{"report_id":"831581b7-cd9a-400a-9a4b-da714619a121","version":6,"status":"done","tags":[],"date":"2026-03-22T15:54:50Z","url":{"schema":"https","addr":"ledger.onlines.click","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":0,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"ledger.onlines.click/","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"title":"Ledger Chain","dom":{"size":29409,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (14779)","md5":"cf50483bccf9a710777fcfdfa96cc948","sha1":"08bd2689ce40aa69a88df3ab657bfd6638a1ff72","sha256":"b4274478deea91bfbb8b00620ea8fc3763fe57c1afc2c06f69c7815231335ba0","sha512":"9a0fcb2fe51bd8ba782c66b0d6fbfdeb76f63690253dcd01391630c8723efa40fee0617dd14bae0b36e2be32b77cfb418f6145783fcce8390547118fdf3f03fd","ssdeep":"768:SjNMsnB7cxksc64Jysq7vvpEUrLbmd//ycyQTso:SjeXx/c64Jysq7vCUrA//Pl","tlshash":"54d2d710b00c027c9d6f5799eed5a37c913af146dea31425a24d0099dbc3fe629eef94","dom_hash":"domhash30caa9442dd66a94238a0375c51fe09b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ledger.onlines.click","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":0,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-26T15:54:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"assets.chaport.com","ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-07-07","domain_rank":504466,"first_seen":"2024-01-31T17:02:32Z","last_seen":"2026-03-17T16:27:37.844483Z","alert_count":0,"request_count":5,"received_data":640916,"sent_data":2365,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ledger.onlines.click","ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2026-03-18","domain_rank":0,"first_seen":"2026-03-22T15:54:52.056976Z","last_seen":"2026-03-22T15:54:52.056976Z","alert_count":6,"request_count":6,"received_data":706916,"sent_data":3898,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"app.chaport.com","ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-07-07","domain_rank":87646,"first_seen":"2015-08-24T06:07:03Z","last_seen":"2026-03-21T09:07:01.468624Z","alert_count":0,"request_count":6,"received_data":8893,"sent_data":3090,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"app.chaport.com/javascripts/insert.js","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"29d2e99d5fcb02404184a538c82b6254","sha1":"ef4318b50add95249beac94e8433544a180f3960","sha256":"27b579092e300cf8d2457274b442dc87db8a173d97c72e19b41ba1d90c613c31","sha512":"76aa1c05f8bd676ec62cdd147fddd7c472b5e8241806ce2a4b0e6d72590237969e3652c442ec06fa7fd84be60c1a0f41d7167f37a1bf8cefaecbf23f89feadb6","ssdeep":"","tlshash":"5211be11a565905b0db92176bb2b730eb4bff7168a4c9a44291df6003b038d3a826cf9","size":998,"data":"","first_seen":"2025-03-16T17:07:37.611527Z","last_seen":"2026-07-24T05:30:09.045686Z","times_seen":1706,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/info/widget-assets?jsonpCallback=true\u0026id=69c008124b3dbd326546ffea","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b10b6e87a4930d70ee5c81bb23c0a6c9","sha1":"787dd052dd2b531ddc0b1575c427dcaadec69b30","sha256":"02094c52d679e5961853dc2b643d644db8434e0134bd07d779952edeebee8719","sha512":"8def9ad9080b847f2bb842279231fac877b8c92df6dc965e7977108709b82aa6a0539c7dea98405aef7d1b0544156ceab1e3cbcabb220a0b5b286df0d2f022cb","ssdeep":"","tlshash":"91e02b51da0a0b151b6027767e0b17c224ab87671e08d7a82575d6247115dc61024c79","size":383,"data":"","first_seen":"2026-03-22T15:54:56.467626Z","last_seen":"2026-03-22T15:56:11.316102Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/assets/insert-main-2c12d9cc3ded20e8cf09a901b86f5c68.js","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9b47be60a9205427afaa3db67511ed3a","sha1":"13aba22e343283634526ffa15ffb2ec1e770502b","sha256":"4b15578d1c420a58c1c41c4a88728a887af2540cedcd064f058f92b64299d677","sha512":"7493fe9f50f66a520da4224a3514ee9f8030fae1d79708d17be392c168604c530cf7551f4d8d56659e6d3d59844f053e5b48bfc788962e2f1babc627a54a9d77","ssdeep":"1536:a6VmkhM1hDaYGcvezlk5c6w8N6Od9T2KBjtrEjv4SpkHBKlqWfw2:ZQc4yk5HKp5ffL","tlshash":"898329897040343b0aeb21b6357f310a213fe2696e495460b53ad7d07e7ae5b621bf7c","size":83491,"data":"","first_seen":"2026-01-15T11:14:47.62677Z","last_seen":"2026-07-24T05:25:08.181402Z","times_seen":739,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/javascripts/audio-player.js","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"65cbf911501a0de13afb9d1cb71933cb","sha1":"e9236ab09f15becfa6d86aeb5995fc896f1aab1b","sha256":"e92027b36a47b6e3c2e1c084ac31e8e7e6a4b904bbaa42d241ccf7f4e48d7a62","sha512":"a619c7409dd01aa33de6a1eb397188a42da076126f727c119ed69455158ccff9421daec4d8135dfee4e719b1d62aa70bc767f4430238da97714805c43655cc35","ssdeep":"384:Brt6nqLIf40nECIgPG8OrYleIoARnq0KaHvWvqTGDBnLbcfSLcg:MwXkPGdg7HnqhSTGlnLbcqwg","tlshash":"70c22c48b7e17d54435a34b3223f4a063bb51652545a3240f016c2e9bf78e8b91beeed","size":27399,"data":"","first_seen":"2025-09-01T08:05:49.861005Z","last_seen":"2026-07-24T05:30:09.026609Z","times_seen":1373,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/~flock.js","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed557a78d5301fbb961abfe911a42b62","sha1":"d11a2a4e9fee28c4b1abc38cd8136bffec7e325b","sha256":"a86e084b4f82709814be6c15fd6305daa783fda87ad95402da9a4d3a1dd6d748","sha512":"18dd1525e2b4d89e3c46d92367fca020cf99fb07856acfd96a25dc7410611eea83b438c91691683983495945eb04a9427bc63e2a383cbe93449f4df0eb1ddb51","ssdeep":"384:FtUCBXTpeaFEo5TTThri1t/mCsOCXiTNZruJ4vKFlcEhRCDxOcX/YM2Vybyq/kmt:n7XTpeauI/Thri1CKWM4ldRzurwkTO0D","tlshash":"cea2b6d61007243d57ead1a13929f7d63177ea98a0caec8a7de91f84d414c83f3f294a","size":21296,"data":"","first_seen":"2025-07-30T15:25:28.733337Z","last_seen":"2026-07-24T08:04:30.30622Z","times_seen":14261,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/assets/index-CgKSV5eu.js","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ab0630fa07ce43e489c9159e683b998","sha1":"2748e488dba0a37831b0fe2e1542e987cce59bdd","sha256":"2fa5c5870dc2e5777998ef702456b062568dc91be2b7d09e214e9d73ef04f33d","sha512":"9d68c2bb6354b01873b61f6cba4102769201318104882047b11910b5b636f0b4746ef972ed57f84f1c061d1c909b3d48e88a5b9c61feab0372393bfbb1b6068f","ssdeep":"6144:FYdpYdFF/GsC7lviE9WRRAGySRAe5Gqzfa8dn+dB/r+5r4tUGx9eR0TV3FEiwLux:KwHMvTzGySRAenBdnABOdBexKJms/7m","tlshash":"26c47ec471a6b57a5ba345e1903f1103f13c2a15f81e8460f13c9dea6ba0906e67bff9","size":589357,"data":"","first_seen":"2026-03-22T15:54:56.450416Z","last_seen":"2026-03-22T15:56:11.327924Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ledger.onlines.click/assets/index-CgKSV5eu.js","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"GET /assets/index-CgKSV5eu.js HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: text/javascript\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"9ab0630fa07ce43e489c9159e683b998\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9e066011ea8f1525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":589357,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (37534)","md5":"9ab0630fa07ce43e489c9159e683b998","sha1":"2748e488dba0a37831b0fe2e1542e987cce59bdd","sha256":"2fa5c5870dc2e5777998ef702456b062568dc91be2b7d09e214e9d73ef04f33d","sha512":"9d68c2bb6354b01873b61f6cba4102769201318104882047b11910b5b636f0b4746ef972ed57f84f1c061d1c909b3d48e88a5b9c61feab0372393bfbb1b6068f","ssdeep":"6144:FYdpYdFF/GsC7lviE9WRRAGySRAe5Gqzfa8dn+dB/r+5r4tUGx9eR0TV3FEiwLux:KwHMvTzGySRAenBdnABOdBexKJms/7m","tlshash":"26c47ec471a6b57a5ba345e1903f1103f13c2a15f81e8460f13c9dea6ba0906e67bff9","first_seen":"2026-03-22T15:54:56.450416Z","last_seen":"2026-03-22T15:56:11.327924Z","times_seen":2,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/favicon.ico","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"7eabe612ad81babeb67cadc6451f2508\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9e0660151b7a1525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29243,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"7eabe612ad81babeb67cadc6451f2508","sha1":"a36283228c06f1ac96b4c1851962e60d16195f1d","sha256":"bc0a997aa8eb9b2287732deabefea2c37ef7b4e1fa91f4de0396b0153ca4ef1d","sha512":"b28c57b4c02c53fdb2121dfea0fa022d8b4f48ca3d04de3120b2ce43986bc1acd80c49e9bb903baa64244d2856580b082986b2ad271e0c5514df42ed3ca90d66","ssdeep":"768:uE9LZghNYVth9B22qzLzOpPu5LoChLoSORKTw1ezynSJJdOC:uwLZONYvh9B5Y5LFhL2B1ezbJ8C","tlshash":"33d2e1fa5144dbbde83ee2471584ec71416a0968a2bf47f021c4ac5c6ed6473b039eee","first_seen":"2026-03-22T15:54:56.4528Z","last_seen":"2026-03-22T15:56:11.303114Z","times_seen":2,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/api/public/v1/operators","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:42.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"OPTIONS /api/public/v1/operators HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: cp-app-id\r\nReferer: https://ledger.onlines.click/\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 22 Mar 2026 15:54:42 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: https://ledger.onlines.click\r\naccess-control-allow-headers: Content-Type, cp-app-id\r\naccess-control-allow-credentials: true\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vitPYGzT9yaQcBwK%2Bg6Bpw4mfUGZsRcRIPvdXskp%2BrAGTfp%2F3oPXx8AkvgfZy5V5EqO1LOjGWUb03agNXAWEl5oWVlXYCuFAv2B3H349\"}]}\r\ncf-ray: 9e066060cb98b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T07:50:59.280742Z","times_seen":17496376,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/api/public/v1/operators","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:42.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /api/public/v1/operators HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nCP-App-Id: 69c008124b3dbd326546ffea\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:42 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://ledger.onlines.click\r\naccess-control-allow-headers: Content-Type, cp-app-id\r\netag: W/\"12e-4ef557GZYxbknPNAtLkpRiQAJFw\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KKf7PfgGDTglkp7kmqaNl5woAJ3yWCaObU2yomYYG7kPfdrBSA0VoedwGqJ%2BlBNoZGDopD5sapQ%2FJS3Do%2FIJIsbsSuIO7dsqvGmS7onA\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9e0660610c4bb7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":302,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4b19b57fe6acde807ec4f81aa6df279c","sha1":"e1e7f9e7b1996316e49cf340b4b929462400245c","sha256":"2b95180e60f0dda95d0a66ba8aba20edb76860e20627b642ce3da4949f32b95b","sha512":"430556b10b8d18511a5583e8820130fd89122b92d23c3c62af069668b9ca0444da2935d846227daa5b0bb2f7fd650ef0aff4ca6724206f48e7dfda028615549d","ssdeep":"","tlshash":"6de0cd11f0a43435cd15694b5c067f854cb498bba6759fdcf01c851072525c09119533","first_seen":"2026-03-22T15:54:56.456204Z","last_seen":"2026-03-22T15:56:11.324803Z","times_seen":2,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/assets/index-BnsdN6wT.css","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"GET /assets/index-BnsdN6wT.css HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: text/css\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"7850d1afffab5cc0e5cb53aefadb2359\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9e066011ea971525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62962,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (62961)","md5":"7850d1afffab5cc0e5cb53aefadb2359","sha1":"5690828bfd7caccf032ed7df289db321ea33ee62","sha256":"2bf12362d02eb3abe7f6aec5fa529aea4240083e30904868c216fb6c3f910adf","sha512":"b5ab65ec4070b983f91dee9bcd50a2a95a978511c2e54f4bc28e59c451b963619dbb9feeb6a0aeee071b254d79cd079d5161f4a6dd9b5a9a9a896b1a96e82b0d","ssdeep":"1536:WhHqM+94uBrkT/RUwetG0Cr378VQZkt5FNCo7P:WhHqM+94okTZUwetG0Cr378VQZkt5Ffb","tlshash":"9453731ab91d617e3c2790e883ccb9ec610af0c0dd3b05b9be9a41316ad37f619b7558","first_seen":"2026-03-22T15:54:56.460301Z","last_seen":"2026-03-22T15:56:11.314283Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/api/public/v1/accounts/69c008124b3dbd326546ffea-92313ef372d7bce29bba128a41cc8a09563793a749b9d133091c42477a7c51de","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /api/public/v1/accounts/69c008124b3dbd326546ffea-92313ef372d7bce29bba128a41cc8a09563793a749b9d133091c42477a7c51de HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://ledger.onlines.click\r\naccess-control-allow-headers: Content-Type, cp-app-id\r\ncache-control: public, max-age=31536000, immutable, no-store\r\nvary: Origin, accept-encoding\r\netag: W/\"5aa-/AoLLI0VJKlB0mUsviTqL/E18VM\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FRUAOuxtjTnkeXId%2FqbKgC52Kv6gpqumX9by4qZlb1pa037TjV4zmd3jzjunZeU39EFIpMCBZZvTTJp%2BpckvAeFOgb2RQbQrgBhahFa%2B\"}]}\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9e066018dd21b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1450,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"28d6853c83d611def5956df342e9b018","sha1":"fc0a0b2c8d1524a941d2652cbe24ea2ff135f153","sha256":"92313ef372d7bce29bba128a41cc8a09563793a749b9d133091c42477a7c51de","sha512":"36e2e5c0d459ea1fa00f1ac7c9f4fb5a89de8d88841beef8519e65278a45819be04eb17065b6960f1d17e949d7cb102d2000df63d1f1af2498f93c6ba8164f5e","ssdeep":"","tlshash":"7b31023a245008bed6da530bf8933f434dbda0736a84591dd49c8a1cb2f75da261a907","first_seen":"2026-03-22T15:54:56.462947Z","last_seen":"2026-03-22T15:56:11.317716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/~flock.js","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"GET /~flock.js HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncache-control: max-age=1500\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9e066011eaac1525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21296,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21296), with no line terminators","md5":"ed557a78d5301fbb961abfe911a42b62","sha1":"d11a2a4e9fee28c4b1abc38cd8136bffec7e325b","sha256":"a86e084b4f82709814be6c15fd6305daa783fda87ad95402da9a4d3a1dd6d748","sha512":"18dd1525e2b4d89e3c46d92367fca020cf99fb07856acfd96a25dc7410611eea83b438c91691683983495945eb04a9427bc63e2a383cbe93449f4df0eb1ddb51","ssdeep":"384:FtUCBXTpeaFEo5TTThri1t/mCsOCXiTNZruJ4vKFlcEhRCDxOcX/YM2Vybyq/kmt:n7XTpeauI/Thri1CKWM4ldRzurwkTO0D","tlshash":"cea2b6d61007243d57ead1a13929f7d63177ea98a0caec8a7de91f84d414c83f3f294a","first_seen":"2025-07-30T15:25:28.733337Z","last_seen":"2026-07-24T08:04:30.30622Z","times_seen":14261,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/javascripts/insert.js","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /javascripts/insert.js HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 26 Jan 2026 10:10:09 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Br%2Bb1RLZPi9OsSK4SlFNzekIvz%2BtKiBiPlJyMFgluA87za79N4wuIYpnmgn3grZDbw3IbwyEgfnRQvmsa3WAzn8X%2F8ObyWiD0uiYz9VG\"}]}\r\nage: 479840\r\ncf-cache-status: HIT\r\netag: W/\"69773d81-3e6\"\r\ncontent-encoding: br\r\ncf-ray: 9e066014d8bbb7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":998,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (998), with no line terminators","md5":"29d2e99d5fcb02404184a538c82b6254","sha1":"ef4318b50add95249beac94e8433544a180f3960","sha256":"27b579092e300cf8d2457274b442dc87db8a173d97c72e19b41ba1d90c613c31","sha512":"76aa1c05f8bd676ec62cdd147fddd7c472b5e8241806ce2a4b0e6d72590237969e3652c442ec06fa7fd84be60c1a0f41d7167f37a1bf8cefaecbf23f89feadb6","ssdeep":"","tlshash":"5211be11a565905b0db92176bb2b730eb4bff7168a4c9a44291df6003b038d3a826cf9","first_seen":"2025-03-16T17:07:37.611527Z","last_seen":"2026-07-24T05:30:09.045686Z","times_seen":1706,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":47,"dns":14,"connect":8,"send":0,"wait":15,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/info/widget-assets?jsonpCallback=true\u0026id=69c008124b3dbd326546ffea","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /info/widget-assets?jsonpCallback=true\u0026id=69c008124b3dbd326546ffea HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\netag: W/\"17f-eH3QUt0rUx3cCxV1xCfcqt7GmzA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n3HgNSVMOAXVYUP1T7UhGPSCuQFRJpRbwd%2F8YVuWraoW9K3vmClzcPQrZdp4eHLkMSQb97%2Fbz1jrVAfnSNtZ3ipp5npQv74MnojRbUha\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9e0660152991b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":383,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (383), with no line terminators","md5":"b10b6e87a4930d70ee5c81bb23c0a6c9","sha1":"787dd052dd2b531ddc0b1575c427dcaadec69b30","sha256":"02094c52d679e5961853dc2b643d644db8434e0134bd07d779952edeebee8719","sha512":"8def9ad9080b847f2bb842279231fac877b8c92df6dc965e7977108709b82aa6a0539c7dea98405aef7d1b0544156ceab1e3cbcabb220a0b5b286df0d2f022cb","ssdeep":"","tlshash":"91e02b51da0a0b151b6027767e0b17c224ab87671e08d7a82575d6247115dc61024c79","first_seen":"2026-03-22T15:54:56.467626Z","last_seen":"2026-03-22T15:56:11.316102Z","times_seen":2,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/~api/analytics","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"POST /~api/analytics HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nContent-Type: application/json\r\nContent-Length: 341\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw; session-id=abf887eb-34c7-46f5-9b81-a8c4a9effb19\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":341,"data":"{\"timestamp\":\"2026-03-22T15:54:30.741Z\",\"action\":\"page_hit\",\"version\":\"1\",\"session_id\":\"abf887eb-34c7-46f5-9b81-a8c4a9effb19\",\"payload\":\"{\\\"user-agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\\\",\\\"locale\\\":\\\"en-US\\\",\\\"referrer\\\":\\\"\\\",\\\"pathname\\\":\\\"/\\\",\\\"href\\\":\\\"https://ledger.onlines.click/\\\"}\"}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-length: 4\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: 9e06601628e71525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f92965e2c8a7afb3c1b9a5c09a263636","sha1":"e9b450d14bc2363d292c84f17cfad5cfbd58a458","sha256":"11a6767d5674c7e45f7e00dc525762275b3a48491ad6045427d2609cc496c516","sha512":"25775ba3c567970fc3df3f8107f2a78a67c5619d54bfb37704423acceec253316949eee77b81100a01b91c742e475b4f6157dd2427a9f9fafd87a4078f2d65df","ssdeep":"","tlshash":"54300000000000000000c00c00000000000000000c0000000000000000000000000000","first_seen":"2023-04-09T18:20:08Z","last_seen":"2026-07-07T11:17:12.578135Z","times_seen":12919,"resource_available":true,"data":null}},"time_used":630,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":629,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/javascripts/audio-player.js","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /javascripts/audio-player.js HTTP/1.1\r\nHost: assets.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Tue, 17 Mar 2026 12:29:55 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d7%2BLgED0mD4%2BCSWu%2FlK1VyJp0l5Txp7dafKIfTXuO9ikqa4wb69ybc%2BC2up4qm4hRPRdyEe0LDnHzhkhXTL7Yiu0u7Au61oPiundxr%2FYTUBv\"}]}\r\nage: 292199\r\ncf-cache-status: HIT\r\netag: W/\"69b94943-6b07\"\r\ncontent-encoding: br\r\ncf-ray: 9e0660192debb7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27399,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (27399), with no line terminators","md5":"65cbf911501a0de13afb9d1cb71933cb","sha1":"e9236ab09f15becfa6d86aeb5995fc896f1aab1b","sha256":"e92027b36a47b6e3c2e1c084ac31e8e7e6a4b904bbaa42d241ccf7f4e48d7a62","sha512":"a619c7409dd01aa33de6a1eb397188a42da076126f727c119ed69455158ccff9421daec4d8135dfee4e719b1d62aa70bc767f4430238da97714805c43655cc35","ssdeep":"384:Brt6nqLIf40nECIgPG8OrYleIoARnq0KaHvWvqTGDBnLbcfSLcg:MwXkPGdg7HnqhSTGlnLbcqwg","tlshash":"70c22c48b7e17d54435a34b3223f4a063bb51652545a3240f016c2e9bf78e8b91beeed","first_seen":"2025-09-01T08:05:49.861005Z","last_seen":"2026-07-24T05:30:09.026609Z","times_seen":1373,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/sounds/beep.mp3","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.277Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /sounds/beep.mp3 HTTP/1.1\r\nHost: assets.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 5466\r\nserver: cloudflare\r\nlast-modified: Fri, 20 Mar 2026 10:30:56 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"69bd21e0-155a\"\r\nexpires: Tue, 21 Apr 2026 15:54:31 GMT\r\ncache-control: max-age=2592000, public\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7o3WM7bJrVThE8D00loJ4%2F818FIHUpUOZcMOZRle2crfBGKmNfN31ndLH5uvlES9z9Y330pJMnarmyA1IrmiuU9T57tDis%2BVe1EN9cmVD6EM\"}]}\r\ncf-ray: 9e0660198f40b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5466,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural","md5":"874dcd48ad642582b7e45aee9d9dda5f","sha1":"0dd4bc230c31bbfbdeecaa0be2e10012603175d7","sha256":"55f34e2987da2f0c358a95a191908c281f1755b6507c149dba284f0509694586","sha512":"1135ca9b97cf2b6ff939ac5d4be205c46371ce05b7cafab84afb76484a2db0d08bb7aa1bfb4bd2199582977a777ad796bc022e202d585c677eda2fff7a51f7b6","ssdeep":"48:MoX/qSWcwSL8U+eLHcyFgdp87Iu25qFP7RJFtdm0AH48rLDYwU//JaZd11Ty50b:MovOdeLZ68sqFDTFtdixXYF/QZd11e5O","tlshash":"13b13c2bb07a75ef510ff2363d21415404b19c8be5957de49004c3b352bab49a259aab","first_seen":"2023-04-13T07:14:16Z","last_seen":"2026-07-24T05:25:08.255269Z","times_seen":1319,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/images/chaport-launcher-chat-icon-new.png","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /images/chaport-launcher-chat-icon-new.png HTTP/1.1\r\nHost: assets.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://assets.chaport.com/assets/widget-8d8255af8fdfbaa32802c01bbfe5e2b1.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 468\r\nserver: cloudflare\r\nlast-modified: Mon, 26 Jan 2026 10:04:11 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WwQfaxsNaas%2BYQ4xVal3GFVW8fVlZudK10jDlCKKRztPlc919CcHzwkcTYLpEOlNuudcCFndmkd41bez6rnoHWTeW8N%2FBd%2Fff5gRZouPDjUS\"}]}\r\netag: \"69773c1b-2fa\"\r\nexpires: Thu, 16 Apr 2026 07:01:25 GMT\r\ncache-control: max-age=2592000, public\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-polished: ok, orig_size=762\r\ncf-bgj: imgq:100,h2pri\r\npriority: u=4;i=?0,cf-chb=(45;u=4;i=?0)\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 463985\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 9e06601a18f8b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":468,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 36, 8-bit gray+alpha, non-interlaced","md5":"c893cdbf01d4901c895649e653607876","sha1":"53f42045c25f8732c60fac3687e1d6c3c8a75331","sha256":"aa4cae387402003c90d9dce3355e6fcb43c1886a5a3d8f1006c62458a34954f1","sha512":"8b603e4019d23225c936f21e81f8a3519170a714f8d3107452de4561d7b61b3ba180c8c903ba56864e5932f7c21da2d2bce3e60e0d75d132a25acf809344c997","ssdeep":"","tlshash":"81f00ed70348121ed3c211212b1289b8845162b485d02f15f80e8604976926432cb7b3","first_seen":"2024-03-02T20:53:41Z","last_seen":"2026-07-24T05:24:49.850957Z","times_seen":1651,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger.onlines.click/","fqdn":"ledger.onlines.click","domain":"onlines.click","tld":"click"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-22T15:54:29.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.onlines.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Mar 2026 14:40:47 GMT","end":"Sat, 20 Jun 2026 15:40:40 GMT"},"fingerprint":{"sha1":"6A:0A:0B:9C:D1:7F:2B:68:1D:A8:76:13:43:AC:79:A4:60:5A:78:CE","sha256":"85:09:DE:3D:DE:30:9C:3F:93:34:B0:5D:3E:2E:4E:F7:60:56:31:21:25:C0:90:6C:37:B0:DE:C9:99:F6:5B:83"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ledger.onlines.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:29 GMT\r\ncontent-type: text/html\r\nset-cookie: __cf_bm=lUhjSbAPd0rLVEqRALZGJILa6uBgsAJ2PK3gQVsS7kY-1774194869.5671973-1.0.1.1-AP0lJxGC8kwb01ogujRoKANcil1yDAsEvjT5p6DYCC7YFZaL27dVBQd.zxAC91h1Lh_QngGk_yzcuDYF7HXon32iM8N0vygYYjqLiRp86DrlvBhq0oCwaHlVA5ByFITw; HttpOnly; Secure; Path=/; Domain=ledger.onlines.click; Expires=Sun, 22 Mar 2026 16:24:29 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\netag: W/\"35db098751820b24bec09274ba11f0b1\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9e06600ec9b31525-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1562,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"77031b9de670562119c7de37c8f1f2ab","sha1":"06d90c9d2069d5beb544b2f5c2c32f8a74ff46fe","sha256":"3d9aac36aed0b96c8293cb633ae5ef4d66c58996913b38fee731febf08754ab3","sha512":"b1a5cef3b70622de640e27b41644c9dbf93da2afa7e77163adc62dd3842dc4d1b35a28df24db0b721e3153503d8f75d2d31705da06adf37e2d08e3f877a6ad30","ssdeep":"","tlshash":"8c310cf3d9059d05926082286cc6f554ca36d50bc28cac5270ec90af1fc1fc2c9fb264","first_seen":"2026-03-22T15:54:56.475652Z","last_seen":"2026-03-22T15:56:11.3121Z","times_seen":2,"resource_available":false,"data":null}},"time_used":745,"timings":{"blocked":190,"dns":176,"connect":1,"send":0,"wait":361,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"ledger.onlines.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/assets/insert-main-2c12d9cc3ded20e8cf09a901b86f5c68.js","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:30.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /assets/insert-main-2c12d9cc3ded20e8cf09a901b86f5c68.js HTTP/1.1\r\nHost: assets.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:30 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 27314\r\nserver: cloudflare\r\nlast-modified: Thu, 15 Jan 2026 08:47:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6968a99e-6ab2\"\r\ncontent-encoding: gzip\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\nage: 464651\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4Dyakf3g4lSB06OzMqxS9zCgBya4mKgj9KEFJ7JOCdiMt18ng4%2FcJhskaSubnymDOrsyXWrUUAYgIQp1zI4Tw7UVXI5j69jyLoYT5LYrNZ2R\"}]}\r\ncf-ray: 9e0660157ac0b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83491,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators","md5":"9b47be60a9205427afaa3db67511ed3a","sha1":"13aba22e343283634526ffa15ffb2ec1e770502b","sha256":"4b15578d1c420a58c1c41c4a88728a887af2540cedcd064f058f92b64299d677","sha512":"7493fe9f50f66a520da4224a3514ee9f8030fae1d79708d17be392c168604c530cf7551f4d8d56659e6d3d59844f053e5b48bfc788962e2f1babc627a54a9d77","ssdeep":"1536:a6VmkhM1hDaYGcvezlk5c6w8N6Od9T2KBjtrEjv4SpkHBKlqWfw2:ZQc4yk5HKp5ffL","tlshash":"898329897040343b0aeb21b6357f310a213fe2696e495460b53ad7d07e7ae5b621bf7c","first_seen":"2026-01-15T11:14:47.62677Z","last_seen":"2026-07-24T05:25:08.181402Z","times_seen":739,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":13,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.chaport.com/api/public/v1/accounts/69c008124b3dbd326546ffea/init?id=f7d23e39-7d3e-473e-8f6b-74321f12cae1\u0026token=a2Z0B6oABrMzOdq0imwnKW6cSH9WII0JwZxwt","fqdn":"app.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /api/public/v1/accounts/69c008124b3dbd326546ffea/init?id=f7d23e39-7d3e-473e-8f6b-74321f12cae1\u0026token=a2Z0B6oABrMzOdq0imwnKW6cSH9WII0JwZxwt HTTP/1.1\r\nHost: app.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nOrigin: https://ledger.onlines.click\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://ledger.onlines.click\r\naccess-control-allow-headers: Content-Type, cp-app-id\r\netag: W/\"36c-5rp4LMB6HVHpP14nloe36p5S2Mk\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hwe3QIGFTbZLcZnmXzDSjQa604Ni4VZKs7ja3z%2BR%2Bt71jHfJnIl5lN6RAc%2BgFcT5rysQKuRY9IyhqldEtkWcL0BN9sRHVE6%2Fcu5bQlsL\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9e0660193e08b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":876,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b5b81d1eb08ba7f88d4280a5923ae600","sha1":"e6ba782cc07a1d51e93f5e279687b7ea9e52d8c9","sha256":"e063e3bab24a86fddb44cab11073d4336c441efa04a3766bdee527c12671e4e5","sha512":"262b259590dae4f9b282208f54ba1cf95baf77dc15a0c567c536526348bcde419030d0c91b27adf6093f20ed40da026948b2cdbeac5ee95ba571ceee28cdb1bc","ssdeep":"","tlshash":"1611e359a5255c3fabd1129674c37f03559a80229684c97ec1a4db38825a6c4120cd66","first_seen":"2026-03-22T15:54:56.479316Z","last_seen":"2026-03-22T15:56:11.319284Z","times_seen":2,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"assets.chaport.com/assets/widget-8d8255af8fdfbaa32802c01bbfe5e2b1.css","fqdn":"assets.chaport.com","domain":"chaport.com","tld":"com"},"ip":{"addr":"104.26.14.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ledger.onlines.click/","date":"2026-03-22T15:54:31.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"chaport.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 12:03:04 GMT","end":"Mon, 11 May 2026 13:03:03 GMT"},"fingerprint":{"sha1":"71:17:3F:B2:1A:A5:2E:DA:92:C1:E4:E2:11:E9:80:2C:13:52:7F:73","sha256":"7F:3C:98:A1:84:80:A6:FE:5C:E1:D2:DF:EE:86:0C:F9:5C:27:C4:6C:B5:D6:90:29:A5:FF:E7:5D:AB:8B:28:83"}}},"request":{"raw":"GET /assets/widget-8d8255af8fdfbaa32802c01bbfe5e2b1.css HTTP/1.1\r\nHost: assets.chaport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledger.onlines.click/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 15:54:31 GMT\r\ncontent-type: text/css\r\ncontent-length: 40140\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 14:48:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6967acd2-9ccc\"\r\ncontent-encoding: gzip\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubdomains;\r\naccess-control-allow-origin: *\r\nage: 393807\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=szOeaBezimZbjGi1bxqoeq5MQJoKKaQq3fo4K7ANKYVv1fcl%2BD%2BK88AO5J0ESEENg9T86c5oN14NDyjDLAJFnwsnk203H4D50PR9qo2YLIHv\"}]}\r\ncf-ray: 9e066019af83b7a8-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":519506,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"977e90abf6d0acc616ac3e2333c47dd7","sha1":"fde568873f8b272ee51f7d234fcc5e28752cfcdd","sha256":"198a441f16727102e4445b1ac691dcd63b320997153032cf87365862b1cfeb4f","sha512":"674bfc75d63048a28eac6488ad6718493c094347f2e59ef32ed7bf438de16a24308eb5d69389b6e3340f5f43bf6b1f1f41a2c7cf057462197229aabaf30a067c","ssdeep":"1536:rSnHvoOjr4YP+CQ/mOwT4FjFTa+02FJPMYncA7aN67+qrqUixyii/SYJM1aGV6o7:FOxOwRf","tlshash":"58b4c9409495291b6cb3293f348772591d3fe022c79329ee7569e3ecc38bd635262f89","first_seen":"2026-01-14T17:23:03.352413Z","last_seen":"2026-04-17T06:26:01.108353Z","times_seen":284,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}