbaea2b783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"766f2387956b714ed1187970e6e993a9","sha1":"e84d850478d7cf66241b7789eb6361e79cf25a71","sha256":"639d8879178dcef27c985ebc8a8682fd45fe70642948aad298a3f827d0f3119d","sha512":"b0542709b9c518694be9b86d3cb2473d73595ade80ca898c62f6c39c201cd148fcad56b9e1ea6c43bb5252e2a8fcace1e5f385531b2a880c4ca3bbf98a92caa6","ssdeep":"192:niL+w9lkDvs9r5VoGGckX7NoBpJKPPzruVvx17avPz:niL+KlkDmYL6BpYnzq/Vaz","tlshash":"6ae1d6fa35a453e8c502e3f1ee17b4696e6f28fa3bc042a6c360ed9567250798d4ccc0","first_seen":"2024-12-21T19:32:48.64242Z","last_seen":"2026-07-21T14:05:53.771405Z","times_seen":328,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth.privy.io/api/v1/apps/clmv1d6am07asib0fs4ss7w2x","fqdn":"auth.privy.io","domain":"privy.io","tld":"io"},"ip":{"addr":"104.18.20.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Dec 2025 13:40:06 GMT","end":"Wed, 25 Mar 2026 14:39:57 GMT"},"fingerprint":{"sha1":"54:51:4B:32:12:56:E7:8E:F2:BF:E7:B7:02:86:46:96:C6:54:3B:06","sha256":"89:90:0C:B3:60:64:3D:02:53:1A:F8:C8:FE:21:37:DA:D9:35:7C:B0:CD:1D:38:EB:B6:88:E7:E6:72:F2:44:64"}}},"request":{"raw":"OPTIONS /api/v1/apps/clmv1d6am07asib0fs4ss7w2x HTTP/1.1\r\nHost: auth.privy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: privy-app-id,privy-ca-id,privy-client\r\nReferer: https://hyperliquid-detect.xyz/\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncf-ray: 9c737cbbbd87568e-OSL\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: privy-app-id,privy-ca-id,privy-client\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://hyperliquid-detect.xyz\r\naccess-control-max-age: 300\r\ncache-control: public, max-age=0, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=63072000\r\nvary: Origin, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-matched-path: /api/v1/apps/[app_id]\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::nxlnd-1769970282857-f9df724de98f\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=Pk0q9xHMVM2.1tD9ZcsIKl.PsuTsUTdkm18yXdKqCCM-1769970282-1.0.1.1-1gYqkcAU0xtVXT_ZgBM.caaN8itbcaHdhjWLVyQH.JgQonZGCmECOLDxzxWfHcwQD4wcfvgch1M_5vwDt7KCS9u0S9_ejfTgwAJIlUVwS9g; path=/; expires=Sun, 01-Feb-26 18:54:42 GMT; domain=.privy.io; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":71,"dns":18,"connect":3,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/eyes.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/eyes.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"6a9-19c09f3e16c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iN7BxcttqTllbNbOReyHCm%2Bc5jT6u1%2F08YH1PAbkJkhaV1O8ueCq6shMI%2Be2EB6hh3Ju584ywsLQANer7UPxbSc%2BqUSttm6%2BHyYGYP6NP%2BzjQZeH4rA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbcc936783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":1705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23531ca79c9f5dc2be0b39b28aa7524c","sha1":"fbc92b54469e04184464faa2d50c5872da5277dc","sha256":"6d76143b39d23013125c7baf0108a0e80eea7f497e91682f8df1bebd702e7482","sha512":"1b8857d1cb472b308344d22485c476c00fe73bb25fce81a8fd49f713bb9b0259b864b9acb8a9a4b75894a8b4b8638e2dd763e63f21b6382984d99b550fafcdc8","ssdeep":"","tlshash":"e931f28d2b4c51f5e16082d6db098228b84770fe5140db7dc35a3d35999bbdd6c2b885","first_seen":"2025-05-13T10:27:03.894079Z","last_seen":"2026-07-21T14:05:53.701352Z","times_seen":95,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/s/59278/SFPRODISPLAYBOLD.woff","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /s/59278/SFPRODISPLAYBOLD.woff HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.cdnfonts.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: font/woff\r\ncontent-length: 134076\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 05 Feb 2022 02:00:54 GMT\r\netag: \"20bbc-5d73bbcd13297\"\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 563\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d64UGDJP%2Bh%2BD3BcHjfNgLVPiy7UNYzZXkaXT%2BWceUqPGY96s3IfhB0edmSqF%2Bk6R7Xc4CGrEkMzIKqpJneuTqf9aoT41ol9UT0eYBoIUm836Hg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c737cbda8f8723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134076,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 134076, version 0.0","md5":"5a6d43d393aff666df0d0b67cbb32c68","sha1":"2bdae4ec52f592b8a9b0786dd53d7efb4f2f5fcb","sha256":"119ccd3741e1185ef0ae63c54b4bcdc65ee0ce4336f1558928707d85b91fbe11","sha512":"2d517324f864d417f62fc74a7aafd0f54c322a23aa7b87d21bb24881a216c5d66c2b76f279800768e051e96c2a6a5b0cb2cc5960f5bb953077b6454c1bc9c763","ssdeep":"3072:PJJ0ljobe01p2YK8TXKSOdXSyEaW1vp3mPxIQuYJ5ORrb6KJ57PCLhqq:Ukee2YKhS3XB2xIQuDxb6C7Pxq","tlshash":"18d3139db96edbdb2da3ed8c10a5efb205dca6c741d178039a81dc67080f796537640c","first_seen":"2023-06-17T15:43:01Z","last_seen":"2026-07-15T11:01:05.639951Z","times_seen":244,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":7,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.cdnfonts.com/css/sf-pro-display","fqdn":"fonts.cdnfonts.com","domain":"cdnfonts.com","tld":"com"},"ip":{"addr":"172.67.184.158","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 10:30:43 GMT","end":"Sun, 05 Apr 2026 11:28:02 GMT"},"fingerprint":{"sha1":"19:1C:B1:F3:D2:08:65:B6:9A:C1:B4:79:D3:ED:56:0D:86:BE:C1:C5","sha256":"D5:42:A7:E8:38:8B:14:DE:00:B4:7F:DE:0D:40:F9:71:1D:5A:5E:5F:69:37:DF:9D:89:C2:31:AD:C5:EA:46:22"}}},"request":{"raw":"GET /css/sf-pro-display HTTP/1.1\r\nHost: fonts.cdnfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1173619\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nlast-modified: Mon, 19 Jan 2026 04:24:23 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pm8lz9SskvLWFfmCXTp1byQpuEEu%2FLtd4C5SOIAr9%2BmcM4Q7xrnb5QmxfYg1S7NjBKvIFRsUod8wtxy5b8BDvIURdOBb9bOdbt1Vh7Sw8aE%3D\"}]}\r\ncf-ray: 9c737cbae86d0b31-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1946,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"751bddbee1b2ea1581dab2baeb2c29f0","sha1":"4d84900f4e08c54f32002a71c21ec94a97a7363b","sha256":"5ac7863e22f33bbf9c3186e919b9c227021236915dd0317d9f4851a63644c09c","sha512":"59fc2944e75419d45a57d1713dd8499dc21f14dc4d0bf22d10b3b53f558b1f589e1aa541635640c751bce43f1e1cf33d6441603fef11e56278287b0bce84ff1c","ssdeep":"","tlshash":"2041a971089ba54866312dcf779f3f1a5e0b500b3189da143ef93d089ee3d2a9281f2c","first_seen":"2024-12-02T22:38:00.917644Z","last_seen":"2026-07-21T15:12:09.729724Z","times_seen":1139,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":42,"dns":20,"connect":1,"send":0,"wait":7,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 32108\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 26 Jan 2026 21:12:48 GMT\r\nexpires: Tue, 26 Jan 2027 21:12:48 GMT\r\ncache-control: public, max-age=31536000\r\nage: 508315\r\nlast-modified: Thu, 04 Sep 2025 17:18:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32108,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32108, version 1.0","md5":"e414fe5664f376c8f145acd792939183","sha1":"5b69d46adc3a06af762193adb2dddbc359b2e786","sha256":"fa31c7981483e52cbb8b8bc1eb0dc6326f160b8699cc0899349f977f0517a9df","sha512":"51c251910e5cce616b3c336bcb63853f83c306e16e9b79e0a18f924a738ba06b3e2cb8132ff9bc6e720527234eb80e90be2625b860e1728b66d4fe86ac9bafe5","ssdeep":"768:gUX6jLkDeuAkZHs27nAflEFIapAgCauwIFPo3zjERcgmcjz:3X6tkpNAf6FIapAgCaMFozInjz","tlshash":"6ee2e14f8beb009ef3828a7812c46b3195b305d569cbfa901eef85d76b5c247c1474a8","first_seen":"2025-09-05T02:25:45.343777Z","last_seen":"2026-07-23T22:39:34.359486Z","times_seen":27180,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/widget2.html","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:42.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /widget2.html HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:42 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 563\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T315dOVYqa1qytystOuDHtNoaYsgJfTo0C2thqjDP4kg6uj2fHOeTUUTKhKl6Un5ubzqcBtxIQSl6r11QFgDH8PP6R6Ug6ZQCOxgQ4tMR%2BcbOVpQO80%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9c737cba689e783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41614,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16745), with CRLF line terminators","md5":"53a0fb9dbfa19a09dc90a5f5f018a257","sha1":"0959016823e9d3f470a67dadd3e6c20a52be30e4","sha256":"a8d9215b15cb16d1c62f008035caf47079245fe303af49fd0279fb5a48d42a0a","sha512":"7963e1bc56f5b2102348528568d2cd4bf75cccec6b66b7dbfb75ecc19133a622e6591c3e5e2c78858289aae1745075b6838b570baf4c6d188952df22bba7abd0","ssdeep":"768:ckpoMyPPwy/9OWMr9S6OfatGteqZsbok0Hs8qGIs37rhwuTRSB18//kDOc6o:Vpoxnwy/9OWMr9S6OfatGteqQI337rhq","tlshash":"7313dfa1419a303ef02286d5f2917f2961b95006ec3240acf3add54f9fd5865e8fbe6c","first_seen":"2025-11-26T00:18:39.076218Z","last_seen":"2026-03-18T14:18:00.981346Z","times_seen":56,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/landing/verticals.svg","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /landing/verticals.svg HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:43 GMT\r\netag: W/\"1bc-19c09f3e1d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XWxROraw3LEOGgowhoyZZE2rAdVTQ4xQ4RXLivU1sd%2FsdphNAeaLsdK7TaqS3IzLgOymYoDci4%2FaOYt0in58VmQ9vb9jwsklIh2WFFyan9XXSpmm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c737cbdf87fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":444,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"40dc2001fe15e9892a0bd64a23f05b13","sha1":"81e5cd3fd27627c1ec77b0be1ab9c4ddbdeab82a","sha256":"8c8b0e080085c730b650a0cba679c7632b9770785db02c408f887ba26ed80b95","sha512":"ada37c0f7e168bbb4806a04ab577bc467badc82ad5fd55034394974906d4f2fcc9bf5d6f14122a7dfebc84bac949e3a90980e23022d51e145f17ac28829566ae","ssdeep":"","tlshash":"4df0a0ad272819f4e3d24321af3961ae4d6760e8068552888d0236363691b6e2c7ffd9","first_seen":"2025-05-13T10:27:03.876646Z","last_seen":"2026-07-21T14:05:53.753269Z","times_seen":85,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":77,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hyperliquid-detect.xyz/static/media/inter-cyrillic-400-normal.cb04b2ee2f7d192478b8.woff2","fqdn":"hyperliquid-detect.xyz","domain":"hyperliquid-detect.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hyperliquid-detect.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 29 Jan 2026 13:11:32 GMT","end":"Wed, 29 Apr 2026 14:07:58 GMT"},"fingerprint":{"sha1":"1A:DD:5B:48:B1:D6:02:76:A5:CF:30:69:3C:32:8B:B2:D4:7C:00:41","sha256":"19:AB:5D:10:1D:33:83:75:67:AF:92:45:F1:D1:A1:0B:AB:A4:8F:11:64:7F:75:E4:ED:0F:38:FF:7B:49:4C:D9"}}},"request":{"raw":"GET /static/media/inter-cyrillic-400-normal.cb04b2ee2f7d192478b8.woff2 HTTP/1.1\r\nHost: hyperliquid-detect.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/static/css/main.215ebfc6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 7712\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Thu, 29 Jan 2026 13:31:44 GMT\r\netag: W/\"1e20-19c09f3e2d0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 563\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x0Pmcnn%2FqbKjQtygbMK%2BZFR3H2y8lW5dwy0qWcZEHhPyv8QTz8I%2BQtl8AliTzWwj8mSOxUGvFMPInj81BcKnDzBWw5G0CigDoptmTMiIDQJc2nxk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c737cbdf85fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7712,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7712, version 1.0","md5":"5343aec6e59f4cb940ba242550ed0ca3","sha1":"f18f7b4fe7afbc2264922521e85abe0181933fd5","sha256":"636d13aab05ed9fa49df19c57fdddbb6f3d084f463743ee5257549dbb7124005","sha512":"6faf32a0d55dff2f9b36e839b17ad776c6fccd14b8c363baa2c6b25f8ef6d7e01ba735b3889527b64defab4b797c972f94286313d5097a58156fc86f12bb8389","ssdeep":"192:qRc0das8PDGXX4D+MpC/plzZSUBWYHuCKCRXP8C69g:HMas8PDGXX4k9lRH4j9g","tlshash":"e2f19fb0a1312604cdcd3fbdeff29c0d585a226603ebcab5764b6c8df75311d9899226","first_seen":"2024-10-11T08:42:10.141147Z","last_seen":"2026-06-29T19:38:18.241637Z","times_seen":113,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":73,"dns":1,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"hyperliquid-detect.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hyperliquid-detect.xyz/","date":"2026-02-01T18:24:43.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hyperliquid-detect.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 28 Jan 2026 23:23:17 GMT\r\nexpires: Thu, 28 Jan 2027 23:23:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327686\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-07-23T22:41:00.148633Z","times_seen":542080,"resource_available":false,"data":null}},"time_used":381,"timings":{"blocked":183,"dns":9,"connect":30,"send":0,"wait":9,"receive":8,"ssl":137},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/ca.svg","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hyperliquid-detect.xyz/widget2.html","date":"2026-02-01T18:24:43.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 04 Dec 2025 23:42:20 GMT","end":"Thu, 05 Mar 2026 00:39:56 GMT"},"fingerprint":{"sha1":"FA:8F:8E:ED:0F:0C:77:1C:66:65:19:4A:E0:5A:9C:00:32:0A:9D:BA","sha256":"62:17:A8:B5:E3:C1:4D:30:E0:1A:C1:F4:98:AF:A1:DB:5B:79:AF:D0:41:B1:AC:A9:12:1B:87:F2:50:2A:05:1B"}}},"request":{"raw":"GET /ca.svg HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hyperliquid-detect.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:24:43 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\nvary: Accept-Encoding\r\netag: \"6864014e-292\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\ncontent-encoding: gzip\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 2047876\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3jS0ACnf0aPj2YRkntRIj0HDgWvqIBk9x%2Fb2C%2B4nZirobVLRLj1ji%2FxUZinrKTTz4eWosXz2Qt8fgXCc6SFEV%2FOSFKwPfnfbSg%3D%3D\"}]}\r\ncf-ray: 9c737cbf58e556c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":658,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"204a7f283c881dceea9b4f4ac6c97a99","sha1":"e80ce7344e5cecc84a97ef13fc06dd499de7163d","sha256":"3cd6c2b9fe12bc0617ef4374b570ad87920bae757a95b104384fc301352c6942","sha512":"02093e6e91e510996813a028c0a3dbef38d1c5f3cbf86412b45f0a319fe4726fe25d22f92c758133a9da522912bfd9f5f679228ebd16fc63adf11538a60ed46c","ssdeep":"","tlshash":"5a01dd308d2cb88c3a432bad103815b203bf9063b30942e8e12f31f933db123e88b500","first_seen":"2023-09-16T18:44:36Z","last_seen":"2026-07-20T13:30:45.781385Z","times_seen":301,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":73,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}