{"report_id":"85ea76a6-bb0e-4c30-8b60-30f7f69f2a51","version":0,"status":"done","tags":[],"date":"2026-09-11T03:59:36Z","url":{"schema":"http","addr":"reward-haedal.xyz/","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"reward-haedal.xyz/","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"title":"Haedal | Stake SUI","dom":{"size":334857,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (61000)","md5":"7aa1738e87ad417a6e4eba6101d29531","sha1":"5ab9a851623562f04b568680ace661a60246c4d2","sha256":"1417a33fa91eb11b2cc826cd3b12c9957234537d5e3913951708988b1c689cd5","sha512":"df13494362e712a4d2b832a492732daa8dfb835bdc0c9c3516e6340bfd7314675579f2a38d3ecfdf8a0fe835909ee45419ad614f563fc170de67927b60b0d81d","ssdeep":"6144:8D6cdWoPWoQZxUzEi2rA6cdWoPWoQZxUzEi2rBSoMDzMj:8ut","tlshash":"4b64822452724afe811f75e1b570a388222fa30bfb828ef5016d58e657d6cf55c938cb","dom_hash":"domhashba3122dad9df17702415b9157afae4fa","first_seen":"2026-09-11T03:59:44.747042Z","last_seen":"2026-09-11T03:59:44.747042Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"reward-haedal.xyz/","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-16T03:59:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"reward-haedal.xyz","ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-06","domain_rank":0,"first_seen":"2026-09-11T03:43:56.14094Z","last_seen":"2026-09-11T03:43:56.14094Z","alert_count":59,"request_count":59,"received_data":4118373,"sent_data":30359,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.haedal.xyz","ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":16,"received_data":4731576,"sent_data":9137,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-06T22:43:29.329928Z","alert_count":0,"request_count":1,"received_data":3239,"sent_data":523,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"reward-haedal.xyz/","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"eec1204d278e5ecb994e2815798b2133","sha1":"a2aec15ab732325a19a922965e2767978e4c4f11","sha256":"0ad36e39739869c9cc4f04d532d01e3d34425dffdd12664b954f951c228abf94","sha512":"13cbddd754874b0ed65a1c26cfb1c0f2c903bf5d15e4042d5b80b42386d5fa988027c57e8a55faf433acbbea9c40cf6d5777e9f25d7a66f274dd66c0d5ac0fd8","ssdeep":"","tlshash":"64c0224080b18da0848c009b7330939835d0242c00022086c5fc888e204aec02598404","size":180,"data":"","first_seen":"2026-09-11T03:40:22.373546Z","last_seen":"2026-09-11T03:59:44.805993Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-10-14T18:40:57.677574Z","times_seen":454824,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/secureproxy?u=%2Fipfs%2FrCiTGD-ycOxDmeVN3kx1wg30cf386fa4474b2ad5f12d84dbac716b%3Ft%3D1789099141986","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a29b840e5a9b7ef0e51ae009c6715480","sha1":"562f73f0791c4bf021a89995d2836d4de22f4d0b","sha256":"f59225c073e1a044e9316d8590729de752849393be505d460b0fd4b6e2de6545","sha512":"fef561e435cced1a27c81ec8119410b0dc51631f5d2d41017dfb5caefefde86b786c40f6872e4d0360592219b169cb529cb91a40ec41db804412c83df7d17e87","ssdeep":"6144:gn0n1c1gLP0DYh5gDgu2n4f/zrYmCdeTTliwzZeURKw:P1c1g7cYsVYmCdefZKw","tlshash":"fac4bdc4873b69f6d2cd26b62663716fcf8c1f04238f587862c21dc3a654b1296e653e","size":563268,"data":"","first_seen":"2026-09-11T03:59:44.770235Z","last_seen":"2026-09-11T03:59:44.770235Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"reward-haedal.xyz/gold2.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.475Z","timestamp":1789099138475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold2.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-9da1\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EVsWF7U83WXMiU6kKeqIgp%2FfFrtHKTyU%2BNeRk3nEE3wmPKPWKwrQswXOkDWG%2FucjMo7CzoCcUwWZZ1TOTtjNKSACVvlGhK96qQVk%2BhWrNAoPUoAUX45GiehHEeQ9nmySD5F5Ug%3D%3D\"}]}\r\ncf-ray: a393c1cf78840883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 40353\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40353,"size_decoded":41294,"mime_type":"image/png","magic":"PNG image data, 323 x 170, 8-bit/color RGBA, non-interlaced","md5":"a89f8ddde14ead06d22c24841d3879c6","sha1":"2670f5020c632e1781989c6c8f75fd38922b98f6","sha256":"1352b9e9346e7a5841db1a6720714ab705ab1a8bd1a06559ff341c00c487ac6c","sha512":"d458043c21f1a692da6854f5bf9b2a7fbb07d60cc2b50c6a43686840c484b06e3907295d1e82a19ae7b0e2681c92b52689f82dee87810e09f4584158d4e6832c","ssdeep":"768:UZZAnsEl2PYUqwiKySHEqaVVsTmDExoddfVHqO3NGcXoR:4ZxElH7vSk5VYmDwyhqmbG","tlshash":"5d03e1de2b4b476eb729f231044fcac9e882a52f1ea0389ed3616937f16499b8147c51","first_seen":"2026-09-11T03:40:22.182259Z","last_seen":"2026-09-11T03:59:44.748924Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/deep_logo.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.508Z","timestamp":1789099138508,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /deep_logo.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-4f4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tmuraMVJatXzpsFDjZts3%2FKHVA3DyzonG%2FmaDBHpL9WnPrRguFfcvMYVJtpzoh9T5c4QZuGY9HZPO9NVJ6pG2OElAJwZKdnGtvdsOh28lDZsqJyf7k7m%2F6vxs5OgK%2FU2Z86%2Bpg%3D%3D\"}]}\r\ncf-ray: a393c1cfa89f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1268\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1268,"size_decoded":2209,"mime_type":"image/png","magic":"PNG image data, 160 x 160, 8-bit colormap, non-interlaced","md5":"65bc268b5215fd47ec4baa7759780c34","sha1":"20353e097b1c79f6eb6c86e7675b98ed7f9492dc","sha256":"0eb602a64b2f3861b4df8ef59dd1e4c0de8e1a570822a64475b683ceaa910a86","sha512":"338565df711e5c14f949d8ba6579ee05301c5b15c802f37f747b4cef914f4984ee592af249b5263f2143902e81474d7870569f8b816e02af955a1817f6842a70","ssdeep":"","tlshash":"c421e7aef0d2dac0e456a823047c68e4ba68860f6bb24328300d1c7bdce1dd5d8240a1","first_seen":"2026-09-11T03:40:22.237045Z","last_seen":"2026-09-11T03:59:44.749568Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/token_haedal.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.512Z","timestamp":1789099138512,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /token_haedal.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-ba0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B9UFe0Rxc9HvoefBVMInkxXPuJIrx9fDJX2EDctDNG6k6urhQo0KCo6WxFwqtAdACJuvBaN%2BOt2mt%2F%2Bal93UxqpoWg4O5vgMaZLEWXEtg06Y%2BdYlYl25FECv7WcqgjFs7iuOyg%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a30883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2976\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2976,"size_decoded":3915,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"7f57abb2038d21e656cbbfd426610f3f","sha1":"3325039364782c0601e753a21a00477bf24bfa60","sha256":"61ab547a104c2a2a7a18f86b8ec0b59e36b846bda84b0a292635828a11d059eb","sha512":"7effb709be6312c6e488f0618ac54c7dcafa4b9a334538de025abe54ddde392418b1cbcd671cb0af435786389f02f7ff403591c028d7ddb8c1afe351592e6dd7","ssdeep":"","tlshash":"7f514d496b85ab7dfa1de4cb0799d263041c3587082d3f751bc91a778fd61010c6fae2","first_seen":"2026-01-24T14:16:13.833816Z","last_seen":"2026-09-11T03:59:44.750146Z","times_seen":7,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/haedal.ico","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:59.868Z","timestamp":1789099139868,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /haedal.ico HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:59 GMT\r\ncontent-type: image/x-icon\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pD1OWvg84MyliFNfZ2cTA1As2aGjx1pFIvOgsCVjDdE7%2Bx%2BZhH%2FgcnQbyRPajDlOt8bnRZ8sGfLxZbgedHDn1cKItV5FPA8BSty5nGhYmOS42NV2KohT2NjNBekm0y9CXFQPuA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=6,i=?0\r\nage: 1164\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a9db7f2-25be\"\r\ncf-ray: a393c1d829420883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9662,"size_decoded":3285,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"f8bdffbca4d1ac420ad8942c7bfe4b2b","sha1":"7beedc1eeb80f50b8018070ac8587e61a9901a66","sha256":"0f99821eb445c133b8c95dd8a036516a5ccafcd16083768e2414df6699ad6b34","sha512":"cfc304801d705fc069501da3101c68bd10abc2dca6a9e611900240bfa596f920dbe9c650ac0a4249ff1fb58e7f078f02eb083c0d0e011a49324d11eb5019ce54","ssdeep":"96:93uVRHigj2NJ9tTtAouCw6Maih4mmAAAAAQ:wPKN/tBoCw4XAAAAAQ","tlshash":"bd1261cc3642807fd6102d705cc4b287d7a4ee97edc9a4b703f37a2e61b902f4566924","first_seen":"2026-01-24T14:16:13.821306Z","last_seen":"2026-09-11T03:59:44.750668Z","times_seen":7,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/orange-star.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.482Z","timestamp":1789099138482,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /orange-star.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-66ea\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7avHyScogbgrCOW%2BC%2BbSKg3vD388cjIYg4Ail5upj1cDrNYFDF9y%2Br21TIJtcG8YMiR2yXFeEaAEQLuUJOqCPpXknvXojLZCdfBdeGONp7%2BZabNC6xrjThjv7r%2FShMNpw66iNw%3D%3D\"}]}\r\ncf-ray: a393c1cf888a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26346\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26346,"size_decoded":27289,"mime_type":"image/png","magic":"PNG image data, 177 x 167, 8-bit/color RGBA, non-interlaced","md5":"c4755f2aca244d9f14af74feb1b05295","sha1":"55295b51aa62fd685e39e02fa4818687e69adfa5","sha256":"4985b0eb8678c2c795ab021a0a9fba07142a98ba51bd14d68ae52856c7827c78","sha512":"04bd4d1589f6f1034a8f1442477934192980949233eefc4a91941b4a40e88f08f5c7117f3c6d0181f73379825a04d917cd2972b5ecede510196fcacf95a867e8","ssdeep":"768:o31q3E8OOKPugePYwJI5TQI2c4Vu7BmWBu+:Q1R5OcgzU8I2cxBmWB3","tlshash":"6dc2e196531da7e7fa9b5af1e1e69a0ce0d065c3a23e752a02e91c119c2f2b1750c4d3","first_seen":"2026-09-11T03:40:22.25337Z","last_seen":"2026-09-11T03:59:44.751245Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/footer-bg-zip2.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.092Z","timestamp":1789099142092,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/footer-bg-zip2.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 323248\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-4eeb0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f7ocYhFD98zGEQ7%2B0RHVPJHKmlXfSFpPHEEQQEpn6RGiiozlZ6valWb2P2gkkCI276jrfDOvcEOpCQcYPlItUcaEDRXeVFfcVJAVKzBv09TwpN70K3B7aTMGmCx7eMX7\"}]}\r\ncf-ray: a393c1e61ce90daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":323248,"size_decoded":324007,"mime_type":"image/png","magic":"PNG image data, 2880 x 1251, 8-bit colormap, non-interlaced","md5":"6b93f6c256e2c1933ea7ccadc7f16390","sha1":"508994516bb68b294e223572ae1074d2f37212c9","sha256":"b992e40c1ec3c8b2d1638a1834e9a9e7eb27baa3e345c8888d628c6890831c91","sha512":"e68da5343fc1491b741c006288bf03de9cd94125a388c7dcbb5a60cf8762bd19750764d248d2a3e75d379eab0da731142e541e61c55fd6f5c791dca1123e97d4","ssdeep":"6144:k9DE1Aul/nRRRDIAfEtkpRrlaMxJGdPfvd+nH9XMY3rEsX2u/B8YPvMVU8G:ODSxl/nRRdEtkkMx8FHdKH9rB8Y8S8G","tlshash":"74642304d2a17dde86f7cb3412facbc85725882ca53f7542a5a0bd625b8324c99d4bec","first_seen":"2026-09-11T03:40:22.297108Z","last_seen":"2026-09-11T03:59:44.751791Z","times_seen":5,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/Token_SUI.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.497Z","timestamp":1789099138497,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /Token_SUI.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-30e4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tKNvCv21KVgFTUK3fqMdo0iC2lfF7BGaX1WJ%2Fo3iCVlGq%2FtydRxxma5z034UBtYddvnynabHV4wKu4dRH6EAw2j6EGp8ZFSuEFJGtaL0g2w7e4NaxhruFndULXBqPWmXPFxDTg%3D%3D\"}]}\r\ncf-ray: a393c1cf98980883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12516\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12516,"size_decoded":13453,"mime_type":"image/png","magic":"PNG image data, 240 x 160, 8-bit/color RGBA, non-interlaced","md5":"a6e723c0f7dfcf7048552d3e97f52cbc","sha1":"5fa7e89f3044592ef9eed884a5fc6bd2fffc10e3","sha256":"9af861c3e5e471b75eb0e269f1fbc9b8cfc5c712e41d353fc13acc9349be3787","sha512":"272d5a82105a22b16dc95efe98faf882ce25d8d99408eddcc527596903be7dc0d293dc98b1abfa0b55a4784bfebcd8b30188e1964af0e161d22d8f138bdc9488","ssdeep":"384:bPGdOE3yzQjPv9NN4YVWXMxKUwSRj+1Tl:bHYWQjPv9NVV4UtATl","tlshash":"c842c06a64023580978c7fab441a1cd6b5aaedd247a27ddafc0e61d359d5877ce20330","first_seen":"2026-09-11T03:40:22.169911Z","last_seen":"2026-09-11T03:59:44.752329Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/magician-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.500Z","timestamp":1789099138500,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /magician-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-127af\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PNxqZd3ZeRWHyAyKZd2%2BYgrgwgo39QWQ4KqoMOUjb%2Bh72418CkRwLsFnG8cbKKb9%2BsH9JhxrZR8JjLOD57cofXAbbL%2BhyQEiZQdOUYv1e24V5CCJ6tb5gKa5SJs3EsCpgYUNmg%3D%3D\"}]}\r\ncf-ray: a393c1cfa89a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 75695\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75695,"size_decoded":76637,"mime_type":"image/png","magic":"PNG image data, 768 x 640, 8-bit colormap, non-interlaced","md5":"4b90571c3be44240a102e3454b85d2cf","sha1":"1e7c3bd755200c413237b0ce5b1da32e836cda72","sha256":"0f7001cdd6c564cc8d00c3e62e52a8e0c619f25cbe868653b934b7f3c6e036b9","sha512":"59a792984c25cf9852d018f2b72589a3f28f4fe6156440db7798064493015e9eaaeb2a495ff541642c7477cacc61e7645d5e157e56a6159cccbfe22c66ad318a","ssdeep":"1536:FklstiKA02FcJOYx6l31iovCdlOcNWPkb+xTdoPVRyV+/MP5GE3:FkmtiKA0A4x6F1io6OmotmPb4qO","tlshash":"af730237f93c2957b5e91859c2306896f28d7768413c8a279d09a335fb29720c7cb7ac","first_seen":"2026-09-11T03:40:22.221216Z","last_seen":"2026-09-11T03:59:44.752836Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/cetus.webp","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.502Z","timestamp":1789099138502,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /cetus.webp HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: W/\"6a9db7f2-75c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1165\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CPLBBNpM1yQAu1ZVm5%2FJ2J2kBa21zQp9L1XG3YKz6WOa%2FJwKs0PheontcLGuVpyPNpSy5%2BBYLjakxKGE1F42l6N4gQVOK6cAKRG0hEUNyhr5s8d0jGNiM%2Byocq9ycV5LKxbHzw%3D%3D\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\ncf-ray: a393c1cfa89b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1884,"size_decoded":2667,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7387dff1024613114ca0bb8661a0e276","sha1":"dc9f7d1b6ff0a5d2b86bf86eaa8147cd59582664","sha256":"a068ffb52e6fb4c58854cfbf0003b9cceb69cb48f143e043eef47122af7cc512","sha512":"aa08b5d4da9d615798b6676d9ff7921281b9b631cc9b43902553f0783c023371095421a14dcc7a4febf7966e75ca12a511984dddd8278d4e8e9102bdd3499e43","ssdeep":"","tlshash":"84410833a7f7877cd5144bf414a16bc6f63dbf2641068271869407482f31588ae7e793","first_seen":"2026-09-11T03:40:22.287089Z","last_seen":"2026-09-11T03:59:44.753348Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/flow.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.526Z","timestamp":1789099138526,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /flow.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-85ee\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z%2Fsa2%2FALUXN0Btm1x3vg4QWFubeP0qCDQ1xP03cHCC4O8am80ekeiqH%2FiKGXhfFOGhWoF44NpIj0Lye5hsOXSv93GN26Rez8bFcAG%2FtRN6yJ1Y8DJcGihnXEcFaUxEub9%2BKDew%3D%3D\"}]}\r\ncf-ray: a393c1cfc8ac0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 34286\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34286,"size_decoded":35229,"mime_type":"image/png","magic":"PNG image data, 1132 x 200, 8-bit/color RGBA, non-interlaced","md5":"4766809e9320224bba198204e8556571","sha1":"9adc9796b36beb07f2b1838d32347953e8c7df04","sha256":"485c17e06bf62671a2754f4f974e27f28d65d2d252e86643eb587c71dd231d6a","sha512":"198b6a5ecd0c395847d847e9e5ad8fc6d6d5f073c3fe7548ad197107a2cd94571640dfdd5896d49c786f8eefab2067d5d4736d649bd307f87a119ecc98c0fd43","ssdeep":"768:17KK9eLinZQ+2pbEXYtq1YFslytgQv80j17ZErLeYmNQg:17KzH+2pbEXYU1eslytgo80j17ZEfZmH","tlshash":"a2f27a77d6f02d1fcd78122618ee0b9080627b8954bc2be17dd1bce25bbd9c9a16c309","first_seen":"2026-09-11T03:40:22.223528Z","last_seen":"2026-09-11T03:59:44.753877Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/first-bg-mobile-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.469Z","timestamp":1789099138469,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /first-bg-mobile-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-123ff\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=33e2hkriRE0q5w%2Bmq2tnOe9AS4dXsNQvy%2FvZn%2FcIyv1zxKjXFevuooaOows9p6zClP%2Bi6UWNZMF2KTxDB9tKNLXxpr44kpaMUEX3a8dz9fAEEcIJvtLta22uOrefKYEWTygMlg%3D%3D\"}]}\r\ncf-ray: a393c1cf687d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 74751\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74751,"size_decoded":75693,"mime_type":"image/png","magic":"PNG image data, 750 x 602, 8-bit colormap, non-interlaced","md5":"e895294cd6959832f55ad0900d75a0dc","sha1":"c963d1f1a9bc24c73a12695444f98fbe50109b9b","sha256":"340a334a2b2e781d60a659b88ab98e15505a52052ca08db2118c95c4fd5fc079","sha512":"793106047432b3db37a489a767e6b75074908d4027709e2d7fac1030af619fdd387401968735e6761a1d98191cd1cab8b0b13211aa0579c0e1967b64b4af6d3f","ssdeep":"1536:HufIB6mygnWRGsMQrgyKEAf7BYh3e1ZZBhS0nDdyD9v+HLmyT:Hufx+WREhyKEAfhZBk0nDK9v+rmyT","tlshash":"917302f14e16fe9f7b49ad51dc0c70c2e47fb608e512313f948ce946bc5a962bc02a99","first_seen":"2026-09-11T03:40:22.276788Z","last_seen":"2026-09-11T03:59:44.763596Z","times_seen":5,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/blue-star.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.480Z","timestamp":1789099138480,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /blue-star.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-4595\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ueH8%2FH2iCbKStnHC6XVLDEHJlp2G2bPA2gxleitrcLP7mt6jD6lt%2Fju7UM2eihtnCfWG9%2BaY8Hlibmfk0jwOzQ26wD4AdIwRPnfb2OCduVJz5uK02HvcWOxo8vyby6dD5g5%2FzA%3D%3D\"}]}\r\ncf-ray: a393c1cf88890883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17813\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17813,"size_decoded":18754,"mime_type":"image/png","magic":"PNG image data, 128 x 123, 8-bit/color RGBA, non-interlaced","md5":"99fe753805dd09bbcb5f63ac2c796a0d","sha1":"8d435091be936b5b6f0640d2ecaaf07ba37f2b69","sha256":"49cd9d2ce3fa7e5a8c8ddd99cf0f6f7bb8359d4456cc75176af1558f805f86c7","sha512":"c2cd6863fc058971d757fec8dff15d76ceb69a37255b7762cfb8d845638f8f16dc982fc14804c569f0bb7a1b7b5e65dc6ad909bd779a3b861e6b38f3191b16b3","ssdeep":"384:1l7mKQVZFlzMDPnFpUPp85zZM5VAtlpDkgUBuOZwuFG:yzZ5MDfgqzZkWtl7UJFG","tlshash":"ba82d05c7898fe05fdd81d01b09026aeb3af872f430a9581586e41d78364fcbb592dd5","first_seen":"2026-09-11T03:40:22.363338Z","last_seen":"2026-09-11T03:59:44.76423Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/hashed.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.520Z","timestamp":1789099138520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /hashed.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-74f6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LFDY0JNd75KL85HG6kzjCnemOhzs%2BIVLkvmY4tUBgTq5fkkok5n%2F61Ttzpbvhf8SaFR6rchgW8U6Knxhb3SodtFrXHMAEjRRGztu9djQbN3wdS1AkdF7ag%2BY7YnZKFLwNZt4OA%3D%3D\"}]}\r\ncf-ray: a393c1cfc8aa0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 29942\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29942,"size_decoded":30881,"mime_type":"image/png","magic":"PNG image data, 520 x 200, 8-bit/color RGBA, non-interlaced","md5":"4572c633e05f5dd459a1602998d608b7","sha1":"49bf7cf3801d3a4671606d77e3826f89f3c84793","sha256":"51cf621c07c6382ce374858398806532ea00e456d9c45197597164b79a9aa171","sha512":"a3ee1a43e6a7cdf615531adb76dae84f2884ea5baa754e9d7da8c8b7f1caa70558f4da4a3a07a7648624040159fb5d54020016334e0e6e1199b2cd019293e4a6","ssdeep":"768:LLkoByMH8TpBs9Oiz+xYxt5FQqrSdaASuAfXMW4XEW:Fyw8dB6Tz+xYx9mQLuA0zP","tlshash":"a3d2e0b38d5d722f19bc4fba0a4fa10488ca40a46d5ed5623e84b4582dfed2db1e7701","first_seen":"2026-09-11T03:40:22.205928Z","last_seen":"2026-09-11T03:59:44.764833Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/top-px.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.093Z","timestamp":1789099142093,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/top-px.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 2256\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-8d0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t3aaxOMTMg6wEoTjYG8SJmAvn4Mlk%2F8TdVLFukHTqi3ctFweBBp5o4GmZ2%2FsGkrD1AmGEZ6x8zI0JRn%2FJuJtQbBilN%2Bu7OHuhm1UR4LxGM7%2BJAm7Mne8bbwwojv8mASn\"}]}\r\ncf-ray: a393c1e61cea0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2256,"size_decoded":3019,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"e2462283041e8bc6e2f16d89c57feee7","sha1":"2b109319129990f7eeeb4fb28e90f0e6d12097e7","sha256":"6e65f5abc57f513294a8f65ed0bee9f02ef334669f8429dc7e6b69a6158e080c","sha512":"8dd3ac3240c818255de95120a0ad332d27d3d92489cd8798a1bcf36d3b55557601357e171a9f3765f0585d7a3d057c534aa5fc37e89ee5f53a5d3e9e2decc1cb","ssdeep":"","tlshash":"51414be344c93e7a4af08b0e220374fe38f4a4ac11a1b41d3abc8489d77d960045aae8","first_seen":"2026-09-11T03:40:22.193062Z","last_seen":"2026-09-11T03:59:44.765583Z","times_seen":5,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/first-screen-bg-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.470Z","timestamp":1789099138470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /first-screen-bg-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-3c170\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BMbW7Q10Z%2FpYDpZzcq7S3gtdfZd%2B70Yp2YOL2tmqdom46qnqUMXrt2yiX8%2FaDsV4fIYC%2FXsZqdjxK1dpsJw%2F1OvnEp2TL%2BUUvuCcrUpXKjXpMlS91xXUvHbfaGdCxTfEsWrKpw%3D%3D\"}]}\r\ncf-ray: a393c1cf787e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 246128\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":246128,"size_decoded":247075,"mime_type":"image/png","magic":"PNG image data, 3840 x 1840, 8-bit colormap, non-interlaced","md5":"c7677938295bf8f1cdee75d9c85c7b95","sha1":"0fb51b18c7d3cef78fa1c7a103237754e2252eb8","sha256":"26124a4eef8f1e292ca3abe1792627adc7535bc50ea8e977dffa05658c740c20","sha512":"908c4a6ae0863aeffade80f6bcfae36ba89c2a8b0c339c1a14e27cf32934c6cb021df275cf8037aa938225fe2227c7c35761fb88ad114af1ceffdd0030f2a472","ssdeep":"6144:wcwiAjReW+x+d4fwr+rzW+moC0CNCbKFfXuYli1vpw:3wiAVAxy4fwrszW/50uCEfXuYli3w","tlshash":"ce34124118256e95fb68c3328afe977aff14fec9a1495fa14220c5ac5ee32e0f318517","first_seen":"2026-09-11T03:40:22.200793Z","last_seen":"2026-09-11T03:59:44.766459Z","times_seen":5,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/right-px.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.517Z","timestamp":1789099138517,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /right-px.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-1d8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vmLzEaNQeVoHWXtN7LGmlBnhAPIBUL6P7J4oy1HtDc6SHZh6rFZ5b474lV1n9SXiuU1MyXGH4dqgxvFn5Hjr6y511ZAdCAiwEx5rHIA%2BOOwU9XEd0vVjsRreUOqmbyc583iEgw%3D%3D\"}]}\r\ncf-ray: a393c1cfc8a70883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 472\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":472,"size_decoded":1404,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"84014386827a77f90599fdea0cb51c6f","sha1":"b51983a14cd6b310ecf43e480e53b2ee7dbec583","sha256":"619cfedb7b0020f182ae792f2922eaa226659f0efb598cf6dee47ecd68bb0386","sha512":"b52e86e67b1650bcd9f2469698ac6bee733b6271c398f7195f28e67a6a21196b2746eee5a7f3512128bfb405cf26df209fb434897f324435bbf6c60a496abd81","ssdeep":"","tlshash":"0af097d3ab220c14ef8e1a26b22ac4f2617f40f90722a90890d9832439252dd1ed2d8b","first_seen":"2026-09-11T03:40:22.175308Z","last_seen":"2026-09-11T03:59:44.767307Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:01.870Z","timestamp":1789099141870,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Inter:wght@100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 11 Sep 2026 03:59:01 GMT\r\ndate: Fri, 11 Sep 2026 03:59:01 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2555,"size_decoded":1313,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3fcf63d91b46adf99bd3db1a56530254","sha1":"62f7d93d0b191e1e8464958268f225f51dd1752d","sha256":"63867a7c4bb197935b85ada1c4bcbc95951598dfb736b24132f0a43e5e5e365c","sha512":"16d25c5cc841006ca8e86ef334efb051054257e6990275a3a0d1e25f9adc6c665b65ff9083dfc9c409d84b69365a26eb9ba875431ca75765743b70902e684d14","ssdeep":"","tlshash":"0451ab92002ba404ab931dc233cf7f3aaece50856085d2b96ffd1dc65cead66436875d","first_seen":"2025-09-10T17:57:06.167004Z","last_seen":"2026-10-05T14:44:47.446006Z","times_seen":31452,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":0,"dns":4,"connect":15,"send":0,"wait":34,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/newStep2-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.494Z","timestamp":1789099138494,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /newStep2-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-d958\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y8Br1AM%2FmXYnLT7BvO57Fq1Wn%2B1iyHfSbc6j7GP8KmiqLCsiAQCzTBTtqCdcsw9ZlmtX3pg6lvgkXqLgYAw%2Bkb4daJXfNunAB3Gr3UTV4uJBa9dLsyUepG9PzLouuKaP28QWvA%3D%3D\"}]}\r\ncf-ray: a393c1cf98940883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 55640\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":55640,"size_decoded":56579,"mime_type":"image/png","magic":"PNG image data, 720 x 600, 8-bit colormap, non-interlaced","md5":"0367a3c4face7138062ffec6d3afddff","sha1":"793d2b3e543d7333003bda0b12efd89f89fe5dc6","sha256":"d3c0b1acb20a74c9d60fd348460ebcb6b50db98ab321044c93a2de092602dbfb","sha512":"1b0616009969dca9521f2288eb6d72fcf2d4f1789398fdd2ebdcceec0084dfd6b0d49d92599c378ea741188360fd883bbd9f37bfcbf1c7cf10fea62db3ce00dc","ssdeep":"1536:TYh+mpOymI3COJLqMdt9i5mBBb82HzN9+3UkmlAe2v:TW+cOwLHdtk5mTb82HRVBlI","tlshash":"36430270d8d9bd15cea9b3ebd4854d3fc8372e046b4eea4f9a0c8d540a7e2581c570b2","first_seen":"2026-09-11T03:40:22.191313Z","last_seen":"2026-09-11T03:59:44.768511Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Alexandria-SemiBold-k3kUd_op.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.110Z","timestamp":1789099142110,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Alexandria-SemiBold-k3kUd_op.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 172908\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-2a36c\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5JG9a2IvBbvB53%2Bl5SCJK4pmr1ETVYsyhtcaD%2FWHnoWpabINvyMjij4DHCUdOcPg2FbmGJyamDHaXVeoMalgE%2BfaolEDGV6udM0jvfOOJvXmRWGzvf6kPws0luTt65cc\"}]}\r\ncf-ray: a393c1e62d0b0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":172908,"size_decoded":173686,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 26 names, Microsoft, language 0x409","md5":"683ba8d05812abf28b2e8b15044723f0","sha1":"89dd4a8e45169c3e5a70782c766476ef9c354309","sha256":"defd9cfba928be83b70b7fa7c9e961c9b9d78fbb78c7fdc1f24e00879b1f3de5","sha512":"89883f0feb3f523f262fd3c20b89c74e46de8055aadedccb14d3e7fedf74a5c029ac151e0e2104646e925ba64e23d0adda0a0ecf7cbf062681df7b8140201182","ssdeep":"3072:KnAn93HLSfdj6o0/vdwOUPaaSLASL9xho/lsk6BajBTd:KnIZuU/uOUPaaSXL9/dBajBTd","tlshash":"02f35c03e623d78ddf410e74a634930a7731fe64bf2aa25bf9497ab8e08b5b1585025c","first_seen":"2026-09-11T03:40:22.232558Z","last_seen":"2026-09-11T03:59:44.769174Z","times_seen":5,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/dewhales.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.525Z","timestamp":1789099138525,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /dewhales.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-5fe8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CJyQDhrFBI2mBw6Xzjiuqs8yTGsmJMbYYkomATlCBS9DwSAS8Is891UBXLktyWZrpdt5gFdCSWsjT%2BIhTrqNpzjjtaGOPJPVHumo1ooEsjqPIEgKBF5D1hNa0bNVnn%2BfZt9%2BWw%3D%3D\"}]}\r\ncf-ray: a393c1cfc8ad0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24552\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24552,"size_decoded":25491,"mime_type":"image/png","magic":"PNG image data, 476 x 200, 8-bit/color RGBA, non-interlaced","md5":"63445fa8d182c03753f902a3deba35b7","sha1":"f2688f93d9ff9f34cf293740cf995fb5d590dd5c","sha256":"35aa8b9fc0ef3e1a5bcff51bd6cc2f07c5fb00a52aee2593cc0006a6f1556a2e","sha512":"769e0d2872b41ec9f0ddd8d78fd0e8da2cf226bc3ea6011014a077cd38dfbef3a2457839d0023c75d84ddba97263dc14f5326f86f896399541aef74b5c45ddb7","ssdeep":"384:77D7grTSrVUuSm5hFDoXI6jv/KayAHg71pmgzJ5QwF5LyqqRu/0oRwdHRwHlFF:7/70+rWuB5hF0PT/KayvT3952Ru8cwdK","tlshash":"8fb2d0b8068f6a5776be8e21e9ff414e4c3ef544c080790b4d46527061a68f87acebd1","first_seen":"2026-09-11T03:40:22.29397Z","last_seen":"2026-09-11T03:59:44.769717Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/secureproxy?u=%2Fipfs%2FrCiTGD-ycOxDmeVN3kx1wg30cf386fa4474b2ad5f12d84dbac716b%3Ft%3D1789099141986","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:01.988Z","timestamp":1789099141988,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /secureproxy?u=%2Fipfs%2FrCiTGD-ycOxDmeVN3kx1wg30cf386fa4474b2ad5f12d84dbac716b%3Ft%3D1789099141986 HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 5966375\r\ncdn-requestcountrycode: NL\r\ncache-control: no-store, no-cache\r\netag: W/\"89844-Vi9z8HkcS/AhqJmV0oNtTeIvTQs\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=zLchlrgbNz_OanjbEVB9lA.js\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/11/2026 03:59:02\r\ncdn-edgestorageid: 1332\r\ncdn-requestid: aac34d2268b4a08c3d0768a7dd2f0cb8\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZMawywoBFExCaI96STYU1j7oWil3lByhQSwi5xR5GRcKChs17u%2F34P5RwGcp88VryBOE%2FMwR0l8P%2Beax4JzSTEOqJAyBgsRAmm2jPd442xLJz5xAgnjPYCLwGLgPotzKJrCkVA%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a393c1e56a3a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":563268,"size_decoded":152027,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a29b840e5a9b7ef0e51ae009c6715480","sha1":"562f73f0791c4bf021a89995d2836d4de22f4d0b","sha256":"f59225c073e1a044e9316d8590729de752849393be505d460b0fd4b6e2de6545","sha512":"fef561e435cced1a27c81ec8119410b0dc51631f5d2d41017dfb5caefefde86b786c40f6872e4d0360592219b169cb529cb91a40ec41db804412c83df7d17e87","ssdeep":"6144:gn0n1c1gLP0DYh5gDgu2n4f/zrYmCdeTTliwzZeURKw:P1c1g7cYsVYmCdefZKw","tlshash":"fac4bdc4873b69f6d2cd26b62663716fcf8c1f04238f587862c21dc3a654b1296e653e","first_seen":"2026-09-11T03:59:44.770235Z","last_seen":"2026-09-11T03:59:44.770235Z","times_seen":1,"resource_available":true,"data":null}},"time_used":743,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":645,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/veHAEDAL-bg-zip2.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.090Z","timestamp":1789099142090,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/veHAEDAL-bg-zip2.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 823089\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-c8f31\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1StmxmRd5eM2B3HVGwSb4tv19yYeEo2P5ckxlwxN8ulloByd6abbltsOYCdssPmBtyWRnaXER3doPhJn8LGtuf0OZN3g992X%2FPuSQZ2BomuV9ddzCILrGPFdrv56sH5V\"}]}\r\ncf-ray: a393c1e61ce40daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":823089,"size_decoded":823848,"mime_type":"image/png","magic":"PNG image data, 2880 x 2846, 8-bit colormap, non-interlaced","md5":"187dc0002ff667060ce77d2fd1539b4a","sha1":"c072d96ded09097fce1b8b261cc744c92d3f940b","sha256":"e48246bae301135a80a3e6670bad34a6230c976712903444b8af8190efe03bb5","sha512":"7e18fa52eb7d57ff83c9e00241df67367c672998c2992655dc0e34f87475971e614b72c135c12e1041ba8cb237cb6fb3b687ac33a8f607662d14237561b6e932","ssdeep":"24576:fjiI90u70eh1rjLKpcuy8zQwaTseuFvPu:uI2c0eh1rnv8HaoeJ","tlshash":"800533d53d20f90eb07990a7bb5490cb7dad26f8a2d837437656eb4bd46f48260833e1","first_seen":"2026-09-11T03:40:22.18951Z","last_seen":"2026-09-11T03:59:44.771113Z","times_seen":5,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold3.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.477Z","timestamp":1789099138477,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold3.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-a99b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KLYM16gjLuVgWCMPAE%2FFaNzfWc6tTYnyRD%2BePysTOZkFbKwuQKhP7GwLt9APvou0INb6Ne3lRrRwBbLlz7hstYbFTehh6zGR1LwNDCcyzBEy1P7YjIeY9ZzZjIyDJ9oYGzVvdQ%3D%3D\"}]}\r\ncf-ray: a393c1cf78850883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 43419\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43419,"size_decoded":44356,"mime_type":"image/png","magic":"PNG image data, 271 x 261, 8-bit/color RGBA, non-interlaced","md5":"6913cfb8ae607b2414919c50589e3ba3","sha1":"b65efeffe17d47e3701863c9f5a314c1de50efa2","sha256":"0b98a8b148adbd78f6e7afa5e1087cbd09beeef63ca7666be65fca47b2b43195","sha512":"8770a8d430093c6fbbe5aecf9af23a5f4ae713626378a0d714004f04166816a2acc1e13e22246de519efd32325053698172e0d5db25d2ce4fc95f85a945728c4","ssdeep":"768:XTJG8LhpDrbRO8afg4IovG+QQZ7rZNdoxy51QBDM2cWKEVLbPpH+LL:dG8Lzc8afg56fZNwy5WG2c8l+LL","tlshash":"8d13020a8dcd4057229f3e370f00fb1d16cba2a4b56a77ba4bca7459433155ab943bca","first_seen":"2026-09-11T03:40:22.195096Z","last_seen":"2026-09-11T03:59:44.771677Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/new-note2.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.488Z","timestamp":1789099138488,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /new-note2.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-793\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ytk%2F6vrKRcKhjtLNTfWoAOjqi8tyop5Q1W3FIBIxIzAwZzSW14359GwjDso9X56utTnY2syof9ez6K19KkLu853y8jxFSXt7JMCrV3gi97IbjjDtWs0uqPux8xwxJBzbgje%2Bhw%3D%3D\"}]}\r\ncf-ray: a393c1cf888f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1939\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1939,"size_decoded":2874,"mime_type":"image/png","magic":"PNG image data, 48 x 61, 8-bit/color RGBA, non-interlaced","md5":"9adfb1b969fafbc47386072b01748c44","sha1":"0b7ed0f709a677eb1c98e402372b4b03785e6867","sha256":"1c8635f9291fc5a7da4f86b03e577d93e42e19e0ee7c31f9e98a3de18c8d1984","sha512":"419a84835da4b9d302a62b008047ee3a8e0243817fddbfa7fe46fd251d0cc226c403948451fb3448a8fb7735dadce75b0e58ecc5895289f0e66b5b031b315c67","ssdeep":"","tlshash":"8c41f9a9b794ce22ab452052d8f371ce607de0290527eb8d0d061f767f9ec5b0e9d389","first_seen":"2026-09-11T03:40:22.248331Z","last_seen":"2026-09-11T03:59:44.772192Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold8.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.491Z","timestamp":1789099138491,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold8.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-2efd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0rcS9rHsmF5qXFHdeItL2vx663gstdc59PcemJn2YU0yWoCeni5lLG6CEmlEWxc5B1H2WbaDaslto%2FemP9J8%2F1kRjFv2ILh5oKN%2BErchUZ%2FVxHGLh03vFz%2BL6DcdQHfaB6C7VA%3D%3D\"}]}\r\ncf-ray: a393c1cf98910883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12029\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12029,"size_decoded":12972,"mime_type":"image/png","magic":"PNG image data, 199 x 66, 8-bit/color RGBA, non-interlaced","md5":"d0d6197a4e995945990cdb206e3c1eaf","sha1":"4f4534332c213946e600ff7295237754d8df868d","sha256":"780b7b8a224ac8d61924d5d8f879bdddbc49aa2f63cd54d5a80c2e8a562af51e","sha512":"4d63086b010840a8901510a4ac054428259b1860fe798c28dded283a80c38cf86b1f41eadb2c9635ea87a96edb30a0392b0c0066301623f22e2bebe2ffd39ecb","ssdeep":"192:MzDYbQaxYDR9Aq2u0f8CFLgp5CO6h7okbQPX4w+GBBxyr0oW8c1REE7eJvM0rSRL:mljATXfdLPfh0rbz8O8cE8eJU0+MHa","tlshash":"c842bf79b10bfa082a23002f1783a9b8f6dfd569171f047d60b6ed9ca59981f096d068","first_seen":"2026-09-11T03:40:22.230148Z","last_seen":"2026-09-11T03:59:44.772758Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/flash.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.473Z","timestamp":1789099138473,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /flash.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-702\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=75Us79h1Kpuxm%2F47DvSGeGgfRT4RFFfMbZMarByu8RSpAr6pTPdkxDZ1Y9xpWth2aRimH9IcHHUb0TIsx2j6o%2FB5K%2B0HPRI0UesYtIuo3uREojeuU%2BB%2FTKdRbWCFZFnplSBq1A%3D%3D\"}]}\r\ncf-ray: a393c1cf78820883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1794\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1794,"size_decoded":2735,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"0a7577ffd3da0262233201488b04733c","sha1":"aef391a0f7a88734b37d5dedbb7fe5065af2dcf6","sha256":"a888762b4d4a3df7f0a91668054a46ede1bf3e7fbe2869213f885820bbf355eb","sha512":"aabea8601634d6f497620fdfbddaf893b52ca813669386c6dbdf53b34f12e722305899eca46f8e616c23cc42d0a582ebd2404de2f2a921c19775b9bc9453a336","ssdeep":"","tlshash":"34310bcb781fb868a18374c671181115af337ae54d34719c99c1a529b3b5b032f5fed2","first_seen":"2026-09-11T03:40:22.234877Z","last_seen":"2026-09-11T03:59:44.773351Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/okx.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.522Z","timestamp":1789099138522,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /okx.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-326d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xrikcu1jT1UlJM3ou%2BPGUGn4ABiYKP0vrox3xD89ct4HvB4O1nHQOR%2F4Dn3fxJjgeSjGXuuuGAzeTYTGVTGDragBYtyvLcxwYFenud2EL0vf6gYlKudodp1wBLSE6ooVCkTqjg%3D%3D\"}]}\r\ncf-ray: a393c1cfc8ab0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12909\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12909,"size_decoded":13846,"mime_type":"image/png","magic":"PNG image data, 328 x 200, 8-bit/color RGBA, non-interlaced","md5":"68aa91e9cfcf533a0cf5a8d4c6d9f0c1","sha1":"b5b901e727cad3ebf59179decb58d0f1cc1a5421","sha256":"3d826d1bbfe495320256b8870ba3bb8cbeb5b3f9fe9cd93485fbbb2fffc54ae7","sha512":"238733e14f7c9527827d7f7a6628864ad90eaf4941294be7406a39d5f7faa3f17e26100991354cb9b8b599a32b81438968376a70fca649e5e59ad047af6c9517","ssdeep":"384:nFIsCcIQMxH45Z+rtxkx6j3vc6ckfhdX6DlV:n4bQMxoZ6ksTc67EV","tlshash":"d942beae7e9e126a1dc10f7c6ef8e6b348727615c734027c5f008e067d78708a968da2","first_seen":"2026-09-11T03:40:22.304867Z","last_seen":"2026-09-11T03:59:44.773856Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold9.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.490Z","timestamp":1789099138490,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold9.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-2f6d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oAxSU3JQwSxFWQM3ZMTVJgZyNnf9LJK2wSEtGfKwb7YWh58LIBCXmjvYZe5NDNXC5uEMjf38ILG8MGZVWPI8ByNemhI%2FduYpcb1cWvcx1eblOq%2Biln4GCYJHS22cbSN5Fd%2FJbQ%3D%3D\"}]}\r\ncf-ray: a393c1cf98920883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12141\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12141,"size_decoded":13080,"mime_type":"image/png","magic":"PNG image data, 99 x 189, 8-bit/color RGBA, non-interlaced","md5":"f461a3e703a2dc656cae98496a3cd317","sha1":"7586466249922fd4a9aaf8822002ad48eaee8b8e","sha256":"5a512114985ad922ba3f62bedb52b07e7fbfa2227f3b6f0f71aae0bcb7dff5fc","sha512":"e2bf4b8100a8dfb5ad05365c7a7256c887070805990c2c1b744eb705aafd207c31c3cc580a073fb73d6a4adbf828e1b5c3caa5f6a6a9c8aa588a55695aafbf9f","ssdeep":"192:och93FKJvkUjGsnnScJsCWedvLfPpnf9/NGgY7BukLHudmSDeMlaomKpQPEP/SBB:o2FKJkUSoNWw3/NrcPicSDeYao0MyBB","tlshash":"2f42c0334cc646245ff719b31bdc7a6b9a426748340211f69ae35510df1d38a2dacb1f","first_seen":"2026-09-11T03:40:22.166288Z","last_seen":"2026-09-11T03:59:44.774362Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/cetus.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.527Z","timestamp":1789099138527,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /cetus.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-3ec0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d8bVfekZZxjSfXEoV4SbCcvDSUl%2F8uPlOXKcWP2SgjvuebA1buYefJIgDlzw0qhLhKv2fgA%2FNsA68c%2BxH6%2FCT77zOhzDyC1dGIN3r%2F8K%2BZ%2BocWsiHljtWNCbXnWf%2BbptHarN0Q%3D%3D\"}]}\r\ncf-ray: a393c1cfc8af0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16064\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16064,"size_decoded":17013,"mime_type":"image/png","magic":"PNG image data, 560 x 200, 8-bit/color RGBA, non-interlaced","md5":"09cb964c6ae2e469d2fa0f4218ba3447","sha1":"db5bb4ae1aa8734fed1d7344f6100276950afd20","sha256":"df9e2f09a40e1a6e55ee5fb8a1cea44a18e4602a26d044ad80403ac775536d6a","sha512":"cf648b20a3e1397a748d2ebd5c1a2e18f8d573d4f8420b342109cb09f2d75c75036bb3b94033fad073bc6ecf25d6b9cacb88fd1d8f561748c1b666e1d7fa44d2","ssdeep":"384:cM/434kUKiHdzfCj+l29BdOkmh+IJsAumgiXpO:fARUddu229BdODhsAumXXU","tlshash":"4c729d5d8d66201fdab10b52a087fc0167465d88cbde8a27d6a320797bd03731f279de","first_seen":"2026-09-11T03:40:22.261333Z","last_seen":"2026-09-11T03:59:44.774851Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/index_1.html","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.053Z","timestamp":1789099142053,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sDe6jJJQ8PvMpsbD2ttjbmImm0RDzpgGD444Uf9dOP%2BvuUXhN%2F1oMTajQ8%2F7BScK%2BOXI%2FTaDHnOeMR6vzKvhXX91FIkzOtn0xX1h6TwRNWKFWkWJW7cEi3MXpmL2YfkeXh94Kw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a393c1e5da420883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":147,"size_decoded":995,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"1b89189e4dfeef4668d8e26260d69b15","sha1":"3a6f954572d65788041fdb2aface23a071b2915b","sha256":"e11f9db354e4478cfccefecf9655738aebb33c82c58bc3cbcaca2721985c9523","sha512":"2fd60196c45b0afc1cdae1a7da805d958e526134959f0ceb087622b600b99fedde755e69f9d25c89b771601c66ec0352ea5aab302bb8c0818716b45b820aac3c","ssdeep":"","tlshash":"13c02b22dc04484f3d005fd1cb8bf0c5c002dd3cec315c00b856b544e9ac231c012549","first_seen":"2024-12-19T00:00:05.397279Z","last_seen":"2026-09-29T06:04:39.345709Z","times_seen":112,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/LST-bg-zip2.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.088Z","timestamp":1789099142088,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/LST-bg-zip2.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 649189\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-9e7e5\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5FZBpQ%2BCpf4v07xqcPo0Jm4zig297ik6QH7WnulZLatHiRcUh3fzndWCC8eIu3wm0HcVfuUKCdl2ztevuIFQz%2BxrRx49gA3yr8xKfyFXyamDqrn%2F%2BjiJnaaK4KHJ%2Fjfl\"}]}\r\ncf-ray: a393c1e60cde0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":649189,"size_decoded":649956,"mime_type":"image/png","magic":"PNG image data, 2880 x 2475, 8-bit colormap, non-interlaced","md5":"9f402049d7f94786e1d63e3728802004","sha1":"d5999458387119414c8284c645f0f2f4b19915ed","sha256":"ac144df494b5984c5955651085b632c5ba6db0a2426f7738c3529c339a33d17f","sha512":"8073dec4cb606cd53ff2c83bc84024f3624d6992031147028aac07c3a151d261f7ca3632deed80ed2c831a9aa851dd7dba02934d08d365ea3809fce837171223","ssdeep":"12288:2luVc/xcbsoJeEHLz+Oa3GmKa+4r3BJT3jVGD7ICo+qgKD:lQoJMOHuLBt3Xr+DKD","tlshash":"b4d423b1a518de3648e3a03733858f615a709cef5783f769a33e4226f425bd046c4be9","first_seen":"2026-09-11T03:40:22.270926Z","last_seen":"2026-09-11T03:59:44.775861Z","times_seen":5,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Kanit-SemiBold-BzKf-rFX.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.106Z","timestamp":1789099142106,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Kanit-SemiBold-BzKf-rFX.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 171548\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-29e1c\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C2VFhpn%2Bk%2BzCgb6%2BvVXlEpepjNTA9h61Zm1pT5dtwAkVZX2LJytrco1Wws9EwEd3nTW3lD5CbYCx%2FTNL6TOBjWJ2nCOMmn%2FGzPvBdixpfNgmbod2ilF6VltRWCzKaMTs\"}]}\r\ncf-ray: a393c1e62d040daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171548,"size_decoded":172330,"mime_type":"application/octet-stream","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 15 names, Microsoft, language 0x409","md5":"b116fde15528c69c1a0a698e82c32657","sha1":"79705a7be8a3c0541c270b0aabcc35b822f5dd90","sha256":"0a2c1d48f57f387e42d24d9cf963d973cb71b3bd48fff9daa524d01606c8d6a8","sha512":"0924b135f1883ee9e0ceee98e1b3da88118269e6be4571170f26307bd05a5a5102fb0a411094454f453940ca360abf4502e741cb13853a5076ba554a0bd540c0","ssdeep":"3072:+1jS05N5hQM+w3VihpWsYh4qVNbb2X7nmInMQnJv8i:+1p5N5hQM+i0pWsYh4qVNbbMnmInMYVD","tlshash":"5af34b47bb4ee789fe0b4d3c567ad72ea1a5f0741d43c3d6a09d2769ec8a0c41a283c5","first_seen":"2025-12-22T05:42:39.979541Z","last_seen":"2026-10-04T14:30:07.882758Z","times_seen":26,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/newStep1-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.497Z","timestamp":1789099138497,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /newStep1-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-c889\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DQ2pnWWmwvp5%2FwcPn%2BW9mtqO9rkDiJ5mjvDe2FOdlheDabrjruWxXgnOX2P8lokXKkGqH%2F%2BGyuo1Pepcsf%2BPrP0yPdw%2BlpmGrYXy2e78DbV%2BuPHbU0ekfyitS%2Bff3186FodM8Q%3D%3D\"}]}\r\ncf-ray: a393c1cf98970883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 51337\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51337,"size_decoded":52286,"mime_type":"image/png","magic":"PNG image data, 720 x 600, 8-bit colormap, non-interlaced","md5":"55890843b6cedee6aaca5d5b75a12058","sha1":"9baef9825aa0ea2d6ca1eef346f76be4442c3430","sha256":"028b5a738481fd0130381b935914882f79f9c8562da91dea9bc92a21ca3f157b","sha512":"019bfb4979ce00d8310fa44238347b0b55b525d9207eb6e77ef32b074a23a5a22300211bf81989fa55aed075b6d21ebf568b0eaf397d376cecda1e995b4cea18","ssdeep":"1536:ufAGpiiCf5akiuQmiAFc2carHv8eEsQCa:u+3kuQmXcqkeEsxa","tlshash":"983302da71b379329fc159ae6360929bfa87433312169ce81cfaeb5e3c443522c414bd","first_seen":"2026-09-11T03:40:22.184251Z","last_seen":"2026-09-11T03:59:44.777201Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/animca.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.524Z","timestamp":1789099138524,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /animca.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-69f3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pzOoXAWG3fpXSRJhrZt%2FZugu4Z8ic45IvIYT8vR%2BK4QDZ%2FpHtYCx5%2B0OoSL2UQ%2BsThbicS0PBWYimcDC5wsXHu2g5jzJjrVArl6EJiQzDI2PjWIv7q6j8MTwtT%2BjT8n8ApDU3g%3D%3D\"}]}\r\ncf-ray: a393c1cfc8ae0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 27123\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27123,"size_decoded":28068,"mime_type":"image/png","magic":"PNG image data, 368 x 200, 8-bit/color RGBA, non-interlaced","md5":"673c53f52b9c66eb35af30683d1fc99a","sha1":"032327a6f402a10def98adc99ef1360837a3d9f5","sha256":"12ba668a7d81d3178429a35aab94e0e1b8941b4a4fdacd1c13241657a6b0fbae","sha512":"ba7861ac14db027369562379d5c2f8bae7401a7d5169748b0f33f66b159b7a6d4309077ce7c0a52a10557687763e941335a93aa4326aaa71bab75b8f4464bf4f","ssdeep":"768:dk8T4TnuqiBGXLy4XckYQqbGu2QbyH8Daf6Q334L:d7kFi94XckYQqiuL0HfN4L","tlshash":"90c2e1e49452edd04cda70434beae03576331bfb64d8fc0466a8e46bda670267238f45","first_seen":"2026-09-11T03:40:22.322872Z","last_seen":"2026-09-11T03:59:44.778201Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/new-note3.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.489Z","timestamp":1789099138489,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /new-note3.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-a3f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fxaszVewT3ycXUFLTMXht8169lv7yvb7IvyY6xcd3NowI5eSNyM6R5x0VHzytmB0b7lz50sm1lEqcBmtmq3vbvOOneeoK2esW%2F7AMKFphsbneuyqJ9SpeWLJuYJrxgGY17qsjQ%3D%3D\"}]}\r\ncf-ray: a393c1cf88900883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2623\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2623,"size_decoded":3556,"mime_type":"image/png","magic":"PNG image data, 82 x 60, 8-bit/color RGBA, non-interlaced","md5":"9ceed84589ec99f936ca4bc64c4b479d","sha1":"ddd8a074210d70f7f4f65a0d1c5f5042fb9da27f","sha256":"1fdc32293b1405353b27283c86f63ca302779cb72b2aae0638b11c2ac97b10da","sha512":"ee05f559f2937a3418163f714c5903610dcf9d626bf6a0411c01ed86c2edc5f7032afd8a2705db5d8727e5c54bfb027a5744d1f1e8d73f2704c508dcb42f8bea","ssdeep":"","tlshash":"60516d8912c493e6ad00903281e82429e92d51f92f857a5f38d89ee7b737aa781c104d","first_seen":"2026-09-11T03:40:22.350436Z","last_seen":"2026-09-11T03:59:44.778745Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/dex-all.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.519Z","timestamp":1789099138519,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /dex-all.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-20c0d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kxRYiwsoSE5y4lXcRrrVt5V3RKW1iNCGn%2FX4zQFif1WRT2zUOmC8%2BB2SAVi8cF44NHCc9jqGkNw6D4XiDS1AJYEjrQbMrU1tgM9Cf3Fqwc7z%2F76Vx6j7%2BOojQu57nB%2BraQNNKg%3D%3D\"}]}\r\ncf-ray: a393c1cfc8a80883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 134157\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":134157,"size_decoded":135102,"mime_type":"image/png","magic":"PNG image data, 6330 x 146, 8-bit colormap, non-interlaced","md5":"004132407002a7925b1587de47c8db25","sha1":"b1c2e1777ba1382388edd0cc91a36580beee4105","sha256":"c8fed2c4619efae68dcccf32af96923ffc7165f74aca34d46fe16f1aab485c60","sha512":"51753a530fc74fe9694adc8e6082b373ce2b913536e96acec27b8d5616553a52a6de1a490176d739fcadb0db3affe4198bea691441f9c6a36c63e43c77bd6573","ssdeep":"1536:2m+BRdu1IhFlUE7lg3qkVUeNnGSOFKItO/1MtC051bR5nKhO/2htOyBBbO4Emkjr:q3Ca6GSJIti1MtCC5nKi2vDRwCw1Rr","tlshash":"83d312127968e525dafbe0762078a6dd8bb0d51db07373c97ce01d141225c4fa523bbe","first_seen":"2026-09-11T03:40:22.148082Z","last_seen":"2026-09-11T03:59:44.779254Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Outfit-VariableFont_wght-B6lQlNBM.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.001Z","timestamp":1789099142001,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Outfit-VariableFont_wght-B6lQlNBM.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 110572\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-1afec\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PQh96sjGfEf%2BrRSLAsVK4xg7zCu0CjLM8fbqltUi1UsK0nmpD9kTJEUZchK56WUNFYBr1pzUiVa%2BUyxj%2BzZuNCTv1Ud%2FT1%2BzGofDUsfcmsGdnaoxhJVLwSIWg1BOLIFO\"}]}\r\ncf-ray: a393c1e58c2e0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":110572,"size_decoded":111354,"mime_type":"application/octet-stream","magic":"TrueType Font data, 20 tables, 1st \"GDEF\", 27 names, Microsoft, language 0x409","md5":"503761edaa25a9d768001eb2ed165466","sha1":"b4f72c3724f761f1f4735a0b3e0645e68e8874c1","sha256":"bccf9dda25ddc7fb32217f386e07c72c699a902eed3abcf5665ce4377fdfa33b","sha512":"f37d2d3f379bda0645a31f87342892209ba14ca1e96a32f1b1967898a645f0b10d7301f146d15840f03b61fe1b41a2e742fa2a1c36f6322e0fac379cc3bfaf03","ssdeep":"3072:J3a9JgdM8TsS8Dz6XpkUAnM+hzYbrMdAO:t1Az5YHhO","tlshash":"31b33a93b353aacae01237f491d3de250633ba356a5583c77f936539ac837e48d27290","first_seen":"2025-11-10T21:04:26.988736Z","last_seen":"2026-10-12T07:12:45.282054Z","times_seen":50,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold4.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.478Z","timestamp":1789099138478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold4.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-2c42\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8iT9PNe%2BwAzrMm91ImphhxL%2FjKUnSqpUQUhJTfKlUEk4ASZeunpCf2VsYSFYM%2FxJ2TcpRHkWgUEpljm5L5xndPVkZhVcsUoz0dKzhfToiIXjOZIOOCdOKbOViHkXTRkxaLWC%2BQ%3D%3D\"}]}\r\ncf-ray: a393c1cf78860883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11330\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11330,"size_decoded":12271,"mime_type":"image/png","magic":"PNG image data, 76 x 120, 8-bit/color RGBA, non-interlaced","md5":"a170ad8297c9ba9497ca894090c72bbf","sha1":"ea267b9ebb774ad8427cdf1a04b98d76d94bea51","sha256":"9f64dc7417e6d03d58ecf6bfd4962dda19df5f6775a1bcd914a58a66bc054a01","sha512":"ef09786af24f18dd932a5cfaab8a1f277f5ac880337877e4cd03a8e740f2652203271d47e1cbca03bff02c621baffefd821dff5bb6106b26d9a3db293c5fb51b","ssdeep":"192:/pxDchSTo0temuiI4Lh9Id8HTLtvdpGqZC0rsCtRviI3WX66270AJh+eD+:/pChSTLekRHTLtvdpIyt/+N","tlshash":"fa32bed256ad4c61ef171aa8bfdc7a1db1bc1c880403f7d8d8e2665f7882485eb841c0","first_seen":"2026-09-11T03:40:22.172535Z","last_seen":"2026-09-11T03:59:44.780277Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold5.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.479Z","timestamp":1789099138479,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold5.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-6bb4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I9dVbNbhKhxfsPJD06X3g2IyM33esvpjmXX8gp6w5WDxT6yL0VRriSWCGxWNrsJI9Xd59OuJHFVtzpRWlT%2FRO7xakGRrqIqGap8AhpXAGQUrj%2BpMLwT774bfWOf3fPqTKR3U%2Bw%3D%3D\"}]}\r\ncf-ray: a393c1cf78870883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 27572\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27572,"size_decoded":28511,"mime_type":"image/png","magic":"PNG image data, 241 x 193, 8-bit/color RGBA, non-interlaced","md5":"27b092aad3ec70853d2e7a084d2c8204","sha1":"6171ade1b26e103c82d78c315f69c66814465b1d","sha256":"6e45602f2ce30eacdfd6cf2662afd06d8d6f37ff7be66878061fc171a820a0b7","sha512":"cbf2c10881b0bc8a2552fbbe98c5fe24b9e231e10d5dcaf375df63cd770da9d1473f0d52f4fed26de7543670f4510f9d1e4efda00a1e24b269df980eccb5039e","ssdeep":"768:9FGFbgp9nc+dlbUJZ+Lpck42zC97po1gLdSpRJ:aFc6m++LpcR2zeo3RJ","tlshash":"37c2e19693ab9c910dbb9136bd136fdc0c5623d8edc2410f88c2f8d65a565c009e3c9d","first_seen":"2026-09-11T03:40:22.155388Z","last_seen":"2026-09-11T03:59:44.780771Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/swiper-text.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.091Z","timestamp":1789099142091,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/swiper-text.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/Home-T0Boy86z.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 328745\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-50429\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tCrp909CMLYmpEZZDD88WGZR58g1r7KigXuPudwqGSqboMSX8U76%2FSO7%2BW3OtS5aFZp79qE%2FSaFi6IYieAlwmrEguhRMKfCDjVV7G4aqhvn2jR7BTnU8k13jh%2F2rkQ4%2F\"}]}\r\ncf-ray: a393c1e61ce60daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":328745,"size_decoded":329512,"mime_type":"image/png","magic":"PNG image data, 866 x 1317, 8-bit/color RGBA, non-interlaced","md5":"953bf1b68051ce7662aa1a45af0c9b3c","sha1":"5eb300ca6932aa3495eb79bf8cf1a4406d82692b","sha256":"8a48a517b86879ea5689186724e8bcdb016360f5807d5b1d628fab957a262490","sha512":"38cbc1a69b4433ce2290ac37ec85ed3286ce1294c9d19b680068a665e3fb1a8e9feae23d4b0d2214340c8eea1f6fb43ee0051db54b568791f73ac2e97cf03b1c","ssdeep":"6144:ByK2If3SdMSULJ9oYRURFMOHYE91HovFvMArQDdL0bvWhKVcS:Bx2MiALPovP/HYA1HnhYqKVcS","tlshash":"e164e01390734ecea1a9e7405d2a776bd527c08bed3fb414c298d195fbc35ba8b26a10","first_seen":"2026-09-11T03:40:22.353991Z","last_seen":"2026-09-11T03:59:44.781274Z","times_seen":5,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/Token_WAL.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.499Z","timestamp":1789099138499,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /Token_WAL.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-26a3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2096ka538A0FNx3oRUpd7WnngiFmBmx5gb9VAuFsUI2b7%2Ff7LI1Nf2wLqyFj%2F5Ffd9VKxu28jfQEOi1%2BhE%2B9pHOSpwRek6Mu%2F0gPas6ZQ760hb4T1xTlHg%2Fu46hYJcN8o1%2Bx2w%3D%3D\"}]}\r\ncf-ray: a393c1cfa8990883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9891\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9891,"size_decoded":10837,"mime_type":"image/png","magic":"PNG image data, 240 x 160, 8-bit/color RGBA, non-interlaced","md5":"cffca50fd28c1a1af0b7d69ac3ffa32d","sha1":"20b51b4df64f3f41f2d8c4cf5bc39f5e02809284","sha256":"d07272be0d92cac8a2810a618d9fb2fc9153ab4ec727e2909cc1a11e0727a6df","sha512":"8798d65d2c0aaf08c12dc142cefe31c35145f1302ad55e62f6bfae568213a49b1291cc051b00ff227a9dc8ea513870c1ac493830d7ac9cfb2f41febcae9ab718","ssdeep":"192:Ao7UvT97UyWWaXgBranEjLkh3NJhRmoyjvku1taO53UzVmmsT:A6UvT9UWaXUja3NLgvjp1taw3U8msT","tlshash":"8412bf91ccd6cf788066ede01883a0e1ffba9dda5d27394470e053292a2cb920d59b55","first_seen":"2026-09-11T03:40:22.250084Z","last_seen":"2026-09-11T03:59:44.781752Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/LBTC.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.511Z","timestamp":1789099138511,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /LBTC.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-144ad\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vIaz5qomWSZ3j%2BTJ2xfiRAkqWwSl8YjZgpPLlB7fp5aN9rdLSJ2GS7j1hcSJZUgJ0MVXglfiQGfw6oVvSdWhOH424q%2Fg97KUpTqwgL2w3MW1OrufZUoGAyHSvANBrJKXUysI1w%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a20883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 83117\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":83117,"size_decoded":84055,"mime_type":"image/png","magic":"PNG image data, 560 x 560, 8-bit/color RGBA, non-interlaced","md5":"e328350b420846ed95e64117fc5d4633","sha1":"b116e4690cb90e7bf58ede542679bc1a33e08d2b","sha256":"3c5d7736fe0691b1bc5448aaad20e656229c6daa61447dc4a497b9527192d537","sha512":"dc87b154a6f0b858bc06935efe32373a85e125fbaa013ef95077a7bb81973094ea95147eb533857b62141d3420f4390c79751147b6f8b54b4c0f362550efc2e3","ssdeep":"1536:lcHaUPKc8UXjGnzfii4ruUrS2C3OQWoXbfUwQhPYVDrgE71q3ecQ:lc6xtmGzw5q+4cwaYVDcI1q3ej","tlshash":"9283129ae0d470d84f7465bc23f290bbd758217e98d88e553f23e6c85a20b5b38db8c5","first_seen":"2025-09-04T10:33:57.520345Z","last_seen":"2026-09-11T03:59:44.782287Z","times_seen":9,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/comma3.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.521Z","timestamp":1789099138521,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /comma3.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-79c5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NzEWoyJqcf%2BXKzwNkFC%2B5j29hiN5lWrs8DKFNeffEyXwwIA9CQ1jaY0ySHfLgsB1%2FKEUAIqZliqTkIYfvGuZg3Q6Qteag0ObMlQm%2FtNgGYoxZVk1DTv0q6elFEJ8njjrsZLzMQ%3D%3D\"}]}\r\ncf-ray: a393c1cfc8a90883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31173\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31173,"size_decoded":32114,"mime_type":"image/png","magic":"PNG image data, 598 x 200, 8-bit/color RGBA, non-interlaced","md5":"102ca8fd707c139bc1ac373b27d87b8f","sha1":"75abb183449223952fce7616264e9665961a13fb","sha256":"cd2f80912d32d0bcfbbb4e90300ae6ada296d711e445cb4795efefca08824d4a","sha512":"3b91e3e59f2d9f5068df999f85d97dc317db764fa8223f6d4aba94cd4af3b0b1e6acd1603dd53cbd515d740c49c2738a3160f4b45ff120a38fd9cad36107825c","ssdeep":"768:xwDw0ooKopJj8/3kORGHascBtOikXm9TKMsEIG0waAtr:8HBW39sHascDOik29GMTIG0PAtr","tlshash":"d5e2e0c00c4665ab1ca6ef61734aa9346ee6284e05f4459a03d8dcdff4c8e372bf261d","first_seen":"2026-09-11T03:40:22.211049Z","last_seen":"2026-09-11T03:59:44.78284Z","times_seen":5,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Alexandria-Regular-ViZbgTze.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.112Z","timestamp":1789099142112,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Alexandria-Regular-ViZbgTze.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 171496\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-29de8\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OFqh0%2BBLcdgT3EtDnmpfNL2EZsvGOpSDCdGql86kFP1B0z8Owz9VCFZF2PFcr4eVer0RckVbHKI9hB3fxBm7qWWyt14rjjjKHa6xJcTz7n5ITam5CTGEM2On4AJyJUv%2B\"}]}\r\ncf-ray: a393c1e63d120daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171496,"size_decoded":172272,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 24 names, Microsoft, language 0x409","md5":"adf2a7d03cbf901bc1cb982a439fd106","sha1":"d65fca1db75eaf8bf2a9be3421c7143e5c1ce0ed","sha256":"7103d8918131783468ff9c7ed16c2533a1a64734b8e054efee357528a3fb601b","sha512":"c029960ebd1794a766fa647de04a7566b5bdaf13de29dfb119e45c672c0c5487aeae945a5d57d860f6fd800f3cea96b723ceaa910a5da695a3becdea81357242","ssdeep":"3072:0FneHUdfdj6o0/cAMu2tmdocp7Jw/HaOqETlzFNZXqLLlq5A+eeixL9e8d:ynYyU/9F2tmdocp7Jw/HRbTfjmpd0ixn","tlshash":"f6f33a07d623c78dcf515eb4d379930a7732fe74be2aa25bb445b9b9e08f1a1480425c","first_seen":"2026-09-11T03:40:22.343229Z","last_seen":"2026-09-11T03:59:44.78344Z","times_seen":5,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/eth-logo.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.510Z","timestamp":1789099138510,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /eth-logo.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-12a2\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BfBurBq%2BLxkAmFE7mVFwkDVHkY47nYzkvP3jD9i%2FQlaRSw3Xa2yzcptVzoZC3mbslX6QLrbCoSMCuGlEeRh6eH6hd85%2F7Re6Tpu8GWyFqr8pD8ofMtYMIbRwp2VQ3EIN2N%2FqjA%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4770\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4770,"size_decoded":5712,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced","md5":"93aa3a01208931e56fa8e8c7b47f3b43","sha1":"a92c09517fd47b83e33f93dec1d30da2899cd352","sha256":"544b1594618050ffbde24d1565f07db9f0d2cb37b5af519628940dab6cc799e6","sha512":"3721749b1dd0a3c5ac4a1990f87fd3344b77c111aec8cc4c66da42d358e04e55e66f698fd523bd8b78dce808028cee99593a3670f812f9be9db649f46ec65b16","ssdeep":"96:Avut1hDgPrpYUE0pEtneo0eEkhO2jfw91ndSEXVKPG:X1hD0Y10yteo0n2Tw91dSElKu","tlshash":"dea18ee53355ffee455c833a2d5a6af40ec7e5e30d213c64d873349e8689b2925868c1","first_seen":"2026-09-11T03:40:22.204291Z","last_seen":"2026-09-11T03:59:44.783932Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/audio.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.486Z","timestamp":1789099138486,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /audio.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-a699\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ltFcO552YaNDntD10KvJoCfS%2BB6kpQ3W0uc%2FoGbjy%2F7du0%2BYEAgwS1gVZUDK%2B2SSuUyXUWvwYnBTLHQwPRJB46ihN40gyTCdhpKlJsdtKBppYaxKkOEt2VSxKe68KlfumX%2BUEw%3D%3D\"}]}\r\ncf-ray: a393c1cf888d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42649\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42649,"size_decoded":43594,"mime_type":"image/png","magic":"PNG image data, 224 x 296, 8-bit/color RGBA, non-interlaced","md5":"43ce8b98a40e6b735991f8f3198a9a61","sha1":"a84affcba1e02b09eac596d8d9dc19d3253632ce","sha256":"79b8b15a5620e1e2d431aa97ae99d7fd3a39bc445a163e2e79c3608cd686b047","sha512":"dffe42fbe3ffcd47c98653cc310bf3db8db91b6b07be02c553a70d1f656e992fd0ffabad91078637a2a523649a41c1bc065403150363588a8c4d161369ad04b5","ssdeep":"768:50BYJIN8C4ERP8JGx1Fn3fP584+sPctVkPwrzjNCqP5LiSwMNdclNsL6IvJJSXN1:6kIT4Eqw1Fn3fp+C2zRCaLd6","tlshash":"5e13f1f7c7cc628fdb9a0d895a481ed8a78782728ca5069e54d413f7a4ac9f0d35c711","first_seen":"2026-09-11T03:40:22.227864Z","last_seen":"2026-09-11T03:59:44.784719Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/usdc_ethereum.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.503Z","timestamp":1789099138503,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /usdc_ethereum.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-75e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vqdZukqXOnbpytwz9FrT%2F7CA5%2Fs7LJTveREnwXPahFzXKFkbBfxy90seZKvgUp68YTmyAklf3cp4kJOMHSAPxz5Q9yI6fNYcyKVfxYuzqymLXVIq7x%2B9zxHoHWckAEJoufypBA%3D%3D\"}]}\r\ncf-ray: a393c1cfa89d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1886\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1886,"size_decoded":2823,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit colormap, non-interlaced","md5":"be5056a6df8684cd41d814d78edb75a8","sha1":"7776557429bc5b316304e41d655c828ce7f0005a","sha256":"015b9e3bf06e97444b1f77a21daa77e9ccad6d064d2a903ef7c3c55685496949","sha512":"3fe74e08775c2973ae91c77d43375cf6bc319191685b58ece7344f8e7da4d426fe9e76e7150e77d44e53ee2922949eb08b608d1ffb14af4f06e7aaf60cafe10b","ssdeep":"","tlshash":"fe413bf32fab0a8e1fa444484d44f0bb63103ef00e76cd894315a829ed32a4857ef948","first_seen":"2026-09-11T03:40:22.217981Z","last_seen":"2026-09-11T03:59:44.785297Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/sui.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.505Z","timestamp":1789099138505,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /sui.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-4acf\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aOqqqUKk1oj%2BYFlKk3E10zpP17eWXObGS4X4UlKKaONdvaBGoZ%2B9HJ%2B8n0ZhPxBeebthgN7GPNThXvRUpkCKcX%2F2ii5Ji4a8OIFNYq7dtT30NwpK%2BAQy2sSPwH83DFs2hKgEeg%3D%3D\"}]}\r\ncf-ray: a393c1cfa89c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19151\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19151,"size_decoded":20094,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"fa9bc84e5b9c8b1a5209d307eea027ee","sha1":"7473408ca1507868d1c40c29b0483a2b229b41ec","sha256":"94bc5d9390f7357f4865d8cf59ded7c867fea98d3a3d70a544f9f4a06e6691bd","sha512":"83c9eece1ffcf6e384dd9af6d743947fe00771ca31ac60bb4b1459765999bfd01f3559b8d07daa33617605bd18d36acde07776e3bf25d646f5290946f8fe9b1d","ssdeep":"384:/bj8WiO4FGyL3Qm3bSxVec/GYiBcAK4JXTfAxP:DQWZ4FVDbbEe+iaAK49fO","tlshash":"5882d078fe94c291994e7f06d1fbc6572ea289c5c8ea63b1fec140a5cc21d05c45b4f2","first_seen":"2023-05-15T06:33:40Z","last_seen":"2026-09-11T03:59:44.785918Z","times_seen":13,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold6.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.493Z","timestamp":1789099138493,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold6.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-3451\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mNSveqjCxtGmWomoTOkhBa4b9Xmb0qzdN%2BPo3i7MAGMHv63hABXuSX2%2Ft7ylvNdMYhmwhzzFJtOpIsK8Nrfas1LtuRVTAh42IxOGOAVZJRUF4WNrdpHfuMp2sWvCO4Akid3PuQ%3D%3D\"}]}\r\ncf-ray: a393c1cf98950883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13393\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13393,"size_decoded":14330,"mime_type":"image/png","magic":"PNG image data, 112 x 110, 8-bit/color RGBA, non-interlaced","md5":"97a2de3df23af30face8f72ee3ad77ad","sha1":"3ad25cf7497f99a3630161924d21c39bf577be81","sha256":"eb959efcab76124bcd589e949ca26a710f99cd5c56255d32cf3537febd7c13bf","sha512":"b1adbc62107aa98260e9a74ec238de30a1dd6eb21e6d5e6b94c35bb074cb28a56551f40a515607bb34894c65f38cdf83dbdd8a79ba9db54f609806e2e21e993a","ssdeep":"384:cjU1P5AAXnyvcdx07n+zDxAd+RywXplzK8JwJ:c4dyAX1v07mRyOplzMJ","tlshash":"cd52b010230b7d997591f2e30e77d9043c9aa51ab7ab6ed07ca079240b037bb2574f9e","first_seen":"2026-09-11T03:40:22.274106Z","last_seen":"2026-09-11T03:59:44.786543Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Alexandria-Medium-BoXiwifI.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.108Z","timestamp":1789099142108,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Alexandria-Medium-BoXiwifI.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 172796\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-2a2fc\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gr1utUxZxRlFFSgsaxpiFzrPKNtQBOb92LyRC%2FOMjjbWIJeHwFvwZh4H%2BjG4scfcq5sEQlqQU1p0f7ElPXqicbYkHurcYEV9XQYQYMNqXeOoDXdZazXqbSotfv6WDvyA\"}]}\r\ncf-ray: a393c1e62d080daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":172796,"size_decoded":173572,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 26 names, Microsoft, language 0x409","md5":"fd57b0968647fb252ecba9a75fb673ac","sha1":"4a8131cd70f7f94e3dd4bea0b7e6d7ac10480670","sha256":"d36630f93aaa2c0e8b0cee7688f270bf24252b8f2884cf7c28f50d858eca3eb4","sha512":"3028c5e79a6658ea92c5a23e53ef1b0e1ebd659a90e22dd14d553cbda4f17d2d049cccf9a319279ccea1cf4341d9457394dddfa796349b0da69db6ea92fca486","ssdeep":"3072:DnA3K8xMBfdj6o0/E3wpaStTb++0caQRlypYQv4QXZNlZuX/Th/7:DnT8xUU/E3wkz+IJ1Q/Th/7","tlshash":"12f35b07e627874dcf421e78d675d30b3b32bf74fe2a9207f8567ab8e48b4616854248","first_seen":"2025-10-13T22:49:28.568365Z","last_seen":"2026-09-11T03:59:44.788547Z","times_seen":6,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/new-note1.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.487Z","timestamp":1789099138487,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /new-note1.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-578\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Egn28lwsMTUieQ8%2FNcpQ01o%2F3wj88uEe5UumzlGCZrpNUneMzUUCKWFk084AagoFIHxHnE%2BnSNAmcAZbJLQnh%2FUD519jUj5CeRVSZlGkyX6Pk59ehCHRpydTKsSIsRfAuYM0rw%3D%3D\"}]}\r\ncf-ray: a393c1cf888e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1400,"size_decoded":2339,"mime_type":"image/png","magic":"PNG image data, 37 x 61, 8-bit/color RGBA, non-interlaced","md5":"beb0dd35fa3d043907af9097b95b6e69","sha1":"6decc06d4aab39deb9d4fafd7131888a0b23c56c","sha256":"2ad6810eb09994e724c55f3563aba05a1a0b106466a43fd3cbcfdc66b3ecc7bb","sha512":"50cb07e6dd1fbdedc8618cb81b95a192e6015f0fe1b7bccefde4547d9e3658bb5f24d161513f82b58c548b22916ebcb2c15effe19d0f55a6607f671508686373","ssdeep":"","tlshash":"a421e66b80b42ce1d331a1b617ac83137ddaf11ba45bfc2a8e88dd2d48c531fc84521a","first_seen":"2026-09-11T03:40:22.153169Z","last_seen":"2026-09-11T03:59:44.78913Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold7.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.492Z","timestamp":1789099138492,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold7.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-2f4e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o%2B06yUo9xsfgqu7eS08BRKRVLId8%2BIP0D8P3ujoq7alHJw9sCXmVCHPZnx%2B2VtpoY4UkIZTmXModAwwM%2B42FBdaXemFFlwLqAmpFxx6rJ9M0FWDzADMkf29ya3VIyiimOXzIOQ%3D%3D\"}]}\r\ncf-ray: a393c1cf98930883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12110\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12110,"size_decoded":13051,"mime_type":"image/png","magic":"PNG image data, 97 x 95, 8-bit/color RGBA, non-interlaced","md5":"a295248824b092eedb5c5f59c3cc53e7","sha1":"e0be4ffea4e2d42b7876b20c6d1411850d3cf2a8","sha256":"1e0e6e53a45ce7667d06e39cad0a38026d00e00f1a7b03af0e3bbe11fc6e6725","sha512":"18cb40e8905830c3a1c0b7a54e2c45d1ceb108a3c4d4736ee5eeb14ade14520226136347ea3fe305ca4e3af9a707d97c693faf6c641d27d6019c714b2bbb6539","ssdeep":"192:r3wxpLKYVnk8Xxxq+Cf7FtGnvgoo/raAJJW6e/c3tuCrmB8kw1Jsgm8FQ:8PKY6QsrGW/o/c3tLqB8kw1igRQ","tlshash":"0042b05cf8153c2f4a1728b69ee41901188968bd87f8c74b8349a35b19fb4839553b58","first_seen":"2026-09-11T03:40:22.202496Z","last_seen":"2026-09-11T03:59:44.789698Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/referee.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.471Z","timestamp":1789099138471,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /referee.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-2d217\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F8UDZ6q2LsNSUYa3%2B9Thh83P62E%2BZm8f5XZ%2BGY77pgl%2BiLFt6tCoF%2Fszlm2s82C4MWE8N5juPmMza3fwJjEGu2Gn%2Fupa387M%2FOK2MHTHdFVHGkKjz2U7R2YyxnBj4v1B5OYBWQ%3D%3D\"}]}\r\ncf-ray: a393c1cf787f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 184855\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":184855,"size_decoded":185806,"mime_type":"image/png","magic":"PNG image data, 564 x 716, 8-bit/color RGBA, non-interlaced","md5":"984186d2ef9583120d07f6d5a4dc99fe","sha1":"9ddd6bbb6ce9a021dbc1dd7b06c1b042e85d1755","sha256":"468122a0e5c1c6bd05a1cd082002378991c30256cc69428f3c201c570c17b44a","sha512":"440d2789eff4473df532c42fd05a6ae8f52c2506c4694c996d8c461a3a7da2db8a05f94d72d07b38c76e16838eacc3a93c07205df5078e640cac747fb1f3bc03","ssdeep":"3072:cdoccdUOJzrQAsiCrvyjg+Osuw/9fcdFtUEVQz8+RiCwJeNWIlkCz:cWB/JzZVCrKpmMZAUiO8+Ri5e7z","tlshash":"fd04126200feedcd71354b37ad68a59bcf426680855b809e7f6311697ae30ccdd2a31e","first_seen":"2026-09-11T03:40:22.284599Z","last_seen":"2026-09-11T03:59:44.790256Z","times_seen":5,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/yellow-star.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.483Z","timestamp":1789099138483,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /yellow-star.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-51f5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xg8jh7rnUM%2B6ok0%2B%2FCbALqU%2B%2B5D8Ru9HsjcYUSCDtNLfC8ykyltzhJomcYiUJZ5Zq%2B2H1ucQqpUm%2BpbIBXaO1eGhWxsgUa%2BTl%2FJCEzyQ2zBcOyIdUBMY7e8SqX18K%2FDsyLJ2JA%3D%3D\"}]}\r\ncf-ray: a393c1cf888b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20981\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20981,"size_decoded":21934,"mime_type":"image/png","magic":"PNG image data, 140 x 142, 8-bit/color RGBA, non-interlaced","md5":"04d36bf4c2113d96e8842721b475172c","sha1":"fb452e0fb8338b696c567b5ea328a52a0947d47c","sha256":"cb4089fe48b108fcc7fc3a8047c5f101cc49d26c22e1552d65f20b032ab07b8c","sha512":"78ad92c30360ec595e0caa96637a5cf168d9a4e38fce903d40fa92f5ba62c0566a12d818f3610f3a959de5da47a05d576b6702638c06b8503ef1739fced8a15d","ssdeep":"384:4PBXxLVp/DTay9ipAifbrpmDOKV2YZ4Z1RwhjdUCeOdbDmkAUH3QbwT:Sx7T99kAifbQDxwTwrUBONmTUHAb2","tlshash":"8892e09981394f644f0fe8721de3d42a5c09bd37a90c7be4d3cd3caaa7f056da580909","first_seen":"2026-09-11T03:40:22.216141Z","last_seen":"2026-09-11T03:59:44.790848Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/newStep3-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.496Z","timestamp":1789099138496,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /newStep3-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-1209e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w0S8d7jnqmxKk7Z8Dvx9LibqbY8LXAIPYOgmkA5GISXUJEiHRGrtVz%2B0w0lNIwLVbOEtEa4XGZOUHkeOLJXgwcvUaeBmBGbYZBwuqn0YwCmFGPa6uOhOQMiVCGoZYinuyrslZg%3D%3D\"}]}\r\ncf-ray: a393c1cf98960883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 73886\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":73886,"size_decoded":74822,"mime_type":"image/png","magic":"PNG image data, 720 x 600, 8-bit colormap, non-interlaced","md5":"fbaaae9d667434439a4aa375da028d0c","sha1":"921155aa48e3b408cfa19ebcdd63c3da1df48949","sha256":"de370397ecc38deb5f826478c19fd76267656d637607068a34cff87d97c2e8de","sha512":"6e4a1665b384a7c50ea136e358bd8c2f87e1a3594e8a29224f90676f89e290ef340c97393975932fcde0a1d7bcfdcad7ef9d7c4c909f5e9ae49d5cf3b4a17e37","ssdeep":"1536:BXGSTgMj+G8Zh+E33BUQOOovXODqgrXlQjwAW:9IZhLz0XODqgrVADW","tlshash":"62731248a41f50926850babde158672304121f92a578788c7dbe2b3daf1777cf423fa1","first_seen":"2026-09-11T03:40:22.186652Z","last_seen":"2026-09-11T03:59:44.79155Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Alexandria-Light-Cjiwb7NQ.ttf","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.115Z","timestamp":1789099142115,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Alexandria-Light-Cjiwb7NQ.ttf HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 171960\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750d-29fb8\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5x4b9k4OjgU%2FMlWFFncpiTRFfwURrTnXQ7IfE9PUrgBGDVd2cx2tQhw5G1dhrvqTDHNzMiI%2FoHfECDRgkhCEwjFuEaCEl%2FzYH9yZd6bBVhYfXjXC6XBRNxTXhwRhzIxw\"}]}\r\ncf-ray: a393c1e63d1b0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171960,"size_decoded":172738,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 26 names, Microsoft, language 0x409","md5":"ba019924763253310ba4b0ddb234411c","sha1":"56f7bace7b89648a9a436a40d06cad6751434d98","sha256":"2d6bac36ee3139b1ec2fea9ca8eeb2ea72567ea94bba4767c0aac744bc00808f","sha512":"7beb2136d76db7d922b535d1d761d5b830fae60988b47ec8b36a1c3cb87b4de980544ac26331bfec2d6fea0e3a201b2c2c24f94aff896b95208b56fdb18a4c45","ssdeep":"3072:12noSLgfdj6o0/SIT790QTb0yLQ9lkS9wZ/oNzbI/7yGSK//J3RV8iwveJPB/Jo:UnovU/BT790Q8/Ln9wZcI/7yGSpi9ZBu","tlshash":"5df36c07fa23874ddf410eb49235a346bb35af64fe3ea217f88679b8f8876615c10158","first_seen":"2026-09-11T03:40:22.240943Z","last_seen":"2026-09-11T03:59:44.792218Z","times_seen":5,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/gold1.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.474Z","timestamp":1789099138474,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /gold1.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-549d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fb%2BJcd1Aza97Rp2jcsSfyjU0wgNrRnnPHTWSArN0Ts1WlnmyVIaaIoBMqK6QYjMh00TSg6vCeMDHwxoH0fjchQapK8wx3CZ4RSdxxk%2FUxUqB1%2BeQ%2BPBAMrIeuuEAGiFJqlPCyA%3D%3D\"}]}\r\ncf-ray: a393c1cf78830883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21661\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21661,"size_decoded":22602,"mime_type":"image/png","magic":"PNG image data, 232 x 118, 8-bit/color RGBA, non-interlaced","md5":"c3c017c20d43d44a10435f40e0f529c8","sha1":"9ad741a7c9dea7a345e8b54a9740ac6e1c305766","sha256":"03f17a40f157436e9dce752e2d9b2e1925e5d8bf827e40591a04f914944d4c46","sha512":"4f7b7e2fb92c13c8c07a66bc34d5d20f6e4a8ef2ca2bd98cb424db338a769dfe8a477f6a7dc6bbeec76e9b7482f6f040729e6f678097ebd5478780a61cb96245","ssdeep":"384:n8mYxDtqhx+5Ut5I65t58VH+blDjGpQ87K3tiO21ae4thdus4pvzFPwErOR9:n8mYHEKUg6aVebNjGq42Yd1ae43os4XU","tlshash":"0aa2e1c0a17f1cb4db7e301dba0b1dcd8f17a66c6556d80fa70ea1b0676b40a3ac8917","first_seen":"2026-09-11T03:40:22.207403Z","last_seen":"2026-09-11T03:59:44.792775Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/shell.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.485Z","timestamp":1789099138485,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /shell.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-96ea\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9dBGCdYmBVo61xyUSXXvLOVeCLmB33hYtvwvDsCwY%2BZBbUoHrqC%2FHfWTKHcLZha6JtS%2Bv1%2FqXhfq02Ipy%2FnYLv9yn3jQUHAyb7ku7iiHgXm349wwaWOspDXrOGWQ6TMD%2F%2BiXCw%3D%3D\"}]}\r\ncf-ray: a393c1cf888c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 38634\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38634,"size_decoded":39581,"mime_type":"image/png","magic":"PNG image data, 264 x 186, 8-bit/color RGBA, non-interlaced","md5":"f008a31e8708f0acb6999a9928f67427","sha1":"cc8b85cb8906438c5f5801d7f4ed6bf780ecd6b7","sha256":"6d0c12c0e3d8e4734b7adcc1e30af45e8bac6fb1e9effcdfa796d4e9d0658e90","sha512":"655b8307cc7c758462b480ad5b76055628e341f92816cddef28997150d7057a496cb2d0562d4e04128b65411717e44b8a5cbe1b38c5a40fdb0a4cb1823d7bbbf","ssdeep":"768:DZeu4jXGh0gSKCkxAugZybGS+XZJnnHXykS2Cv6U2JwSILAMx3XryRg0KF+h4c0:YuY7kOsWpdyhX2Jw8u3ORgOx0","tlshash":"190302c6affdc4a12d132d91e6f6e5f8df5d4550e435c97a46aa8c0a778714481233b0","first_seen":"2026-09-11T03:40:22.301561Z","last_seen":"2026-09-11T03:59:44.793371Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/index-C5U4xAQZ.css","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.452Z","timestamp":1789099138452,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/index-C5U4xAQZ.css HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 201035\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967510-3114b\"\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\nage: 1164\r\naccept-ranges: bytes\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=25G%2Fh1eZWe%2F%2BC9kas4EAzVP5gLePQZROgcK9cnzyrTo90rQ21APFU4D2BlxbcFoWq52l4ALMxTCredfHa%2FEO%2FfLo1NKFNPwyAbi%2BuHPF73WjWcWo7%2BSmFWqsvEeOuZNs\"}]}\r\ncf-ray: a393c1e48b430daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1597033,"size_decoded":201852,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4d177de5faaab927eb1e787cda523a2f","sha1":"f5d6b5f624fca96f41db2fb94a75df508a199640","sha256":"3736e77ced7df207473490b3b50afc5c0987dbe90fc5adaaebac3ca82516596c","sha512":"bdd520714960c9b6da0014f3ea910b73ab1adcc84a8b33a8685c84ce2e1ab6dd8857de4e990997a52614d3cf8b92fa687709c80ff303385cba9a2398413f3e14","ssdeep":"24576:fK4kUYVYSYNvKKWl6wmO4YzeBIuE3FWalKYxQ44VCDyzSez9zSURjqM35cMoUfZN:fK4fjqM35cMoUfZwyjl","tlshash":"2d258096ee20b37afe27e55a4398637cf10abc52dda256ebad445110a0c77ff0873604","first_seen":"2026-09-11T03:40:22.179232Z","last_seen":"2026-09-11T03:59:44.793935Z","times_seen":5,"resource_available":true,"data":null}},"time_used":3404,"timings":{"blocked":-1,"dns":55,"connect":2,"send":0,"wait":9,"receive":7,"ssl":3330},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.465Z","timestamp":1789099138465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Sun, 13 Sep 2026 03:58:58 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q9jd4UAK%2BPndIl3eStmbtmOpkN4C%2FC8j068xtYuC1jSeihjqpXigdas5liEcwQ7pTOiViUEzDM5gqp0w2vULTEStymkCTp9d%2FvfGJoq4HFLP%2BxRXmGR%2B8orQ7iFxtfUEEtcKIg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\nserver: cloudflare\r\ncf-ray: a393c1cf687c0883-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1300,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-10-14T18:40:57.677574Z","times_seen":454824,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/ottersec.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.531Z","timestamp":1789099138531,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /ottersec.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-4d59\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3bEcOUaQGK1IwxNnfdkqtjFc49uHG6CgaQuPh6lSwvs0zwYWQoONedUPIcCoaoUPYzP4PR0IfhYXC%2Flgf64ru5lkVGt%2FponpdWOoHsnnqlgCc17fSik8x9BSaAHbDYHAtv5uXw%3D%3D\"}]}\r\ncf-ray: a393c1cfd8b20883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19801\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19801,"size_decoded":20738,"mime_type":"image/png","magic":"PNG image data, 596 x 200, 8-bit/color RGBA, non-interlaced","md5":"5ce932a2ef27ab09c02773daba7cea4e","sha1":"d4d64dc59eaf657d84b355e8e1a1eabf729f8fac","sha256":"f1f8ca012232eb7ac6efa0512992ec61379c9b6aefdb881ccb9231de84f43121","sha512":"4869998c4516d76e3417b74a5c47d49e3835970bd66545e1a0dc40c8f5f23a17b889b57046af8fb247bf71802f69d9648735067df31e6da0002fa80dff8b27ee","ssdeep":"384:kpPzycRE95TUAblDVuTNzqoPTDuObWB92UmpapraDYvxqGWeiPZ2jCUQDM2fw9:kxzycS5TjDVuTNzqkTDdw2URa0pqGWe9","tlshash":"a692ad9f8bd8d5d7d46cfe2b1a5ce2bc01a2aef6152c5f588b30bdac6c410d0076469a","first_seen":"2026-09-11T03:40:22.238995Z","last_seen":"2026-09-11T03:59:44.795058Z","times_seen":5,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/new-wal-logo.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.507Z","timestamp":1789099138507,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /new-wal-logo.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-8909a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EOy6QR9jz6WW48wbQNcSLUDNpJ1niuw2PmpmtbEQfp%2FpwcK7vgR4PQtySiz0GHd7WcyU8gSzSpbB9jX5xgxmtvrYqRxq%2BFytUKdIZtw2d3fE28gDCps6fIJO9Sw5u0LGM3eYxw%3D%3D\"}]}\r\ncf-ray: a393c1cfa89e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 561306\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":561306,"size_decoded":562245,"mime_type":"image/png","magic":"PNG image data, 1500 x 1500, 8-bit/color RGBA, non-interlaced","md5":"b1f057f456194ebf49a66287016e4d58","sha1":"b5bccfa840a43a0169dfb0e43c8fb2e4f1c0d313","sha256":"ef48fbe8f0a1ed89e68a6859d686b039de3aac3fcaedf9c7a5618aa38b2011a4","sha512":"2da3750f3bc554ee9d42ec979c888d9ae6b4520f1931449504355a8e312500c055ff943cbdbe11cc48b702756b2a16763ad43dd1e349c1a3c661a4ab6015722d","ssdeep":"12288:R4Lh+RCroBMhPvwAGO/t1hW/H2K6QA+Gq6vxK42UXAS1h:R4N+RWLXlK/H6QAnqw1bXAST","tlshash":"22c42397f42ad30ecf45c97b41a47f39403cadd9cee13a1b456cf8b88d92721b8a9844","first_seen":"2026-09-11T03:40:22.255036Z","last_seen":"2026-09-11T03:59:44.795582Z","times_seen":5,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/light-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.515Z","timestamp":1789099138515,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /light-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-49f1\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BvbigY5dAy0Bfah4%2BK2Ys6NOFHTmOY5Y94BQtD1qhR0Lx6TzJ%2FRL5lTBN65PXko2tnj1hkW153vFTz4v%2FoHX%2FVQA5O%2BjJHEyQ%2FgYIereUY2mj6iOjjtagRClgJk0AxW1zq1Icg%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a50883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18929\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18929,"size_decoded":19874,"mime_type":"image/png","magic":"PNG image data, 366 x 366, 8-bit colormap, non-interlaced","md5":"d4e195e84487527cbb44bc0f70405ca9","sha1":"31cbd185c3c78f75aab0f972ef516bee44de4372","sha256":"3fffafe98d755a801344d6de8a5e5e741a297b7fc7b549a6f9f1d1931e8675dd","sha512":"f25be2eed7943c930a99d7fe8279a34daf0af8291f1042cfa0723f6d6764d7c2e07453497d8236a9d5f30202358926c9a38936b72d45437dce05ff23fd2dfefb","ssdeep":"384:cSqLFhT4BFGDeXHwHNKaiFafDIAKetbSRGjG6GQiDENjwYB:07iXHwHIaiUfkAKeRm5WFVB","tlshash":"db82d047483ac161e33476964c51e30b1e72a443f24d7b01bd88f3dbb2b6ae9411a8c6","first_seen":"2026-09-11T03:40:22.24511Z","last_seen":"2026-09-11T03:59:44.796131Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/haedal-bottom-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.516Z","timestamp":1789099138516,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /haedal-bottom-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-ed08\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qIWtiodzdABFP1PR8Vyb1ox4pVq2fYV39T8ofRPtVwAqL7P%2Bh9ooNubpcBVtXnsgAkPhVrjNHLFPczr7Jh%2Ft4JHOuxQFBgSof%2BJPUlepUAjjxEvJiqndy7zVXj7yXvRZTl4hFQ%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a60883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 60680\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60680,"size_decoded":61619,"mime_type":"image/png","magic":"PNG image data, 580 x 582, 8-bit colormap, non-interlaced","md5":"718c5c70d9891747cd06a2bccf438280","sha1":"8ffc1de3f92869de8b8a873d1497fc0cbdc744a7","sha256":"30f9f3d8de3c405f70257ccc415ad74a6dafd2847ae94719e4d93e7a645be959","sha512":"1e7851101b1b2327a0372df922382bfa7c4264bcc178bef2f1a9ac80f5aa6d13bb9204eec93164b671f45dc8a62543998beaad8b3a8c872a4030e54bad75ea74","ssdeep":"1536:cRBxvJJscl9W9kORM0/To+w/dwGruv6JIeFk:iJJscTWbM0/c/dwcj5k","tlshash":"fe53122560d39699de87e37f24e30d0f8ce12989906f82e5dd08403ea14eeda14ffd44","first_seen":"2026-09-11T03:40:22.209072Z","last_seen":"2026-09-11T03:59:44.796742Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/scallop2.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.529Z","timestamp":1789099138529,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /scallop2.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-6568\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J25YKcsp5yKaKTTFO7iaRSRTkJ2Yrr7Ou%2FsQ9NAiqbHhU1WsvQP519dswS5VsCEn%2BN40W5U0A5hMECYD70Yc4o6F28b459qatl%2F%2F1HKRfb%2FxoisQMw%2FTTnj9yOitqcb%2FKixTmQ%3D%3D\"}]}\r\ncf-ray: a393c1cfc8b00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 25960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25960,"size_decoded":26907,"mime_type":"image/png","magic":"PNG image data, 504 x 200, 8-bit/color RGBA, non-interlaced","md5":"7010abacdd289cce28b9b4f7efb227f1","sha1":"7af2607444dd4282db5c62f1ca75bdc7f65da3c8","sha256":"03590815a19fac98c9b34c780d8940a59b2c11fb75dac3dd35b39af4a40f6d64","sha512":"acc3e2d9a9083cb5eb1f59bb2b7f1d76b5c363fce5c34db7776607589b423a04fd63fb0fd37b076eba3fbc934cb7ec9957e5051792790b54ff6f97bc83472f2c","ssdeep":"768:kmPFzt+djA+mzbDrg3+E2vMW/gqLG8sw9pX:kyFzt+djSzbDrg3XFW/gAGyj","tlshash":"36c2f18ebfbad4e366097f64a568a35524c64077c6fc1180134eaca3f79b74822d4db8","first_seen":"2026-09-11T03:40:22.26316Z","last_seen":"2026-09-11T03:59:44.797363Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/referee-hand.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.472Z","timestamp":1789099138472,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /referee-hand.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-600f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YwPh7879fLtOayf9adSrxWIbz7oTOm5guKz6n3x92MzW4AHAHpzy9ge03RfKveO4X%2FQRmuk5NPRp6zblEqUyBsdrD2kn1lcnxlcjOZheyr%2B0EzIjAt1rfHGVoKZLWpTtXK4orw%3D%3D\"}]}\r\ncf-ray: a393c1cf78800883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24591\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24591,"size_decoded":25528,"mime_type":"image/png","magic":"PNG image data, 176 x 334, 8-bit/color RGBA, non-interlaced","md5":"176fa3d4c873a9a91cdb2fb68f962dac","sha1":"fa1acfe6b404c307221ce9701b3dcfd935d05104","sha256":"f7f772f1b4e232e06e0cefab67366038130d5405e2c58517bd96707fb8831d27","sha512":"5e474fd58ff2be194a08d230705d280eb2cb92e9c66f3e03afb385dc3ef2424005947d87e8633f033a3294aaf5f1751ee3e6d7e77ee63244b25168ca744adca3","ssdeep":"384:rcFAkGI9M3gAQ1v4GdjS4AaQFU0SNcCqcanjuCEvOsiyvNrTrTSI2YS+cn9Aj:rPkLG4v4mjSBFU1NifjuChTSTSrYSFA","tlshash":"36b2e1dd3364c944654e303c10d9a09fd29b3dbf1212c56944c67b9ce8e9bc6538ea95","first_seen":"2026-09-11T03:40:22.347526Z","last_seen":"2026-09-11T03:59:44.797921Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/images/redesign/home/sunglasses-right.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.087Z","timestamp":1789099142087,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /images/redesign/home/sunglasses-right.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ETUvs7oa%2BsVRTxymPc1nlQ6nJeMibHwhtmyyKeWbomeRbvSQwIFeQ3t6Vy9qJ8QjfsfYxtnhEcS1ik9Xl9gysCHpajmu2Hf9BUXNhe0uqZJGRCmeyfiqG78VqMP9VUH9Z7GHyA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=4,i\r\nage: 1163\r\nvary: accept-encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a393c1e60a460883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":334435,"size_decoded":44675,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (61233)","md5":"bfbb11fd930e7b50327d56bd96566622","sha1":"4153cf75a2f05c63b750de5861cd5ffa41773b3e","sha256":"829d04f9151a49611232ffec0b608878c2cd5ce132b24b78d573c9998a4eae15","sha512":"a341e79a288e172c6f219065d61c322b015763edaefc27d4187aa1681dabb86b98d89ccdcb658b66ca31af652b455259a4326c24acc4b41c05c1527e60e6e345","ssdeep":"6144:Bu6cdWoPWoQZxUzEi2rA6cdWoPWoQZxUzEi2rGSoMDzM6:BkI","tlshash":"fa64822452724afe811f75e1b570a388222fa30bfb828ef5016d58e657d6cf55c938cb","first_seen":"2026-09-11T03:59:44.79846Z","last_seen":"2026-09-11T03:59:44.79846Z","times_seen":1,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/sunglasses-right.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.085Z","timestamp":1789099142085,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/sunglasses-right.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 1622\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-656\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SqdWzFMJXXPCCV3%2BHq78qjZoXqErDQpPs6lsXjX2%2BA2N1DTKV88Leq0wJTUNfoOL6NCQgmajkLuGov7QY5EphBjELdTduSpQgQsU%2FT47FvxrjE%2Fti7dizCJ%2BXABUiDqw\"}]}\r\ncf-ray: a393c1e60cd30daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1622,"size_decoded":2385,"mime_type":"image/png","magic":"PNG image data, 97 x 86, 8-bit/color RGBA, non-interlaced","md5":"737d1a0d3eb5aa7808570d0f609e5c7d","sha1":"aa7bb61a121c72ba953c4c337e815b18ce11918d","sha256":"574ff9d71932b85b60c71d7dcb5c6d927118bac6de3857604ba2b4b9a59c1769","sha512":"98fb02f861a3aa794d9bf7292b4ab624a03071726992914fdd4e0ce69ae5af53c78d1ffbe22c6918746be82e16f00055f4d7c19bc8b732eaa507c9fd3a5819ab","ssdeep":"","tlshash":"1a310ac21578f722f99731f5c34c4b840708042dc925131f4e333b95db6639a1a23d8a","first_seen":"2026-09-11T03:40:22.246849Z","last_seen":"2026-09-11T03:59:44.799513Z","times_seen":5,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T03:58:57.857Z","timestamp":1789099137857,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rNNi9lWP7sSzKOJ7%2BwzRXw5hMJ6mcUszvUzLHrAf2CB3mBtjma4y6wQRBJfauOuRLXnNDAhE8y7I%2BY0K5xfFaZTcGSVCxFdsMK%2BFzpjUJpcOLsHAkczKWLH5b%2B3M%2F91nOt0%2Fuw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a393c1cbb8390883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":334435,"size_decoded":44519,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (61233)","md5":"37920dd42c08cf244a0a62ea451beac8","sha1":"a90136a777f7da3ca43f65ed2abaa81d14e76287","sha256":"8bb699eaf056d601b9872e56962c30c07593334ae56ffc9507b81754ce4bbc83","sha512":"a1bcf30ab0187661f8782b684cf4f4c3dbdd083d0ea039d4f0280a536e4099499608e23f8ce39550d66fe73152ec7ca52e4e88a2d817b8350e6b6fc135189526","ssdeep":"6144:Bu6cdWoPWoQZxUzEi2rA6cdWoPWoQZxUzEi2rGSoMDzMN:Bkn","tlshash":"a164822452724afe811f75e1b570a388222fa30bfb828ef5016d58e657d6cf55c938cb","first_seen":"2026-09-11T03:59:44.800213Z","last_seen":"2026-09-11T03:59:44.800213Z","times_seen":1,"resource_available":true,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":5,"connect":12,"send":0,"wait":212,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/assets/Home-T0Boy86z.css","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.455Z","timestamp":1789099138455,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /assets/Home-T0Boy86z.css HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://reward-haedal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: text/css\r\ncontent-length: 5377\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:43 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a96750f-1501\"\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\nage: 1164\r\naccept-ranges: bytes\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2KbQeka1wOESHANcHIygQpHwEb8x8a8R39%2FfmI1vRAvsRDpQnp1WGxEy1gio%2Fn1x4VfTe94w%2F9Q36sg4FjgSjo3AznMftiAtp2PNbo08TKaBO7pFRhbFzHTm3h8W7Eb8\"}]}\r\ncf-ray: a393c1cfcbbc0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19706,"size_decoded":6183,"mime_type":"text/css","magic":"ASCII text, with very long lines (19705)","md5":"dfab6730fe168ab3f89bad92c299bff5","sha1":"7e6d92f10f2028d034872117da4b4bece4585bb4","sha256":"d399e5688f658e3bed5f932164e3305e99eb06c98ddb7f85cf42c1b63a5144b0","sha512":"b30cf6c9fc07dce7fb440330d5370b0fa501f7700c1a8573e7e9d6dde8520f168946d730affa324e21c08ae578bcea3b8ffffe0e2ba74b30e62f771490b9154b","ssdeep":"384:P1nZur7irQ6SRxatglUbehJFdKW+SVZpbW:P1Z47irUktzb8JFLDVZpbW","tlshash":"c39230688f26048d98530b11ebd45eb8590ce563c6eb4dddb3161e0ec7d61ac13bee8b","first_seen":"2026-09-11T03:40:22.265076Z","last_seen":"2026-09-11T03:59:44.801201Z","times_seen":5,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":53,"connect":1,"send":0,"wait":17,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/sui-haedal-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.532Z","timestamp":1789099138532,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /sui-haedal-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-8694\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jW9zz%2Bjnf1YB%2BCeU%2BjUIyowlL4aM11%2BcEHrVK7qy87GUYXo%2BqQLwQ%2FewJgLvRdy7DJj1zI2%2FPKVMlD0uP15lkNFgEfVS1m0sss93pVGzeuyJE8Zj9dKZjH%2BgN%2BrWYj%2BfoWBl1Q%3D%3D\"}]}\r\ncf-ray: a393c1cfd8b30883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 34452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34452,"size_decoded":35405,"mime_type":"image/png","magic":"PNG image data, 420 x 583, 8-bit colormap, non-interlaced","md5":"7cbc2c8251e10a7928a7dcb0bfe9c9a4","sha1":"a79da7a0f212eaebfd82bfb129f87731af6dd3eb","sha256":"8cbec387b919640fa0d8504445617eba854b27f9e58fd38c183af2fa5bc39ef2","sha512":"7ffd60e6fc92b2134addcc8e378cd5c8470139c63822681355fea70244579dab5979f9b580b23e9c03f0a72542bef63078801d001f5df3b7e7a0a570522f57ea","ssdeep":"768:s37HtrQeVrgw0ZQv6GS1OKYaq2QSwK3cS0+xqXU+TTKfHisqFc+CglQ:sZrd45bU8WSwWcS0GqE+nKfbqC3aQ","tlshash":"1cf2f19ca43f951c5fb8a471a8910874b7299dcf9aabd73c28328ef05087ecb1d23534","first_seen":"2026-09-11T03:40:22.225225Z","last_seen":"2026-09-11T03:59:44.801793Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/images/redesign/home/sunglasses-left.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.082Z","timestamp":1789099142082,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /images/redesign/home/sunglasses-left.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RThrDNJDSthLvTTA33Nneqyj8Y2f41Lr16rpLRI8tWkSvqmyEDmlVOoZznX2tbmwkk8WktTHhakhfnPUvvJ8414105qVs8UU4oFDy3y2L0vLtOqb1zAHbql0I0o3I9anEWfAkA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=4,i\r\nage: 1163\r\nvary: accept-encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a393c1e60a450883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":334435,"size_decoded":44681,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (61233)","md5":"4814be4614fe3dcd9aec2d4338961973","sha1":"63e2317d73b33771efa71c909601a326e94c1a46","sha256":"81939a0b332aa276e46a32a6ffdd6043e52ff4b50f810eeae169f1936e9ce179","sha512":"f22ffcd6e829e51e850f6cdfbfdecb5f86d34277754229890a52d3aef72bff519bd36af75e7ad3de55b4f5c9546ed5101d295a83b828f9a83db6999192bac2ee","ssdeep":"6144:Bu6cdWoPWoQZxUzEi2rA6cdWoPWoQZxUzEi2rGSoMDzMd:Bkz","tlshash":"5364822452724afe811f75e1b570a388222fa30bfb828ef5016d58e657d6cf55c938cb","first_seen":"2026-09-11T03:59:44.802371Z","last_seen":"2026-09-11T03:59:44.802371Z","times_seen":1,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/haedal-top-zip.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.513Z","timestamp":1789099138513,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /haedal-top-zip.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-267ca\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6EoaUD12yJEYeoDjZtVYqbjZngEx9dXZ%2F078xeSZ0sR8GI432o%2F7WI05wzVI4jujAqAlTI00oIxMWWrZmhyUKSYKfquTHJgaOYT%2BbbDjPSJIdRn2xEjUNOsouMHnUU0RB8%2BavQ%3D%3D\"}]}\r\ncf-ray: a393c1cfb8a40883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 157642\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":157642,"size_decoded":158585,"mime_type":"image/png","magic":"PNG image data, 832 x 788, 8-bit colormap, non-interlaced","md5":"04114c378fabc0e1f277d0455a6be6d8","sha1":"5f385e1bd0b1696a6b5ed0b1dd486cecea79f94d","sha256":"27f5b241a49b0df04ef48eb2d8be33edccb222e583d09c7a0568072bbfd403f0","sha512":"2cb70526ff2f6abbdb583e25773270d5f90ed28e635d99400e083a2253e138110a806a6195d5e35b1b31d12e6cc77e2d95af2f4401366a96630752001935e985","ssdeep":"3072:FfQFoIOGZUhuXsFL+XWvMXT/osZdZ+obFd1/oyFJLXfYCiRMwpkG77the:CmoZ2pMT/VZdZ+e9wyFZXACTwpe","tlshash":"1af3236ca041c88abbf4d43674b302a8c5cd5461a0c70d7b798f78bf997b5ca605f96c","first_seen":"2026-09-11T03:40:22.281853Z","last_seen":"2026-09-11T03:59:44.803405Z","times_seen":5,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/reflective-strip.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.083Z","timestamp":1789099142083,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/reflective-strip.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 1410\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-582\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KuyCeORk4IA48Wx2d30FhHKIaPBA%2Be3ZE4vDajAbupkBy9TbEerhYztf5PwdLZABiJSEtIeieUrhttyFFwD4ANhBFjpxStY7j%2Bq3qw8MKEpTgi1h%2FqlPdjP5vW88FWPg\"}]}\r\ncf-ray: a393c1e60ccf0daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1410,"size_decoded":2169,"mime_type":"image/png","magic":"PNG image data, 130 x 130, 8-bit/color RGBA, non-interlaced","md5":"2a6f4820fa484ed0d7151a0eae1b47de","sha1":"6da4f0918c4e9916048501be0084e90967506132","sha256":"317214f93fccc43f1f411af5f23e5f708867201d8b30586d98cbaf0a42f3bcca","sha512":"d831770f7b4d27cf0d695a5c125e4c9afc85dc191fa3cc2d518a0e84fd472db7c16b285dd06b5f8029852d33415a90625e10f6a588f98da86f55defaa25cbcf6","ssdeep":"","tlshash":"0221dbe70b19e8f4d751f138c3632250ff64e4b4d60c56a30e845629ddf4faa175b624","first_seen":"2026-09-11T03:40:22.267994Z","last_seen":"2026-09-11T03:59:44.803988Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-haedal.xyz/movebit.png","fqdn":"reward-haedal.xyz","domain":"reward-haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.180.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:58:58.530Z","timestamp":1789099138530,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:54:49 GMT","end":"Sat, 05 Dec 2026 11:51:16 GMT"},"fingerprint":{"sha1":"21:09:43:9A:01:CC:D2:9F:DE:E0:2B:66:93:FD:1E:8A:53:DF:6D:5E","sha256":"F3:4D:32:4D:98:FD:89:2C:D9:21:E4:51:88:0A:96:7F:46:7F:53:B6:05:82:64:C1:F1:B5:73:20:E6:ED:ED:80"}}},"request":{"raw":"GET /movebit.png HTTP/1.1\r\nHost: reward-haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://reward-haedal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 03:58:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Sun, 06 Sep 2026 18:58:58 GMT\r\netag: \"6a9db7f2-5a42\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1165\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B35DgXK3WvVqwmQhlNI0QcMWl3Iy1IqyOH8Y5ciVGXe13H%2Fva0c%2B9QCG7a3351Hrl7H%2Fl5uS8PvYii9owOx0HB0qfNxKSneb5XpczRjPxwzztn4PiOuz3bXixhJHCCEgMmCcdg%3D%3D\"}]}\r\ncf-ray: a393c1cfd8b10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23106\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23106,"size_decoded":24045,"mime_type":"image/png","magic":"PNG image data, 590 x 200, 8-bit/color RGBA, non-interlaced","md5":"22271dabc4a5568d5b3f9ab1b5b207f6","sha1":"9ac6a9b8cafb301e1b193853e02c34d5dfd32ff8","sha256":"d38fb6411f64a4b8e0b62ebd1da7813a31f805026f9dae3ba62639fc7cb7f89c","sha512":"33f26b3a7f6561917ce3958ec49a1a932faca75c95c1da0e6aea59aad5647e455c49a9b6fefeac0db1e396702b6cceee127dec0206f006623ee3e5cfe3d4c1d7","ssdeep":"384:S4dmDmoKV8E5mVCqqWjSQP9FcB8bs0X4fhMmUgImLT:fd7oe8FfZjSH6hXE+JmX","tlshash":"72a2cfc6e96c287f6c52272931c7b675edd2327a3db429053ae0ac22e5d0447f1774e2","first_seen":"2026-09-11T03:40:22.219277Z","last_seen":"2026-09-11T03:59:44.804618Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"reward-haedal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.haedal.xyz/images/redesign/home/sunglasses-left.png","fqdn":"www.haedal.xyz","domain":"haedal.xyz","tld":"xyz"},"ip":{"addr":"172.67.68.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-haedal.xyz/","date":"2026-09-11T03:59:02.081Z","timestamp":1789099142081,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haedal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 12:32:29 GMT","end":"Tue, 27 Oct 2026 13:32:13 GMT"},"fingerprint":{"sha1":"90:99:AF:6E:77:6C:64:D4:F6:6B:54:E1:6A:C0:2B:78:84:A7:1F:FD","sha256":"03:7B:8D:E8:BB:39:7B:B7:0C:DC:EF:57:BC:43:5B:C0:41:2B:7A:98:A5:8A:70:0D:70:3B:2D:A3:04:71:23:2A"}}},"request":{"raw":"GET /images/redesign/home/sunglasses-left.png HTTP/1.1\r\nHost: www.haedal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.haedal.xyz/assets/index-C5U4xAQZ.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 11 Sep 2026 03:59:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 1609\r\nserver: cloudflare\r\nlast-modified: Tue, 01 Sep 2026 06:47:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6a967506-649\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,OPTIONS\r\naccept-ranges: bytes\r\nage: 1163\r\ncache-control: max-age=30\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GCbA0wn98IkUlvszmowos1NwMk%2FlNSExU2PR8jQQ5rZBX5NwNnwDxRAYKNcprnc5NkeYPki891Lg8sEhxiAnC9w67qmThcyVf7ttgtcx0fok3yohpZ0%2BvkC3eb3wYbct\"}]}\r\ncf-ray: a393c1e60cc70daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1609,"size_decoded":2366,"mime_type":"image/png","magic":"PNG image data, 111 x 75, 8-bit/color RGBA, non-interlaced","md5":"3baa1c9c3b1ba4e9d9205d04d83513d0","sha1":"d0fe2f651c0bb7628b8d090013e0ebbe4106c28d","sha256":"f9aed038b067e9ead6afc543d98277888304fcc66e42c4da17c8c3ffe3a99cd4","sha512":"b1a24740256aee2ba1b8b546a590982587132254f15d8e186fd96ce5d3a06f73a548b270d0039010f9fb661ebcf9a11c0f757743a130e4eef4399949bfad1d5a","ssdeep":"","tlshash":"de310ac227b78597c5831736087403d60f2bf2624ccaf25bcda5a58cfd233a9b06a5c9","first_seen":"2026-09-11T03:40:22.157753Z","last_seen":"2026-09-11T03:59:44.805236Z","times_seen":5,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}