{"report_id":"85edf949-0bc5-451c-b5eb-147b6e29ca4d","version":6,"status":"done","tags":[],"date":"2026-02-08T15:24:18Z","url":{"schema":"http","addr":"nexo-airdrop.com","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"172.67.223.237","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"nexo-airdrop.com/","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"title":"Nexo: Your Wealth Platform for Digital Assets","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T21:57:33.47713Z","times_seen":17844365,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"nexo-airdrop.com","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"172.67.223.237","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-15T15:24:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"nexo-airdrop.com","ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-07","domain_rank":0,"first_seen":"2026-02-08T15:00:56.906369Z","last_seen":"2026-02-08T15:00:56.90637Z","alert_count":23,"request_count":23,"received_data":5169878,"sent_data":10792,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"nexo.com","ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1998-08-22","domain_rank":51388,"first_seen":"2015-10-29T19:10:01Z","last_seen":"2026-02-08T14:59:30.974435Z","alert_count":0,"request_count":5,"received_data":570936,"sent_data":2582,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"nexo-airdrop.com/solid-20.2.2.min.js","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"702ddc402f5b5a38ac4277d96a33f4a5","sha1":"1e865eb9c88cb8e27c0e7c43333267b08b76484b","sha256":"c338585ca32dfda146fab43f06c633a0352e6e2b8aaed26248b93e6156c2a216","sha512":"ab48bc20114872cff84abde26b803bd25036e4c81ff5a282da6aae156abe771117096226cb280f1b3c428cf0062d868233a4bec66df2a13e5fc04713aeacd088","ssdeep":"1536:Sfiv8tWttW9klw+ojWAz6a/rIr+b5pN/QCO0t:OtWttW3+o6AHFt","tlshash":"89a3c6da1946c0d5ae9510ded073e90ae0680953cdaef053eb2cecc9b49efa69447337","size":103570,"data":"","first_seen":"2026-02-08T14:59:38.220322Z","last_seen":"2026-02-13T20:42:24.404371Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-08-11T10:54:04.310295Z","times_seen":3240,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"fa89e001dd5648af147c82fe3e4f0a04","sha1":"c79e48c5c10cde20e3b34a862d1659f97cf9b9df","sha256":"b9d44f47e04fe81fbf4996cdcdb6b83aa2d91837ade46c382560bd180b987b50","sha512":"2b806806cc1e992b9f1563ebc57a4d65672759f170c224bd0738e97f97295dba5855ed99e901453f3f566932df7822e7c19e068793495d8d866b55e47df009c2","ssdeep":"1536:lf67GtWxtWlwl0+8PkQKOLuoJQRx2vRnHCSm:FtWxtWT+8PHKOuCHu","tlshash":"6ca3d8d9190ad0d0ae9624ded473ea06e0240d13cd7ef163aa2cedc0789dfa6d947277","size":99430,"data":"","first_seen":"2026-02-08T14:59:38.270159Z","last_seen":"2026-02-13T20:42:24.441263Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nexo-airdrop.com/49c334581b960a10.css","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /49c334581b960a10.css HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-1240c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1403\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GnLolF9VzCOCDxRi4%2BvHejzlX64%2BSn%2FmvUjQlYNiq3LGzgQGfrv2tgdob%2BBPBruFMmn8ktxot6Hd7SnyMdUdPyJs1PLgMWXjZxV928nlvvE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf26c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74764,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (63243)","md5":"124a291da10a60f9dbf1247cbecd8e46","sha1":"d0fbce5a00e56869d764008e873cf1302dc3e64d","sha256":"090c0b5162b9d1a5799553c10cc42e51146ea5291825479bbcf44e6e70e6502d","sha512":"f52e0d07bb2b6fa4dacbb7502f0e9465dd4e971838edd53908232ede738163221ab99260fa962a2c3f88160c81386f10b60b912dd43177547a100a83dddc9ff5","ssdeep":"1536:GwpfUfOU66z91yhYEeeBq7PBbCJXoR2mp8oZG1Ic:Gw1UfL66z91yhYEeeBq7PB4w2mp8oZGH","tlshash":"9e73739e6f42013f6c6381f6d294ab9ca11bb0c1ef2616fbf99255018fd03f72d66624","first_seen":"2026-02-08T14:59:38.251195Z","last_seen":"2026-02-11T04:03:52.787107Z","times_seen":6,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/index_4.html","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /index_4.html HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 1403\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RrnjPcyrdaR6IUK2iOzAgZvg9X7GKNZ7UAVcGkCV2MKKmKFxc9TJQh%2BpINKkGums8ttSjxnl5bQBbNXRIPNl3nunAtjYnuw7UHwRFMapJIs%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21805f53c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":479,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b8b916caf9508aa0bcb27716bbf83168","sha1":"ccb37900753f6e79ab72b92a97ea4b5d7c583cb4","sha256":"3703f9e7452226474b8ba75cb4759d2a5d76b2f0b5ee52633c91d215f6f2e813","sha512":"8a3ca3a6a146ffec769d7756e59b810ad424ca3605dc6bd1362dace420fc98929b13fa963feeeb11aa1d9f3ef62424b78dcf48db91ce0c9296b2059a0a067ab5","ssdeep":"","tlshash":"85f05ca05114b40a220030c027c7f1de8243fe4ec900eca0f69c8184cfea338c493a94","first_seen":"2026-02-08T14:59:38.21818Z","last_seen":"2026-02-11T04:03:52.76571Z","times_seen":6,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/0ddfd6b1e257170f-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/0ddfd6b1e257170f-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac21818a56b28a-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:27 GMT\r\netag: W/\"21a8c-19c3cc63156\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1404\r\nset-cookie: __cf_bm=9ob0US6PQBRM0w74Kv5I0fcLncnZJsM6Pm7hzt30Dts-1770564234-1.0.1.1-YIl_XpvcKlVdBjgHYo0JHqm1IO_aFNrUThLQNfeAjYiNdLGUDAmze2zN6MD8DgsGWyoUOf1dDrQlWS_z_Jr6ZqHZXsdKwlK5G07WriVQN6XzUGlv79y2PMaGTQl5Pr2l; path=/; expires=Sun, 08-Feb-26 15:53:54 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":137868,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"a55adfa82ace257bd61c26c2a86b8852","sha1":"f2ce5fdbff510c5fd8e138ab4d2f94d07b007039","sha256":"00c14d4ce441993e3413162f60a006701f53f8245922899f420e0ab32f02aa8f","sha512":"adb0eac7133d8d015fd5a8ffe1f54ad51b2155bac52ea7ac4c28c78b93a0a71a6b682354f71f07e162f9d7abedff97051296fae1a05d31fae41b7b3873b27084","ssdeep":"1536:v3a/iLAuTFylGEj29ggA2QB7gVWh26egbsEFaYVYK2JTIgZO:vWidT9OtgAjXhAgoEFa74","tlshash":"afd34a47f74bc70ad5d6ae358e62e338b775f9387f2f170baa445660ad870948c24388","first_seen":"2025-02-18T06:07:21.695785Z","last_seen":"2026-06-22T15:07:09.686623Z","times_seen":33,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":65,"dns":14,"connect":22,"send":0,"wait":17,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/042a00f4b3c474b9-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/042a00f4b3c474b9-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac218179ffb28a-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:08:46 GMT\r\netag: W/\"21e34-19c3cb9a942\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1404\r\nset-cookie: __cf_bm=eyaAySicZaaJXRndQqkYgLBouuzeBtSpxR0h40tH7pE-1770564234-1.0.1.1-d8PeSSwQ9JVcxeEYyq34arKWT0JjmZ0R1pwml7.GRz4E1x1ugWTVPZqx26DEho3bPhf3tUkwhbfJQcg1w_xlL8zIgj_pFVAFPi2vlCjKcEBjPl0W9mGq7P2O1NAAz38V; path=/; expires=Sun, 08-Feb-26 15:53:54 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":138804,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"daa1324825c8ed8cc6e66ffa594f14bc","sha1":"9d5d73e867441c769e920fb2b0065d9538028b73","sha256":"624818e1ac54c05dc9ca0b266c020d54f82e7b56597b9890b075524b5f11831a","sha512":"4a1d2dc8ec668826e97726c84593da6bbf0362e28c100bc160d5b65abf50466725089da4473dbd11e53290a09cf6b4eb471b5ac92e5aae1c0f2d21f56fe3b24b","ssdeep":"1536:xzRA/iLAMgPUSDbEaAdKdwYV4Eh2TTiuRDKJRp0mFI/jHGs85JPz/bTe:hRwiebEZdKdwYWtiZSHSFC","tlshash":"b1d34b47f75ac316d1926e758e22e3317f79f834bf2b2b1fba415264ac8a4804c94798","first_seen":"2025-02-18T06:07:21.702351Z","last_seen":"2026-06-22T15:07:09.721927Z","times_seen":34,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":92,"dns":5,"connect":3,"send":0,"wait":20,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/684ff108e6721b29.css","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /684ff108e6721b29.css HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-aa8e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1403\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SozsrHaaLGaVJ3%2FNpIy4Ti2129%2B5Os2Z5GCRj%2Fh%2FqMvxcorQ1kE2F7N87%2Fg223IGBw%2Baa8t%2FZuNuYEHxm9tS8etgjQGMd7leOCfo96U17bA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf25c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43662,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (41550)","md5":"5352fa66d7e8b63ef51b4dbec558837d","sha1":"5d8a71a40ce6b72069f65b83cd9e007d0552d20d","sha256":"a56f265c9a5e705d9cc6347faf9c28e4e7d275b79895972673784f17fc3dee43","sha512":"0f2371532b21096229d13b1d2211414cf2a0fb9b10eda0b36684144bccb884489b188f7f2558951ba515f72bf153ae41086a6d68cca69b0fa053fcd4578dcdbe","ssdeep":"768:y1fDnOjQSyfD0YUqhqvpo06iXw29FZoe8jucp:ynX4iv1p","tlshash":"2613555ab140423bfed787b9e056b198b1266cc5fe379bd9e90256b082d93f32cd2344","first_seen":"2026-02-08T14:59:38.241778Z","last_seen":"2026-02-11T04:03:52.762328Z","times_seen":6,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/lockup-black.png","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /lockup-black.png HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/png\r\ncontent-length: 2529\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\netag: \"69868ec2-9e1\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OIrkWsDTvuy8CIuhRRoJ2tY1xvgRLCNU4Fw4OfgtCvNjRpKZ19Q1pehziYYo8dVev5vzXcqcJcK4xNpdzQ5ZGJUh206%2FCXkfh7FWGtzaqFA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac217ecf2bc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2529,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 64, 8-bit colormap, non-interlaced","md5":"a2e4901710adebed7d73afe1d8d16761","sha1":"99667b4216f79b9c25054bb0837fabda9c79625b","sha256":"60a4170aa0956eb89b5f8beb65f6a93e0e8767588e544e65f01b34f827cece38","sha512":"0d76fe008470fc5dd60c7c860226f1902fdec1cfb6b586d1214b21b41a0924381a6ab4859f49559b991a7648d9ecd9dfb5184bf2bffd639dd6d7c8655bef875a","ssdeep":"","tlshash":"10512db3ed0f8a09c4d132f9a7d60ad26553b16a59a99f130314c95ad8508c8fc2380c","first_seen":"2025-02-18T06:07:21.68996Z","last_seen":"2026-06-22T15:07:09.652046Z","times_seen":36,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/index_1.html","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 1403\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8aPwGT7thhL1j%2B2eME5j76J3XToxEMb5%2Bwbx3sDrQBNzH6TqrZ7xy7P9zwhrINW4EVTUw1CS39pZoY%2BVun%2BBsE%2BL9%2BDsCwH2yG4zGR5osGw%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21806f54c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":244,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"c7c1e01c73f0dfd877bfb32a6294af12","sha1":"0a51375bae31e5f8c47a105d33b67a05baf53c78","sha256":"b2dc1dab75ac996f2a3af7cdb627d970358fd59fb0f91277ac64b81ba690b571","sha512":"e3ba21ed856f2a3a9ab50a13e8ec65f8fa4436748f3d645566a778450f0162d5371329a0a20a5d82bdd57fc762f54c7a26277656ab6ad6db0dd8b03cbb708a75","ssdeep":"","tlshash":"14d09722d105480e98018ad2caeae2c8c443d82cfb106d24bcf23720a66c223842263c","first_seen":"2025-06-28T16:48:34.945511Z","last_seen":"2026-02-11T04:03:52.785057Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/index_2.html","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.309Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /index_2.html HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 1403\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r%2Bur0HbXuJuxDtfLiWx5fCc2gQ6tVbQypZPlJLowCZqrriuQl%2BMOuXCMXNkT7xApiV4lfp1JwpLxlW%2BlyeJoxF%2B3zfFNlyacfabT9B04F%2BM%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21806f55c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":144,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"c0043baabdf16fca37148f72e8555ae9","sha1":"2ef15aa1adc09bde0d07b36592914e0db26fc7d8","sha256":"fb6571d56760d1c18a9634d89797d272311844e5b92b7fc71c6f8da6743bd392","sha512":"99d092b1f8481246875dfc2c2114e4b437e491f63812b438ee7fbf02a24223fe27223351c2fe05afbdfa95cd4579dfd98e5efb7eb946d08a15250affc52b23cf","ssdeep":"","tlshash":"bfc08c229800480e29009e91cb8ae1c4c402dc2ce8215c00b862a144a9a8121c012548","first_seen":"2024-07-19T02:09:55Z","last_seen":"2026-08-06T23:22:21.671319Z","times_seen":245,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/navbar-personal-loyalty-program.png","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /navbar-personal-loyalty-program.png HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/png\r\ncontent-length: 119525\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: \"69868ec3-1d2e5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SgryOTr0XcRTk26z%2BKL3qcEqsbS7mrgpU%2FNQzAsvFBKstrnHfo8Fj5izztcckUZ%2FNq7RiMmd5Fzu%2FQKdDE5ZEUkwNCtfInmf%2BTQ6FL5WPis%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac2180ef5ec272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":119525,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 955 x 306, 8-bit/color RGBA, non-interlaced","md5":"ef9748ee1c83283609f4a788187fa160","sha1":"53e40dc81a1cf93d4cba75125726d68571ec6c4c","sha256":"47d931e6480414a8d5a4e53421364d8185ce2d01f7f2e7ed3726e9015fd8aa98","sha512":"731ffc435fd51b0e0406959896fc14942228360bf6e2bc5212d9b1158ed6c71f48ce3cbbf8106fa09da04bfa550ded1d0dc42abe35da34e294e23e948e6718b2","ssdeep":"3072:CDSJSpwDlaJrNmG9VT2ZL4aWc20WKYGVAi3SNTK:C+4uMJrNmCVSZLLWF0j4+","tlshash":"79c312b4f8803712ccf70193e128fc0a2da727d5ba46b61b7a065fb248a795487117bf","first_seen":"2026-02-08T14:59:38.238077Z","last_seen":"2026-02-11T04:03:52.780977Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/index_3.html","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://nexo-airdrop.com/index_1.html","date":"2026-02-08T15:23:54.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /index_3.html HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/index_1.html\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 1403\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j%2FaMVHmHMCweYSqG1pBeski6ZvEVYb%2BXlqh8XEHKhScUPiy51psZjk5n9BHaha%2Foei03RjcHCP0vrp7FLwyNcr1VcLtBa5YFmlg2mSzqCbY%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21834f9fc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":396,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"57302211dfbbe622631cb707b6159ad1","sha1":"53dbc10f8066403d874a604b132583fcef0a0cca","sha256":"957eb9f5943ffa20b1c955af0acfdeb114b28bdef53d8fa8546c4df2739e38c0","sha512":"2f7e051d2db698be106573bc3c0eec5a88052fe3febc937ef3b37f94559b3e4f24602df3100ed22fd7648b28c34d7cb78591554c9516ed12dbf310529e5f7bdd","ssdeep":"","tlshash":"74e0f1938311c807055667c13fd1f208400bff1ef5419c9079f594a8a8ee23ad416984","first_seen":"2026-02-08T14:59:38.255997Z","last_seen":"2026-02-11T04:03:52.772978Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/modal-exchange-cover-1.jpg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /modal-exchange-cover-1.jpg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 201421\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: \"69868ec3-312cd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WqTQzxRTsg4mGM5nWS782HtN8FDraP4%2BIoCXbJjHkX2TqHlEtJK2FNrRGY4umd2SqbHHebTdLWpj1T5W79w0rOHq1iTk1E0ckhXj%2Fw34Aq0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21810f65c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":201421,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"988850522737076891de094730defffe","sha1":"cf5169d38e382077c7d4bedddcf1a8abb7f3e146","sha256":"71c4c77512a9f7cfb8fbfaf96c3e66d412578733dc87f6c79e65853fbe5ba18a","sha512":"e92475a94365e81296d080c58066d28abc451b48c085d81a6caece67ca43e537b839583b74387cc7ba00169816e2ba20d194c47717413250791b7b30adaf1e18","ssdeep":"3072:lpvGIaa3ohiAcF1GeIvBRTAxB0CGMGpm30ZdkA1S3kkxO0tAVcEaqTOiTt:lgwog6jjT9M13jTQcDiTt","tlshash":"301412286822720af4dd333649c33738771361b0d3a5e5a5954e242898ebf899f71f5f","first_seen":"2026-02-08T14:59:38.261539Z","last_seen":"2026-03-18T23:37:37.434113Z","times_seen":10,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/modal-card-cover-3.jpg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /modal-card-cover-3.jpg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 287734\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\netag: \"69868ec2-463f6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JYEl1UL%2FR7Loh8%2Fw0LGOFrayeIyoZH6kSmh%2F7QDJKsAlPk5GvggZy5b9%2FA8ZsXhvb15BXA651uXLeQwJIeewTmTwEYteaeRrq6xjoXhudFU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21810f64c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":287734,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"fa28c7cbe23457a382757592a9d49bf5","sha1":"44554c5c1c0ea5c1e8fc77147bc19e573ff6db1b","sha256":"2d5d6cfcf8368719b020858b316354357f9aeadf526b538193f5b7375fc9fec8","sha512":"12c04529f44ddbe37066389810d2f45100522d79f9227b0b3268f52af8d0413897b3faeee03ebeed7552474ab54756230306c60d21731b3ddc5b9476dc0acc72","ssdeep":"6144:y1kbUAOErJbqsNJBFikQHcdYoF0mzCzdI3Z2:yybUarUiJHxSH","tlshash":"ab54236da4bfbcccddce7930c56d8f4385a2d197c91c0986e9bbec0654692e1f61201b","first_seen":"2026-02-08T14:59:38.225944Z","last_seen":"2026-02-11T04:03:52.770056Z","times_seen":6,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/a304e72db1b9eeb1-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/a304e72db1b9eeb1-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac21817a1eb28a-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:25 GMT\r\netag: W/\"21d08-19c3cc62849\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1404\r\nset-cookie: __cf_bm=WQ.0T5dcGElKJgXnG1pYFZQHiZlfdkpI9JW3EnaNEJo-1770564234-1.0.1.1-uknXs3hk_wxevVSaZDTyK4s6r_O0QN2xwqgXPM5Xu31FRuLnqiirDm9xgenAdgYkFwHfDtuzFhIi5DA37pIBeFzvKMtcuq2PAXzlMeQDL4gp.zue2NqmAiJ_X.UnLtwF; path=/; expires=Sun, 08-Feb-26 15:53:54 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":138504,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"4b1be56aba8f613af50d404818c0a400","sha1":"ecb0151e96be45e03fd43382c1621431861e3f34","sha256":"0928cfe0f4aa200fe2e2d3f35c5fc7c3c46637bba58fe5c424b517fa5d433072","sha512":"c5ce0ac0e8573d18212d47b668d7a1cb6308c7bc7350c5d55a8e972e11e604bd61be34a6ff8152eebc3c68fe22d2a18c44627b2178085f67b1d49717225d3472","ssdeep":"1536:WIi/iLAYEiiE8lOv5edcO5I+f3puAItHpZWzwP1BXAyCeB/7sfWP0rfqO7lEVGY:WI+idEZOR3+II5uAItH1BXAyB/IfWPoS","tlshash":"3bd34c17fb47c713c496ae399e21e331b77af5357f2b570fe6846620ac861808c6458d","first_seen":"2025-02-18T06:07:21.724693Z","last_seen":"2026-06-22T15:07:09.702072Z","times_seen":35,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":53,"dns":0,"connect":3,"send":0,"wait":19,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/null?e=jscdn/getFile","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"POST /null?e=jscdn/getFile HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nexo-airdrop.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"t3crd54291xppjt18yec\"}"}},"response":{"raw":"HTTP/3 405 Method Not Allowed\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:55 GMT\r\ncontent-type: text/html\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lA1rwfefhPyHw2aTXexknnPdPqJswr8ufLo%2BtLx8UJ3%2FoqLcVSpkz02CryaNwFpWFL77ehpxlGEUpfRCLrBDHfNzacy8%2FG3QJ8B08eGqg7I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9cac21834f9cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":166,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"d5ce8ba8dcf98117e9329c3419a8298a","sha1":"fde2a01dc50e1858314b5572887549e2bc2b19b7","sha256":"0e3ae3475a519a5c9f23858c084d3bcd133111e4f42234e99bf09652c5fd937f","sha512":"98f2673ba8d2e2afa175cfd09e401dedd0e5bbb09a0c20aa3c7395343a79a605ac6b2d5af83d7e2f46586de4e0444e0fa86c9641edd26d0e75db4292fabc4f3b","ssdeep":"","tlshash":"17c08c6e271b3c48c66321742ac3f4b0c28e92a284f84300a444005331c32269acbb51","first_seen":"2024-04-28T11:50:49Z","last_seen":"2026-08-05T03:07:59.9369Z","times_seen":163,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/apple-icon.png?4749ef0a6ce1ccdc","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /apple-icon.png?4749ef0a6ce1ccdc HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/png\r\ncf-ray: 9cac21846a45b28a-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\nx-nextjs-cache: HIT\r\ncache-control: public, max-age=31536000, immutable, no-transform\r\nlast-modified: Mon, 19 Jan 2026 16:02:07 GMT\r\ncf-cache-status: HIT\r\nage: 1725707\r\nset-cookie: __cf_bm=_vyh4Jf9Q0bRdwgRZkfuMreEb6v4QKu2bLB487Q3tTw-1770564234-1.0.1.1-Q5qFAidoj_skkmI4GZqXY7kV.m1Rb9sDdT1JL_JeSqxXmmnBhCNfJEFd4wWMlo_DAk5FcSIHV2rNWIUD_pozhNkb2Cx1Cc7yxAGI1iVmpdHTTtZ7q2x3e2cqgQCta2YV; path=/; expires=Sun, 08-Feb-26 15:53:54 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":2000,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit colormap, non-interlaced","md5":"e6ea14fb6c7ae07d69896c0033b397e6","sha1":"888a7e3d4c71873ed4bf823a9688f7e3a7fdf17f","sha256":"0e84447c2c33d8657fa28614db2d73d44c23ab666dcea3fbda0043b605fca630","sha512":"279c25a60f2e447432e75422bfb7ee60e3067d5b7494ff45e1c9ec436ca3e832604801dee6dbbb977655605c3243b36aa9823752146c30fb5042fc68c5a067f2","ssdeep":"","tlshash":"a3412cb50a401e3ec55743b8ac02a90814b3ee504ef6754dfd16518c5be943a85f4d62","first_seen":"2025-10-10T22:37:16.828011Z","last_seen":"2026-05-14T12:58:31.952997Z","times_seen":30,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-08T15:23:53.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:53 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CA2abJDWFmp5ntteeNFAZWuMFYA7j138cXiRkEeVMSTpEML6iM9NavenW5s3jhmO29QV%2FF01cHH6nVwERBodr1DzMHGqcbijlxj9EYlZPZo%3D\"}]}\r\nage: 1404\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cac217d8e5949c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":382649,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (43730)","md5":"ba7396eac538a1de88b1e4b2e81fbe36","sha1":"9a121d8a37c8a3dbf462d305b7f7cc04951cc39e","sha256":"51b81def949dcd957cd2c8935356ecd9807ff3cfc4c4e973ce28f3f6bd887e6d","sha512":"cb7428e516a7bfd07b22c4dfdfccfad2bbd676fedacd6ba0a16989d394ce6cc277b9057f42c8d04efa1fc6ac3b3490a90861dc88f00e57c296ae1cf34b39117e","ssdeep":"3072:etO31XeRSD4MrPHsycKaRyNKaYN3nWbfAFjDK+TcDMOu7U+sjTcuMCOYCQ5hDucS:AhsjTLvpCADuUu","tlshash":"bd84e8b76690232ee2838799e5227b587022e95ffe338ddcf24c437057cdae98d15648","first_seen":"2026-02-08T14:59:38.240192Z","last_seen":"2026-02-08T15:25:16.048716Z","times_seen":4,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":100,"dns":77,"connect":1,"send":0,"wait":20,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/883ce2b13657fbbf.css","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /883ce2b13657fbbf.css HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-4dcf\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1403\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w0uK0%2FcMMhspx8mLlJp0G0TXIKGrdniduuP6TT8fNH6ro5JMt1%2F7vgDNhSW88NxLp3pfEHG4rWPJw1yPYcO22osuX1Lm1o6Kf0AgHlWNl2A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf27c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19919,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19919), with no line terminators","md5":"5150a0ab5632871c7205e57ef92276bb","sha1":"fa4bb38c936b413d40ecbdec86fd3445289fa36b","sha256":"cb09d3c166cb72be4c9a1af9b1c5c88aab10bbe332b722fb5e7df69413352276","sha512":"c76ef579adbf0f98f66a1cf6243658404b30329634716e84d1121cf34bc1ddc54d215ea7b5b10349a1048606566c9c5e24d56eee758203028e3c1d5bf65ec4b6","ssdeep":"384:XgYPEug3xoys3EScVsI1OS76OutbI0pNpEncGYxRC0K5cu3k:XgYPEN3Wys0FsxS76ft00FPRD2c2k","tlshash":"0b9262dce68150321c4390bbd7dda40d952a61f0ee36aef7e5e2128d43c63e22ba3755","first_seen":"2026-01-01T20:02:11.555951Z","last_seen":"2026-03-04T18:41:36.541597Z","times_seen":12,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/bootstrap.min.css","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /bootstrap.min.css HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-2e50\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1403\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hDqFbU31v2A%2BqalD%2BOI6W9hoxn%2B3V66ttelQ0ur4t0d09ePpaDsSBFpbKgKoOKDwI0dGjFFNtYPk8bsfoybLSL8wx0MmpRndLY5Jhx0ojJ8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf29c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11856,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11763)","md5":"abc17162416e88c12c5a3033e53e4ef8","sha1":"36f905ddf0408d067afe32d0b006e0eccdc0ea24","sha256":"734ad0f82c4c4b7ed522616573c56f4ba29938cd2c311d92698145b0de7ddad2","sha512":"b189eba7a26a8174fecce7071dcb05c4d2876399587ef34b5ec456f6554c21b7a1d470eb4b2f5c8f31ed19851e32d41a0e6c304aadb3358ebe3b3c82fd3906ed","ssdeep":"96:e27fizipfmmURN0wbDT1aLVxiTw3T1c1biu1G1j1Gj1G+1+cn21+cEgD1+c1g1+R:e2Gif5Rxx23a5TMwJ1kXG1jw33p96","tlshash":"0c32dfe2832bfc6f9763301bccd2354d363a44759b62bacced8a19d643865e42763391","first_seen":"2025-09-26T18:44:58.800291Z","last_seen":"2026-08-11T17:57:04.741531Z","times_seen":2481,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/powered_by_logo.svg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /powered_by_logo.svg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"69868ec3-144a\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mNnndb5u9VrYC5Va7IZdfeWNoipERqeGXN9YqMYPZmwZkv0jXa4Dfut%2Bir5syULy3QrriaDFIeFNeqV5yycE29aSHaXpQ8a160HCjn82CC0%3D\"}]}\r\ncf-ray: 9cac217ecf2cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5194,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"63e737d3544164d2b7f4fbca416ac807","sha1":"030370aa38715e4c41589633f69d0bfe8255d46c","sha256":"5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d","sha512":"31ee1bb536c0e50f5568a415ea3308367bfcfd11d2a6f7dff1c8e3a982f7be790c240a603cd4c6e187672824b8e5d07646049a28c6a88a7b001eb9a0142f312b","ssdeep":"96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV","tlshash":"93b1a9f5aa45d29c391e8984ce37a964551fb4eb7bfe83d06192d332e40ede0f900c18","first_seen":"2023-05-04T19:47:29Z","last_seen":"2026-08-11T20:53:16.018249Z","times_seen":121287,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/modal-earn-cover-v02.jpg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /modal-earn-cover-v02.jpg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 197682\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:50 GMT\r\netag: \"69868ec2-30432\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z%2FSKuVcBAPGQypCwi40UgKz%2Fp%2BKor9zMvIS0EdFWOZ0XW5w42R4MyVEeqHuav8%2BBkdIoLYNriDZ40mH2BCKI%2BP%2Fr%2BNe5yo%2BwhJgl85sraiE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21810f63c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":197682,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3440x1256, components 3","md5":"e9a2360d686519b623fc826dc5f48e69","sha1":"1ff8b44303462d639c718778adfe8621df256305","sha256":"26d44df2d0f58a35ecbaa207c1a7ba0d27d77fb8fa9e9ca6198f3adb61428b44","sha512":"dc1b9c469b6dde4a7f43b661244ae7187f5f6695e160317e1908431a01cf54eb4e14a31184468bc2fc9de6a7ca7d49688eede027a59471b9f804faff2853c6e3","ssdeep":"6144:/3jPd3zco1SZQRijyhZzS9BTUWje9USsqGB:fhwo10QI2zzS9BT1K9xu","tlshash":"fd1412f34505f733f86f9bbe2587d2e5725a8cb329e12445933398b19284207ba5d4ce","first_seen":"2026-02-08T14:59:38.228244Z","last_seen":"2026-02-11T04:03:52.772451Z","times_seen":6,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/f1-digital-asset-partner.svg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.663Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /f1-digital-asset-partner.svg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"69868ec3-7bab\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BCbh9ZfVlSwmIVCHwDlEXnltfMfn3%2BfOb2gRastkMaLcRTrjG21stOqE%2FdbXdE2uebcQs2Xoykjnu8kY27YItII4jPlVy1g0T%2BYllYaBpzk%3D\"}]}\r\ncf-ray: 9cac2182af86c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31659,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b84ec9730a3118729a6852f3a46cdfde","sha1":"c64e5edb945294566f9e7dc7fc8936ec088db577","sha256":"63d063f420a38317a54b18eaa8bc7a07c8e79d129db1a57017b3b7dcdf036fc5","sha512":"251d83ef6836cd0a7d322ad80477b2abd9de955508fb7e2c4096571f3cd273a1fb842ab761b3de2de27f7017d405a06295da373c1daac4e39d5a498ca234daeb","ssdeep":"768:JRTP3tWkTQMatysWEttPHztTDNf5GbXWIt:Jd8k09O/","tlshash":"95e295ee2ae45af4e845e2f6be1111dc381658bb7d86cf34c39d9f19389646c8e14cc2","first_seen":"2026-02-08T14:59:38.235836Z","last_seen":"2026-05-26T06:02:58.886243Z","times_seen":15,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/home-atf_full-f1-d-01-02.jpg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /home-atf_full-f1-d-01-02.jpg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 213313\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: \"69868ec3-34141\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oVrNU%2BZej%2FWRIXgwGUaDQ8%2B%2FLy3lf3t%2F5%2FpCgev%2By9ONC3pfZF5AjEr%2F4yzqwy%2Fyerz2UlkNlrddsFZ5%2FAi%2BDpLZlgfvpD5HQXOZj712DcY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac2182af87c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":213313,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3808x2128, components 3","md5":"f3b90c7071d461fce6d5c5b61ed3f898","sha1":"5d6923e4b9e2cea25f250d2c23be9df616304bbd","sha256":"8b197df5bc44e780d1ca742f895da0b3ee408acc60a85ae7103f24f20bb987b3","sha512":"73db0856347f8d0add2cb4fef3593d4624c9126309e447fb7d2ceaac0b20cbbd00628ae35d31858834532838835266ffd272dfbb2cfb38afe0d742c23e286f7c","ssdeep":"6144:A5kGQoF7njWlhW9zkhdgN5UWHYSXTYBy6o2VtH6:H7k7nMEzJN5U4pkBy6oSH6","tlshash":"49241263e6b8747ad11ecb35d1570f657bb272a68ebc1787f868c461b0d13ac2ca1680","first_seen":"2026-02-08T14:59:38.254477Z","last_seen":"2026-03-18T23:37:37.449507Z","times_seen":10,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/01a4748c34ee3248.css","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /01a4748c34ee3248.css HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-20a2\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1404\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oRCG5Q1ST6IbD0vnrdWk3V9s%2FMBPLIgocMlRzuiLYCg0KudWbRnsiMv7QBPUEvp%2FH1IpaNi31fBJ2aUI07SDcFAAi1nNoztSirHZWSVwOpU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf28c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8354,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8354), with no line terminators","md5":"282aff559cf7ec6a79420ded0370ec99","sha1":"7134734c7f9c22fdc59f65e4509d2cede45605ec","sha256":"d5b5993255dbfcc3158ca9959808f858c36f87cadfa7c2c9129e9d9d8b744de5","sha512":"00530959fb3455065d7888fcd35bd789985362339fe9a71d1fbca64b1fc2c32d647f76957656015b3dd14a1015dad49bec7f77f70add873a85df4ed817ca1eb6","ssdeep":"192:jCsf6EsfZ0bQ6Z/Qz6xM6xxsfj2ysfq/85sfBUM:jPpJI/OM","tlshash":"6e027114e259903b1c63e0d5e7dd994d903e70c6ff3a3ebabb91018147c12fa2dab649","first_seen":"2026-01-01T20:02:11.552464Z","last_seen":"2026-03-04T18:41:36.502543Z","times_seen":12,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/icon.svg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /icon.svg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=6,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"69868ec3-a20\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GvGsBpM1ZUVhh%2BHR425LCuiYYNyQa1SzcuNu%2Fxfr6GJoam40U7PLY8JTlwKT0896ACUE4rW2hXAHJDFW3cLF4mq9a%2FAzxT2Q5NKJQPfittU%3D\"}]}\r\ncf-ray: 9cac21846fb4c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2592,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"22e5e7b7216a73890c27e6503b71b045","sha1":"e318ba2412a1f3d583e758c1c3040314074cfa3b","sha256":"fd536f40970a0566ab94c776c83ca843ee2cb3aff9e9da374f99b3b1a672a818","sha512":"bb67c94eefc5fad7962ecd8b7175688d23296b5cc79b6037770bba391f1ddd719bfcf92032e3a4259655f2cc4d393eaf3604e8e9d94382228cde74508493a14f","ssdeep":"","tlshash":"e051a690237a73f8a011fbf8d63258babd2334d476259ca9c3618d14a002029dee88a6","first_seen":"2025-10-10T22:37:16.780392Z","last_seen":"2026-05-26T06:02:58.889666Z","times_seen":31,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/navbar-private-clients.jpg","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /navbar-private-clients.jpg HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 26479\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: \"69868ec3-676f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 1403\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8r0hH7vW1GUCZ5mBu5bGx%2F05hK%2Bri7SlONwn6tB56bAKtvAQQ%2FNwDYmr2aQbT5I7Y2on%2BYulmCjxbw0YKp3JVDb9eX8KOPuMwDB7EIadCSU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cac2180ef5cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26479,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 956x308, components 3","md5":"a608c210953764a9d30549756b15624f","sha1":"5b91f4a34f4fb1acf3648d76dbf2c6f120a59ca9","sha256":"32cc24106d5bf3e4b63a8a14adcdba47e15da61cef03a920404822a759cb12be","sha512":"185512e97406c2196de2f7823648fad32e50a84a996e9e3dec73ba32f5fc4db824469f2a71936ec249c0acfdb62550807ec5686587045fea2b3a8d630c625f8f","ssdeep":"384:dVNwmRW0E1cSbMulUfzzq9mZOKgiQMx2KKwupBDvIwKChnqwJLRkY0D:vWr2SbM1GBKgiJ/ufbKCxqIRT4","tlshash":"64c2e0de62030764fefaac36e55b15125639cbe258f89ccce3116410a3e85f6fe5b411","first_seen":"2026-02-08T14:59:38.259424Z","last_seen":"2026-02-11T04:03:52.771861Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/secureproxy?e=jscdn/getFile","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:55.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nexo-airdrop.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"t3crd54291xppjt18yec\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:55 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kcUVetT1shnPiMaLn3RO4h4Akdgh2IBg43g%2F4SxWfXKkD%2BW3JIHPUuFGhnTV8aljArj4gbhYPH6PbZbRot687zUOdbKGVeFxOh6O3WKuI1k8jw%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9cac21852fd0c272-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3414522,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"0b5e9d4efacaff3d8e26b68c7903e779","sha1":"9451c431bca12f38fdc4a8af1884ea2d38bc33ec","sha256":"4a78984c7303963658ef7ab7366fec37ffc58bb08d0434bd300a0f37b5b67cf2","sha512":"0e68e280049e7fad3350389a325a760de6c815777118785c4951e49479f474b5968d0bc0be5bdffe907b2522ca54001f2289dde7857d05a6e31a9ddf78e8d779","ssdeep":"24576:QOV8/8Yae0PgGswPpBroS7InwbjtsJshJuEbd2:QO7OwPEZJsw","tlshash":"f82523002d5bfcd94f8c7baab4fb2e0795405f4288cd50dbea25edc0256837542dea5e","first_seen":"2026-02-08T15:24:20.662606Z","last_seen":"2026-02-08T15:25:16.058183Z","times_seen":2,"resource_available":false,"data":null}},"time_used":569,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":429,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo-airdrop.com/solid-20.2.2.min.js","fqdn":"nexo-airdrop.com","domain":"nexo-airdrop.com","tld":"com"},"ip":{"addr":"104.21.32.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo-airdrop.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:03:06 GMT","end":"Fri, 08 May 2026 01:01:36 GMT"},"fingerprint":{"sha1":"F7:42:7D:D6:3F:4E:B4:40:D1:39:77:88:BF:29:FA:DC:7B:21:F5:86","sha256":"F2:AC:E4:D5:1F:05:FE:9F:7A:16:84:CC:57:6B:34:CF:39:80:EC:AE:23:2E:DD:F1:35:EA:8A:D3:C6:CA:23:88"}}},"request":{"raw":"GET /solid-20.2.2.min.js HTTP/1.1\r\nHost: nexo-airdrop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Sat, 07 Feb 2026 01:00:51 GMT\r\netag: W/\"69868ec3-19492\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1403\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UL315E8sFfr24icEVaabDJWm3WCo3poCPrYhfh8vi9Mw%2BUDwW2rAvcqVE%2F1R1FPWnKmezZFQQylD7BJEqp49p0rdGGMxIgSOr5WmxYKfFY4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cac217ecf2ac272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":103570,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"702ddc402f5b5a38ac4277d96a33f4a5","sha1":"1e865eb9c88cb8e27c0e7c43333267b08b76484b","sha256":"c338585ca32dfda146fab43f06c633a0352e6e2b8aaed26248b93e6156c2a216","sha512":"ab48bc20114872cff84abde26b803bd25036e4c81ff5a282da6aae156abe771117096226cb280f1b3c428cf0062d868233a4bec66df2a13e5fc04713aeacd088","ssdeep":"1536:Sfiv8tWttW9klw+ojWAz6a/rIr+b5pN/QCO0t:OtWttW3+o6AHFt","tlshash":"89a3c6da1946c0d5ae9510ded073e90ae0680953cdaef053eb2cecc9b49efa69447337","first_seen":"2026-02-08T14:59:38.220322Z","last_seen":"2026-02-13T20:42:24.404371Z","times_seen":6,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-08","alert":"Sinkholed","trigger":"nexo-airdrop.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nexo.com/_next/static/media/e326cf415f11af9a-s.p.ttf","fqdn":"nexo.com","domain":"nexo.com","tld":"com"},"ip":{"addr":"104.18.20.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nexo-airdrop.com/","date":"2026-02-08T15:23:54.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nexo.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 14 Jan 2026 01:10:47 GMT","end":"Tue, 14 Apr 2026 02:10:44 GMT"},"fingerprint":{"sha1":"67:37:75:28:94:DC:B7:E2:59:67:E0:EB:74:97:6C:32:60:EF:6B:8D","sha256":"78:C7:ED:1E:E9:E7:93:28:7D:60:92:B9:FF:75:2C:22:62:BB:FB:67:2F:89:A2:55:BE:82:A6:F1:72:EA:34:B6"}}},"request":{"raw":"GET /_next/static/media/e326cf415f11af9a-s.p.ttf HTTP/1.1\r\nHost: nexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://nexo-airdrop.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nexo-airdrop.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Feb 2026 15:23:54 GMT\r\ncontent-type: font/ttf\r\ncf-ray: 9cac21819a77b28a-OSL\r\nreferrer-policy: strict-origin\r\nstrict-transport-security: max-age=31536000; preload\r\nx-content-type-options: nosniff\r\ncontent-security-policy: frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com https://nexoio.my.site.com\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\nvary: Sec-CH-Prefers-Color-Scheme, Accept-Encoding\r\ncritical-ch: Sec-CH-Prefers-Color-Scheme\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Sun, 08 Feb 2026 10:22:25 GMT\r\netag: W/\"230b4-19c3cc627ee\"\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 1404\r\nset-cookie: __cf_bm=DOjsxCJ0TZToSuJ_ZylVde178rDDVJC34D1pVmrVRU4-1770564234-1.0.1.1-09f4LyUGgCzQbba.VyAUSi8J4Gg4.QWQV7qOvLsEzKXhh0a5txrYtsniM0i8EsnWqtEFdvgK6rURXlyKsbTXV30GMskGvs6flxSum9YhIEvtsGZggTin1nmqY_UlnnJr; path=/; expires=Sun, 08-Feb-26 15:53:54 GMT; domain=.nexo.com; HttpOnly; Secure; SameSite=None\r\ncontent-security-policy-report-only: default-src 'self' https://nexo.com *.nexo.com *.nexo.io cdn.segment.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://nexoio.my.salesforce-scrt.com https://widget.trustpilot.com https://appleid.cdn-apple.com https://www.apple.com https://browser-intake-datadoghq.eu https://region1.analytics.google.com https://region1.google-analytics.com https://events.eu1.segmentapis.com https://www.googletagmanager.com https://accounts.google.com https://www.gstatic.com https://fonts.gstatic.com *.geetest.com wss://platform.nexo.com https://nexoio.my.site.com; frame-ancestors https://platform.nexo.io https://platform.nexo.com https://support.nexo.io https://support.nexo.com https://nexosurvey.force.com https://nexoio.lightning.force.com https://nexoio--c.visualforce.com; report-uri https://security-logging.nexo.com;\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":143540,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 40 names, Macintosh","md5":"fc57eb0147fd30086e477681a884b785","sha1":"983e237872df7276ae77d4325a4d9e3df60edc93","sha256":"d4fe3dfbfc9bbe84e11451d10862806198c4f68700d958f03b66a786327b5de9","sha512":"fdacba42b8f226245c815109bd8c3a5cefbcf3d2f495803a082eaa0e9018a6ee30e2b4cf9b828384e81c92c9515d24c423039c0641297bc68469b975cd0dfc96","ssdeep":"1536:wO3j/iLADD6G9XZwAQIkOZwuFIKI4rKm5bEAYEyWj4kZVvyGWIBIis1wF:TidG9CkPZEKhrr4kG9Q","tlshash":"14e3185bf797960ada835e759ea1e320bfa6fc31be3e571fb2404668f8c74518c01188","first_seen":"2025-02-18T06:07:21.711469Z","last_seen":"2026-05-26T06:02:58.935976Z","times_seen":34,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":42,"dns":3,"connect":2,"send":0,"wait":17,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}