{"report_id":"851409fe-d7aa-4fd2-a7c8-bf10f097ffbd","version":6,"status":"done","tags":[],"date":"2026-02-19T00:55:17Z","url":{"schema":"http","addr":"claim.superformfoundatlon.net","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"104.21.16.93","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"title":"Superform Airdrop","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T13:51:59.597545Z","times_seen":17887522,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"claim.superformfoundatlon.net","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"104.21.16.93","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-26T00:55:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"claim.superformfoundatlon.net","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-11","domain_rank":0,"first_seen":"2026-02-19T00:54:56.259261Z","last_seen":"2026-02-19T00:54:56.259261Z","alert_count":20,"request_count":10,"received_data":5163571,"sent_data":4864,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bdc4f09266852b15d22ecc99917eeef1","sha1":"833c3a5e522cc59e78aad59f9c2f9e5d4f93b5db","sha256":"e34db08a4fc2cc090bb186ba19335397e91a9859053e4eeaa9f504531977ee5a","sha512":"95251499c4aed2dea9b3f6ba4566c61995f94fb60fdd6f997cd7425190b9f6c0eb4510c5fcecde1f156ed4bb321ecd07daf5e85ee9354c740b48fce3ae6b9617","ssdeep":"","tlshash":"0ae0c2246a0410bd259365a4cb9d6241e86000735081d501fd1ce65a4f90b693468fce","size":294,"data":"","first_seen":"2025-07-17T06:56:45.686424Z","last_seen":"2026-02-19T00:55:18.50827Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ad1c0840b54220b50b455f6c3b510505","sha1":"ec32335a13e8d8e5529b3d970025d01bda5f089c","sha256":"2fa493d0fb6e2b7aa262dbb0890d24bf1fbf261d1fb807e9e6bc3751ab2b257c","sha512":"747121380afa1c800af0e9a7b4485f56b349013cfe38047b7e00a1d953038e2cece51a0ac4b0e4538144a4ef4adcab4803304ae082ec9423708ba50148867fe6","ssdeep":"","tlshash":"f5d05ea06d182379136666648a9f52813be44461a4e1f002712ce5c60ee1b6410beddb","size":252,"data":"","first_seen":"2025-07-17T06:56:45.689285Z","last_seen":"2026-02-19T00:55:18.509305Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/432401d3-26fb-4f6e-b540-d2c16482914f","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f11bcdc7b7757c117a8de0db3a4c25b8","sha1":"962e4d08a960106c829d0f9d492d7b891927adab","sha256":"b60b89c0c92cf57329c8590a2c5540cece4def64e4e7bf04f2d39b8ffa3b2748","sha512":"7461553dadb09db423bda8c47a58f8cdade82aa710a0f4415cde912e7a88cd4471ea86aa58a2e5097c90e2cb45ac410104019c56a04c35955e827f0bb0796040","ssdeep":"6144:vkWGL6BSn5NGCk3zi0mCw8wLPNU2HZjGfty3:cjkSnv1k20mCwFnHRGfty3","tlshash":"1044810609ac4f7986ec22e015f72cc401794e0ad9dc3cbfb9ada1579e25bd6e0c279d","size":259964,"data":"","first_seen":"2025-07-13T03:04:16.940864Z","last_seen":"2026-08-13T18:03:54.375268Z","times_seen":5113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/material-input-2.8.1.min.js","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f538ddcc253c3ba367bb9a6c15e10d6","sha1":"26cf4d9d43c7624d9da4cf04f9cccab6480d4256","sha256":"710f87ee660cf8cec4ad68c7eb8957a7c2612c2b1a5ea840c033ebf9c17968fe","sha512":"adc49e827b0ae85b11cd49827301aec0be671e902f4606a2e0cece5eccda7da2f6251803b598a3b54a311bf152300196eb22038bd01765eced0da2bb5b8a2c63","ssdeep":"1536:YFQIHXDVBji3cMXxPXXaHHhFsiDSvzboaoXqwZF9u:YFQwrjizxPXKIsSvzboaEqw3I","tlshash":"cbd33fd6590bc4e98e1111ddd473ec09e46809a3ceadf193ba2cddc6b42ef66844723b","size":133599,"data":"","first_seen":"2026-02-19T00:54:58.229021Z","last_seen":"2026-02-19T00:55:18.506131Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7aa26c16a4b033eb4b77215fe34c871","sha1":"af0683c9205287112ffafe392dcf647b6f13db9a","sha256":"bd6be8578e12bfd2f651e9225c4fb5f0758302ac910d6123149fba8ebe840a4f","sha512":"3a323b807c79038a601327bfe3f38a9bac0cb13472803572f1953b1826b876cd282cd1788e141181b538500664523d671e58ce82c3b083df7da0faf7c3f0821f","ssdeep":"","tlshash":"a9e08639757815794d5b947bc687534f7da1142a5001a116780c924b0fa4f3034ead8d","size":327,"data":"","first_seen":"2025-07-17T06:56:45.690488Z","last_seen":"2026-02-19T00:55:18.511193Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"e7eb97449debef5fceb58eb2eda19a81","sha1":"578eedfc85289b09a8b3b026c03bd5db7a6065c2","sha256":"08b66ea2e1abf912815e25f527642efce2ffc43a8d4803bdf7563790dd69b450","sha512":"a37786743e97b0b2146c8c37f5c106ce7296ff2aa3b72abac700e104e87e51659a2bd0ab8687e85eecf338459ba84b7b1d806f2387e3483bfca1dcea7b7067d6","ssdeep":"1536:bZ1lKMg4EGURqSF6iz37dALhFsAzSvzboiyUKhJB:bZzKMg6URqSF6iz37/8SvzboiyUKhX","tlshash":"cdc341d5590bc4e58e5221ded473ec09e4280a63ceadf1a3ba2cdec1745df62848763b","size":128941,"data":"","first_seen":"2026-02-19T00:54:58.237049Z","last_seen":"2026-02-19T00:55:18.512147Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"76244d8526da359429886b03a7ada498","sha1":"90415cd87cc2f928fc8e16b7740dfb09f7e5bc10","sha256":"3f699786f5f750c5ee9696bce7941003b51f5e5628b55aa6ca59917195d8b490","sha512":"3ba24210155df81c4378587bf70fa4a66f8eb44e60d01deca3b32a8ccdd092d350a1fd870334d90469b750c2fc86822743811cba384e7baa95635291061c3adb","ssdeep":"","tlshash":"dcc0125970206966048e787d4ccf088ebe268412a20849c999dcd8547fb1e6c42e484c","size":184,"data":"","first_seen":"2023-09-20T06:28:52Z","last_seen":"2026-08-14T12:21:59.538531Z","times_seen":1971,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-08-11T10:54:04.310295Z","times_seen":3240,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/24b9d70a518bb58e.css","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:37.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /24b9d70a518bb58e.css HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"216-19c4c832de7\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RfOWqoroKjc%2BMAvRd1sNrsI%2FchOz%2FVEAirbBkgAfQXFfTS%2FiduEVemneq8Xb8aWr6vqTgyhfTO6XB9QSrqRsAr0ZhGly51SplLc%2BjriVbkQluR1Ivq0FHlc8Zy9t\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb451beddfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":534,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (534), with no line terminators","md5":"5187cd0a93fb6daf09cad236fc10c76f","sha1":"3639d3384c737156280a82ae508c92f608d55ffe","sha256":"1d3162144a434a45889360f66f962a2cc2c30116c9ac4db345078a6f87f500bd","sha512":"6fee11fb9fdb1933898c2bcbba1ede39f8877f60344376f87e5ff4a3c2f6608837dc4e8ffa026f8a51062c61cc3b1f802879d6bf7713c49b0758f7237a484c92","ssdeep":"","tlshash":"8ff062a4e8219aba3d12e878136cdf59d003a09089ea469579cf526861c3b930d72155","first_seen":"2025-06-25T09:12:16.631378Z","last_seen":"2026-06-26T22:05:17.195861Z","times_seen":100,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/a15fdd5be02827a2.css","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:37.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /a15fdd5be02827a2.css HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"111bf-19c4c832deb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KufLRWhUQ2kVqXDeH%2B0ZPYWkkyS2OOJwKj6rK4ta%2FMM5pW7K4XALBu8MsqdWtaPHJAbrK%2BZj0ySSmSLoOWruDqmW69wFppL%2FQY3mFUKGoaBfb3L1DGHljWIjH63j\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb451bf3dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":70079,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (61886)","md5":"3b09fe46bdbb296724ad9b2c4626f122","sha1":"8ddfcbb4d3d31ab2fa98f84b335e78d143f50d82","sha256":"286b718d4e0c4de4a6c2f2899f9869d8a97cf39f52af1959089a512b8c8b4338","sha512":"db29dc2546e4648021bcdee24af0bcf1b72308eb8e6c397e64de7041b7f6505260c68f23def21e960b64a7ded287d214a3e8752e22734d181eac4ba7d45fffc8","ssdeep":"768:C/VnOg0VFq6ha4lUfJgX8zHtAVtXilnTsNpnuhc26ajln3uqVB4Gi:yOg0Vc6ha4lUfJgX+Kyn3uqVBbi","tlshash":"f563c720e225e57fbc37a57866bcf81c72067190deb907e9fa2271119ec36f21c26724","first_seen":"2026-02-19T00:54:58.233828Z","last_seen":"2026-02-19T00:55:18.492793Z","times_seen":2,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/9722456a4ad99fe0.css","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:37.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /9722456a4ad99fe0.css HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"6d9e-19c4c832deb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n8Nq1T7HHkv%2Bdq4bMEIz%2FrnMwSTGDZHNh2%2FzxkwIAfRJ69wHP2Fm%2B4Roxq8EkfGX96TVMxFDANh02KmkErlkjWdj5pVGhm8pz8xzozUfWuuOeYejtuvVKAJRHySH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb451bf8dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":28062,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (28062), with no line terminators","md5":"b06c08500e32c56b15dab50d887b0311","sha1":"e131304fec1b297c8e717e0c7928fe467ea45c45","sha256":"ac50ff87190bea4ef8fba0e895c90a5c177efedef0ceeca4ffaa898129fced01","sha512":"fe09764f0f31f55c043a9395f2c79d6cdfbdf35ada449f097433569aa8d7089139496a6317d0c4acd242bd50346926428f5f168d48b6a73eb6d94d29a3659aea","ssdeep":"384:TpSed283ZcW23qWF7O36AgzyAIfPo8PFEIN4:TpSUJoAgzyAco8PFEw4","tlshash":"bac2c9097e2d3f38ba13a32440c0849c620b775feebd8797acd1265d9d9d78431aca79","first_seen":"2025-06-18T00:26:14.391201Z","last_seen":"2026-08-09T03:42:01.514962Z","times_seen":150,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/home-img-1.png","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:38.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /home-img-1.png HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:38 GMT\r\ncontent-type: image/png\r\ncontent-length: 66426\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"1037a-19c4c832def\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kahQRs%2BGgfF4%2FhJvo1QFtko7En9tIMMjorZEzHnw0JubAJscMhExE2Z%2BhFW7mK5HRSvN4nN1Sv7ALqxszm2o%2F3sE2W4ihHkA5JUkubvTosWfklA%2B6oK5gKhCHgyh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d01cb486beadfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66426,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 666 x 403, 8-bit colormap, non-interlaced","md5":"62aba68778136dcb821d22ff04a0f5b0","sha1":"274d04c2128e4fc6dabc9f6589390efc467e3314","sha256":"2239b0a3d3b56cce01b6c4d8c2970e848916574132c45ea63a7d8fd0d5815c9d","sha512":"cd05b086288bb1238045f87d9077ab7e26f829e6fbbceaec1a41d3d13868c98a8ccc5706cca7aa62b7c8555a429cd522d98465c202f08261677f148d1748a91a","ssdeep":"1536:S4er3poK0eOptW/0yzctvD0HvnMgYWzx3xPKBUMck2WjUQ0nTRjO:ZezqeOjW/0yIlLTWTNgKhO","tlshash":"2f53025c6137a6ca909386b0c89b5d0f49732863ddd4c0c88f0856927a7f3b76933a2e","first_seen":"2025-12-03T23:53:46.0764Z","last_seen":"2026-02-19T00:55:20.34988Z","times_seen":36,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/null?e=jscdn/getFile","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:38.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"POST /null?e=jscdn/getFile HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim.superformfoundatlon.net/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://claim.superformfoundatlon.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"n6ngtk40j6i1u64spv2z\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Thu, 19 Feb 2026 00:54:38 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff, nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UzPzQOTNdjq1jqd7n9UFtwkpMiR6pgXrJEr2eNGnA9wxEFN9d1NADDn0ELCD4RQ56veHiAA57fLqXJ0dc1b%2B8l4ZBO6zuImvyBcB9roDfSYwJWMa7L1Dx9%2FUKCWe\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb489c51dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":144,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"0648c3a59093f77ab5400e886115e62b","sha1":"50a2d9ac5bf4c961039c97e4e10059d42a79083d","sha256":"dcd28e20b1fa7aa64ad5afe66bb1b2e133a2a96efbc7a2ed50e4e90ea4a1e966","sha512":"d0e0d76c52e45465e7f214798be9efa2860729cf7ba46c655e4be15c9cfcdaee4bcd771a8c35f5851c9e63caf9ac9f14cc4961a8abcafb9ad2a60d45c9ee618f","ssdeep":"","tlshash":"81c02bef101001010930c3443ec2a2a434d73b8b20e2c9006b83e017ecd461bc8c728c","first_seen":"2026-02-19T00:54:58.230811Z","last_seen":"2026-08-03T12:54:54.39356Z","times_seen":14,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/secureproxy?e=jscdn/getFile","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:38.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim.superformfoundatlon.net/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://claim.superformfoundatlon.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"n6ngtk40j6i1u64spv2z\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:38 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncontent-security-policy: frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EaPVlH3U58M1YmnFhnOCoe245x5rZ837LsBKCRAPXzaxOqqPoPOPEyj13X%2FSB3ZN%2FJtCpPUMeeFjlamukSvAPMJCdEZjafnHmm2%2BBbHSRwfctw%3D%3D\"}]}\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncf-ray: 9d01cb49df0cdfec-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4797675,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1dcdf72a6c5bc006aeb0d7a82a6ce327","sha1":"5947b47a595d41fd782fba13a053727480bb21db","sha256":"63ebe92d4ecc25fdb89e6fa25c4420cd50932de0e0b435b0b4281ce7ce5bb302","sha512":"078e5c9fa97bd12f6b978acdf199c10828e2a31a4adaa5ee27f2ec209bd5ebe60da932392ba9ed24c5b5ad1158af0df326e3b19aec89af23985eebf490057cc6","ssdeep":"24576:pYkb/YWmLkwsOukzMSPbg+lsVo5/Cr0OSzcfUjel7M0RjUIje:ptGkwdNZngkO5jy","tlshash":"b62523e39fab942ccf5c0e99701b2d0f6c450d411448eaf6ea65e8c736acbb041e693d","first_seen":"2026-02-19T00:54:58.231782Z","last_seen":"2026-02-19T00:55:18.501234Z","times_seen":2,"resource_available":false,"data":null}},"time_used":617,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":483,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/138f3cb2f3239054.css","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:37.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /138f3cb2f3239054.css HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"2d5-19c4c832de7\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tJ6fBE0I1LsTVjASm1k6YMd4FqJG65t%2B7rcineFVF1qzWl5sIQnrKMGKNl%2F9utUzZ5g5Khh6AukpbR2gHflJj%2Fy1Cvcc%2FaPt6sJ6FR%2FfXnyvB48j2rtVv0QPEQnD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb451bfbdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":725,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (725), with no line terminators","md5":"44db3e1de099a93d79acfd53c5f5a1f2","sha1":"34665fd937b455fcbfd4e8e354c1ab00de993f56","sha256":"517c3d37440776fa987ca01292cac5a1d7381c317be1508a26422d851d4d979d","sha512":"67b4fa1db97721ae7dba04c1710e6f63d266cdb596e94c9b544bd2e2bc7e5e5a53189f56962ef37fe3334ed9583a32aba015fc70231729fe0b0173d32f44894f","ssdeep":"","tlshash":"e201e9a8c921f6ba7f17e1a892d81b3a3206e7b444ca4384421fd0317ccbbb60163896","first_seen":"2025-08-21T04:05:47.796863Z","last_seen":"2026-06-12T10:50:16.390393Z","times_seen":82,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/favicon.ico","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:38.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:38 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"2b36-19c4c832deb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BYlgl6uAMtrcnMr%2B5Bfcf6VaCQvCUJTdxtHRoXj19lZrvdnXJ7sGBwzQIZKTF5vPNyCa0ylSbA84qa6qulSj6CKQzZ4ZRxRUePR1WWcY2xUVQrOLMrRMstsNJ%2BnR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb485b9fdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11062,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 53x50, 32 bits/pixel","md5":"7e8ceeb0fd30da8b3bf55ad8aef7023a","sha1":"bbdafec6c002159bc6505a2d22230e69151a62ca","sha256":"09a78fdb5ca24cff9ed5492efa4f68385086817a8b3afe3a6551a5d546621693","sha512":"acb45bcc5a16a2935b9a9ffac3d610f45de7ed4c93cb578b3ee885ef71ff7d632bbf5370cfbdf8ddffdf3c2a673b01bc141ae0685959e28bab0ec996ef968281","ssdeep":"48:XOZjt4MGocdLrnNDHwGh9Vgx4ozEBPUsBPejqHme9E7GpG7HHQeLAJxXuhSP9odU:+ZjGdl9fia3iW7HQxotV6u4eixs","tlshash":"60321f89f71bdbf0d001e1b252d2ef9a6ec51daaa450005407543e6b3db2ea9f38e533","first_seen":"2025-12-03T23:53:46.083421Z","last_seen":"2026-06-12T14:10:03.994811Z","times_seen":42,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":235,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-19T00:54:37.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: public, max-age=0\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Akv6dpPRbxsVyYy%2FM9XDf80231hHwuLUqYkrCJd0BPG2JW6%2BQlcv9n91yvPoKmEHK5Fw4eRQsZ7s7gwRG5NTF3AIP8fClkqT9kpibg4fDXBIFXiBzTUbfQ1Dnm1m\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9d01cb42fa5e4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45769,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30151)","md5":"92cd9e1733b2161f9685e6f62613a48e","sha1":"d6bd9a329aa8ee822ffdc4954e658cc99d97d2fe","sha256":"c50bbd0b6ea1b5c5ccfab51e47af0e751ac8c0db443e02819d192de4a378fe02","sha512":"49310571232083b8b430b041caa7fcb7a18fcf1237318963fa5626af778ab2ed773dad67321474bf630ff1d4a7fef15e6b7fac7f8719465a830f0e352d66a6cc","ssdeep":"768:5q/lcQXxoy/LDN7uBkVbSKn9ZlHMeBmaN/x89vzoCx:5q/l7hJ/PN7NVbSIX8vzoCx","tlshash":"15233b90a5601bb62c07ffa486cded18d127a0f689cb164dfbdd514953c2bd80fb9b88","first_seen":"2026-02-12T11:29:48.607647Z","last_seen":"2026-02-19T00:55:18.505304Z","times_seen":4,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":24,"dns":1,"connect":1,"send":0,"wait":161,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.superformfoundatlon.net/material-input-2.8.1.min.js","fqdn":"claim.superformfoundatlon.net","domain":"superformfoundatlon.net","tld":"net"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim.superformfoundatlon.net/","date":"2026-02-19T00:54:37.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"superformfoundatlon.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 11 Feb 2026 10:51:11 GMT","end":"Tue, 12 May 2026 11:49:41 GMT"},"fingerprint":{"sha1":"88:90:CD:9E:58:B7:05:2F:28:D6:49:11:1D:98:5F:DF:06:6E:6B:89","sha256":"5E:B6:39:F4:D7:40:62:E7:67:67:C5:F2:DF:03:A5:0A:95:83:85:40:A0:72:6C:B0:5E:D7:5D:93:C1:21:74:1B"}}},"request":{"raw":"GET /material-input-2.8.1.min.js HTTP/1.1\r\nHost: claim.superformfoundatlon.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.superformfoundatlon.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 19 Feb 2026 00:54:37 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Wed, 11 Feb 2026 11:43:11 GMT\r\netag: W/\"209df-19c4c832df7\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncf-cache-status: EXPIRED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XpbmTppl8HpmdMuXAGOf%2FNxHwLz%2F50g3ScFjDNpcZsIfq18WS7Nxf25fCnipJrnLksRkemw3AL5zKMTKdH3ALC4YMaW3yZdEHu1zQJ0jmmy3WaUF8PFrC6mUK0eD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d01cb451be6dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":133599,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6f538ddcc253c3ba367bb9a6c15e10d6","sha1":"26cf4d9d43c7624d9da4cf04f9cccab6480d4256","sha256":"710f87ee660cf8cec4ad68c7eb8957a7c2612c2b1a5ea840c033ebf9c17968fe","sha512":"adc49e827b0ae85b11cd49827301aec0be671e902f4606a2e0cece5eccda7da2f6251803b598a3b54a311bf152300196eb22038bd01765eced0da2bb5b8a2c63","ssdeep":"1536:YFQIHXDVBji3cMXxPXXaHHhFsiDSvzboaoXqwZF9u:YFQwrjizxPXKIsSvzboaEqw3I","tlshash":"cbd33fd6590bc4e98e1111ddd473ec09e46809a3ceadf193ba2cddc6b42ef66844723b","first_seen":"2026-02-19T00:54:58.229021Z","last_seen":"2026-02-19T00:55:18.506131Z","times_seen":2,"resource_available":true,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-19","alert":"Sinkholed","trigger":"claim.superformfoundatlon.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}