{"report_id":"876f5778-f372-4a1a-8071-2269de590c24","version":6,"status":"done","tags":[],"date":"2026-01-31T16:55:38Z","url":{"schema":"http","addr":"4359238-trezor.io","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"172.67.210.100","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"4359238-trezor.io/","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"title":"ONE Bot - Premium Services Showcase","dom":{"size":423830,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (20682)","md5":"53432c166eb85ae7a99d766c1d90560b","sha1":"9b49340aeff17875d6b6ccdc973b5758204fcf03","sha256":"e86d148095bf51630a62eb659fe8c2677f9466ac82de759c155ce85605330f9e","sha512":"965632226e4a71fa1edd60a9fba5077cae68733197edfbae9400cf45c1b4d8e63842fa3bcd8a1d4eff8b3535eabbbec7604766a0f94475428b9d6e80959ed32a","ssdeep":"6144:Te/+sP+2PnlHu2aoOvyJJtCN0NKw5q0yrtcMAaHuEp:TArnxPOvyJJYLZzHuEp","tlshash":"67947e68326c117d6ea303e1e4af7606b1383423b40e8871f51cf8656be59d63467fae","dom_hash":"domhashfea5ee0fa2b0dd5e5e7bbd4b7453b992","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"4359238-trezor.io","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"172.67.210.100","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-07T16:55:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"4359238-trezor.io","ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-11-22","domain_rank":0,"first_seen":"2026-01-31T14:51:10.209415Z","last_seen":"2026-01-31T14:51:10.209415Z","alert_count":16,"request_count":8,"received_data":3430972,"sent_data":3027,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"manus-analytics.com","ip":{"addr":"172.67.195.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-09","domain_rank":0,"first_seen":"2025-10-19T13:04:57.49856Z","last_seen":"2026-01-29T23:25:04.627356Z","alert_count":0,"request_count":3,"received_data":6134,"sent_data":1449,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"4359238-trezor.io/","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f83de6abaede5e7367a59705fdaf4073","sha1":"345794096c37d3f3869a7f94ac035dc1c0d968d4","sha256":"348cdcec42b7dedf482db320f59dcd8e9193b4ba19528b2de939c16fa05a1466","sha512":"e3edbc41d39ee49f43471191f4cbcebf5b634217ef888f0189612c02f824049aee5c0283d2e9e0440b36a71109f506f25071d10cb22cd05659d523a2af5aabed","ssdeep":"6144:z+sP+2PnlHu2aoOvyJJtCN0NKw5q0yrt0:DrnxPOvyJJYLM","tlshash":"11748e98327925796ea302e6a0af6507b1383423b40d88b1f518fc756bf45972077faf","size":366733,"data":"","first_seen":"2025-11-16T02:43:10.998968Z","last_seen":"2026-06-03T22:58:10.192529Z","times_seen":51,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/assets/index-CukD0pOC.js","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"45423e61563ba7fd970ea4bf9a7c544c","sha1":"517c1eb6b9afb2ec88c0489adabc2840b8826064","sha256":"2a7c091c8fd068a8953a6363efb5c0707740b9251b2b54414cf51c0f251a66aa","sha512":"f9f96de1e68b996118e6042b277545d617e5e8bf014da7c0f31cd8646272cd980ada435fbace1fce3fa301205d9b30bc2998a968f602adcad84f784fedee67a3","ssdeep":"12288:STO/wY9buMJzlZXM1e7rMApSI/YQL4vJAmtsOtvcmrhMFL+dej2wRUxXEy8PE1hU:R/VFJzlZXM1e7rMApSI/YQL4vJXtsOtK","tlshash":"2ff47d94319835395ae316f1906f4107b2382925b40c8494f12ceded2bf668a76fbfed","size":744364,"data":"","first_seen":"2026-01-31T14:48:39.892339Z","last_seen":"2026-01-31T16:57:13.198628Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"manus-analytics.com/umami","fqdn":"manus-analytics.com","domain":"manus-analytics.com","tld":"com"},"ip":{"addr":"172.67.195.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"72f32e397a4654c165924d8dd2113b1f","sha1":"23c3d68d3c03d544bb9a56ddcc9cd702f74613e4","sha256":"7eba89b02651cb67beefeb8aed5d39402f7994b226114c2c639ae354dc1a94f2","sha512":"35fb2163cff1af85d4133d6e791d867253eb213acaee98470a0e165f870951e50d23a83770e1ca42dafe3825b7ca73d92d329b73795a96168e084fde32a56b22","ssdeep":"","tlshash":"5d51f8f77281f0f13f7938d0c1b96224ba391e72b82f4091b6f91c4b8b0d9165131ea9","size":2618,"data":"","first_seen":"2025-09-23T15:56:30.742447Z","last_seen":"2026-07-25T17:18:25.054015Z","times_seen":694,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"4359238-trezor.io/assets/index-CukD0pOC.js","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:16.356Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-CukD0pOC.js HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:16 GMT\r\nContent-Type: application/javascript; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nX-Powered-By: Express\r\nCache-Control: public, max-age=14400\r\nLast-Modified: Wed, 10 Dec 2025 10:04:24 GMT\r\nETag: W/\"b5bac-19b07b81840\"\r\nContent-Encoding: gzip\r\ncf-cache-status: MISS\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=irNx1HaJ6ze2HS4PhxhGMun3Ukzt6vJ9fPrCF9oFDOZDczePstbLnugh3MVm03lM3TBvvxctDaRRpt1y519bylUXwJrT3s00lAcQjeTJFNaM\"}]}\r\nCF-RAY: 9c6abc573a1fb1b8-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":744364,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (12944)","md5":"45423e61563ba7fd970ea4bf9a7c544c","sha1":"517c1eb6b9afb2ec88c0489adabc2840b8826064","sha256":"2a7c091c8fd068a8953a6363efb5c0707740b9251b2b54414cf51c0f251a66aa","sha512":"f9f96de1e68b996118e6042b277545d617e5e8bf014da7c0f31cd8646272cd980ada435fbace1fce3fa301205d9b30bc2998a968f602adcad84f784fedee67a3","ssdeep":"12288:STO/wY9buMJzlZXM1e7rMApSI/YQL4vJAmtsOtvcmrhMFL+dej2wRUxXEy8PE1hU:R/VFJzlZXM1e7rMApSI/YQL4vJXtsOtK","tlshash":"2ff47d94319835395ae316f1906f4107b2382925b40c8494f12ceded2bf668a76fbfed","first_seen":"2026-01-31T14:48:39.892339Z","last_seen":"2026-01-31T16:57:13.198628Z","times_seen":7,"resource_available":true,"data":null}},"time_used":1061,"timings":{"blocked":0,"dns":1,"connect":1,"send":0,"wait":384,"receive":675,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"manus-analytics.com/api/send","fqdn":"manus-analytics.com","domain":"manus-analytics.com","tld":"com"},"ip":{"addr":"172.67.195.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.570Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"manus-analytics.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 16:05:36 GMT","end":"Sat, 07 Mar 2026 17:04:08 GMT"},"fingerprint":{"sha1":"D8:8C:C5:54:BE:AE:D3:9F:8E:B6:13:D7:83:D6:F0:DC:8D:F3:92:49","sha256":"E7:5D:02:ED:6B:18:CC:0B:D9:98:94:03:F0:CB:C9:9E:39:1D:07:DF:17:13:E7:6B:62:C5:AF:35:A7:F2:15:9F"}}},"request":{"raw":"OPTIONS /api/send HTTP/1.1\r\nHost: manus-analytics.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://4359238-trezor.io/\r\nOrigin: http://4359238-trezor.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\ndate: Sat, 31 Jan 2026 16:55:17 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, DELETE, POST, PUT\r\naccess-control-max-age: 86400\r\ncache-control: no-cache\r\nx-dns-prefetch-control: on\r\ncontent-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\nallow: OPTIONS, POST\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=49NyeX46Z4xGBu6MBQ4fCaXPnuBOhgLfElIz5X5XhPsB3iJDXVpX5zx4fyHKMtyWjJIqI4Lq2VF03Bs901B7f8oV3BOresBPOoJ5Y5ppPl1KrFg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c6abc5edd6edfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T01:23:59.53248Z","times_seen":17537268,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":7,"dns":1,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/logos/one-gold-3d.png","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.798Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /logos/one-gold-3d.png HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:18 GMT\r\nContent-Type: image/png\r\nContent-Length: 1726044\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=14400\r\nLast-Modified: Wed, 10 Dec 2025 10:04:23 GMT\r\nETag: W/\"1a565c-19b07b81458\"\r\ncf-cache-status: MISS\r\nVary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uC7ItTsNMpcL60DJX35tmPSYAGGMTBvLsplLeA6sug7QokW%2BzNxSDQDcQNp1dAxAO9AcyEGQSbEIP9qP9Fq9oTiMu0MpJW%2FGXylodzh0Ng%3D%3D\"}]}\r\nCF-RAY: 9c6abc60395556b4-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1726044,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1376 x 768, 8-bit/color RGB, non-interlaced","md5":"26203d278e8578734a8f73cac15a01a2","sha1":"072b0b587dee9cbf21b960bc75cedcc81669826a","sha256":"7718e192d8eabb0ef0b9d074d0eeb7b134ee0058760a349538865b047ed438d2","sha512":"f17f408929390c10e2eae789288fa90ef0dd6756023698d917bc8045a17bb02d1d4995365d373a29a279de0c386650bf6b002101076dbbe1123426bed59b20e1","ssdeep":"24576:/MSvZZWHhhsVAAV1sj1ne9nRUaX7VGFu8M1S2MgRz2EjXF:FDVBVadeMaXgM8MdN2uXF","tlshash":"71253324aad39fb1edd7c0b17d85ce125f04e2974b517134a370a6035b69ecb38add28","first_seen":"2026-01-31T14:48:39.889829Z","last_seen":"2026-01-31T16:57:13.207994Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1407,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":350,"receive":1057,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"4359238-trezor.io/","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-31T16:55:15.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4359238-trezor.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 00:49:46 GMT","end":"Mon, 20 Apr 2026 01:47:13 GMT"},"fingerprint":{"sha1":"9E:B1:B9:98:24:09:A9:3F:96:12:11:52:E3:E0:41:35:FA:50:F7:E2","sha256":"54:1E:2B:33:1F:FD:0D:AC:7E:5E:EE:8E:E4:28:3D:8E:A9:6D:BB:AE:DA:82:38:C6:62:38:A1:04:EA:0F:40:00"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 521 No Reason Phrase\r\ndate: Sat, 31 Jan 2026 16:55:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 7000\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nserver: cloudflare\r\ncf-ray: 9c6abc525c37b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"521","status_text":"No Reason Phrase","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7000,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (396)","md5":"b2118b831ea876ea75213a39da785235","sha1":"b0f44f135e8bbefd75c22cbcbb5d359194f80524","sha256":"8e5692cb09b06bf5d838371e074685393c5b00f9f3c87ed36e00c010d0c2339c","sha512":"f93df2c28e47e966d315031f4909431a05a39e82ac7d03841562719183de07a36a27ef63d7f784e7ed3a0b8bea584f4a6e077eeef69c0b03054e009cd1923227","ssdeep":"96:1j9jwIjYj+DK/D9KUumSG4Fh8/G4Fvd424Fu+skKmk2OLwmNnwL557RLlpaQxP:1j9jhjYjKK/BqteUIVO/Q85571lUeP","tlshash":"bae16671f1b5127a109381923695eb1a7ae0c613cbff5594b3dcc6672f9ee81e903290","first_seen":"2026-01-31T16:55:41.408755Z","last_seen":"2026-01-31T16:55:41.408755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":22,"dns":1,"connect":1,"send":0,"wait":188,"receive":1,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-31T16:55:15.896Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:16 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nX-Powered-By: Express\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 10 Dec 2025 10:04:24 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qCP38X1lvrBdwm2ujn%2FmydK%2B%2FFuvxgzvY51hroDgxwOXIFPr4MeYYVO%2FyoRLLsy3fSRGHWtIt2VvxEVTQCbye2TlHQDdwkQauzyL6oC8uA%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nContent-Encoding: gzip\r\nCF-RAY: 9c6abc545cf80b41-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":367791,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (35542)","md5":"0f5656f42453d02c32996a5744aaadbc","sha1":"28cee2f3377baec606f36ce22cb990c05e6df30e","sha256":"f7aba3ef52738b24a7df4b57705eea8aca2b834f3fb4e8308a984aa4fa95d85b","sha512":"420809ab622420e9c1b030663458ffe710b09e56c9d9ecdd7cfc3e2bc62223b93ce24e8b03cddd5127e6c73c16fad8e2438a3f57d49cb15399abdf864ce69753","ssdeep":"6144:g+sP+2PnlHu2aoOvyJJtCN0NKw5q0yrti:urnxPOvyJJYL6","tlshash":"9a748e98327915796ea302e6a0af6507b1383423b40d88b1f518fc796bf45972077faf","first_seen":"2026-01-31T14:48:39.884529Z","last_seen":"2026-01-31T16:57:13.204329Z","times_seen":7,"resource_available":false,"data":null}},"time_used":914,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":380,"receive":532,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/assets/index-B2ElKXMZ.css","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:16.358Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-B2ElKXMZ.css HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:16 GMT\r\nContent-Type: text/css; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nX-Powered-By: Express\r\nCache-Control: public, max-age=14400\r\nLast-Modified: Wed, 10 Dec 2025 10:04:24 GMT\r\nETag: W/\"238e7-19b07b81840\"\r\nContent-Encoding: gzip\r\ncf-cache-status: MISS\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W%2Fg2aZkceqoU5eWyPe%2BblAU0f2plKVyZFoWVmvvjJBfubL9mTBJYpD9cTi7dEpB9bP8MtY3wbq9IXVP8ChaYwtUcWUczPcgwJK9btTYViA%3D%3D\"}]}\r\nCF-RAY: 9c6abc573fbc56b4-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":145639,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"03971cb9563f305d8e60739608a7e047","sha1":"4bf558cbf1efd8ee9cddb427248d79c90d120e9f","sha256":"bce8bd2ad23b0293cf99fb95ccd63c555775c62868ab8a8fa3fb4eddfe8db5bb","sha512":"4362f55625f14b9b7428cd1c7e59c0f47024068e3fd8633c4e2160ff143d1b977449be33c5fd524bf4b9f868a2dff8f16ed6b6858c4623380a6d7ec97bb7153d","ssdeep":"1536:44x4E6hoR6EhRQswUoOzZPFACagSsMq+WDhzmAkX7zMMDN7HvK9e9t6988R988q:4zhoI1UdzZPFAgMq+WDhKAjg7TF","tlshash":"d1e3c4a47265e43fbc23b0f9938cf85c9119b0d0dd2906edfd06a21667d3bf619b6a04","first_seen":"2026-01-31T14:48:39.894872Z","last_seen":"2026-01-31T16:57:13.210501Z","times_seen":7,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":374,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"manus-analytics.com/umami","fqdn":"manus-analytics.com","domain":"manus-analytics.com","tld":"com"},"ip":{"addr":"172.67.195.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:16.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"manus-analytics.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 16:05:36 GMT","end":"Sat, 07 Mar 2026 17:04:08 GMT"},"fingerprint":{"sha1":"D8:8C:C5:54:BE:AE:D3:9F:8E:B6:13:D7:83:D6:F0:DC:8D:F3:92:49","sha256":"E7:5D:02:ED:6B:18:CC:0B:D9:98:94:03:F0:CB:C9:9E:39:1D:07:DF:17:13:E7:6B:62:C5:AF:35:A7:F2:15:9F"}}},"request":{"raw":"GET /umami HTTP/1.1\r\nHost: manus-analytics.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 31 Jan 2026 16:55:17 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nx-dns-prefetch-control: on\r\ncontent-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, must-revalidate\r\naccept-ranges: bytes\r\nlast-modified: Tue, 06 Jan 2026 05:21:53 GMT\r\netag: W/\"a3a-19b91c12568\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tfViSR3p95GM40nihsXsi1o34vyZIRa1Qjix2VE%2FAo%2FojMxxFom1J8Q4OKyzunwBQpowwBoXIEoOM5wx4YhampjMhWLOPhavl49Mk8pGs5drnng%3D\"}]}\r\ncf-ray: 9c6abc5a6c82dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2618,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2617)","md5":"72f32e397a4654c165924d8dd2113b1f","sha1":"23c3d68d3c03d544bb9a56ddcc9cd702f74613e4","sha256":"7eba89b02651cb67beefeb8aed5d39402f7994b226114c2c639ae354dc1a94f2","sha512":"35fb2163cff1af85d4133d6e791d867253eb213acaee98470a0e165f870951e50d23a83770e1ca42dafe3825b7ca73d92d329b73795a96168e084fde32a56b22","ssdeep":"","tlshash":"5d51f8f77281f0f13f7938d0c1b96224ba391e72b82f4091b6f91c4b8b0d9165131ea9","first_seen":"2025-09-23T15:56:30.742447Z","last_seen":"2026-07-25T17:18:25.054015Z","times_seen":694,"resource_available":true,"data":null}},"time_used":513,"timings":{"blocked":53,"dns":35,"connect":1,"send":0,"wait":407,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/favicon.ico","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.554Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:17 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nX-Powered-By: Express\r\nCache-Control: public, max-age=14400\r\nLast-Modified: Wed, 10 Dec 2025 10:04:24 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qiy5LoLnUP3nCP8cA%2F57saf1wwvO42P%2F9Wq3vT6nRPYH4DYe0r1Fs6R9hwAN%2BiFN%2B6Q9722%2Bh%2F87wliEePIt%2BEikttsgWKS%2BnIOqkmaeekp3\"}]}\r\ncf-cache-status: MISS\r\nContent-Encoding: gzip\r\nCF-RAY: 9c6abc5ebd69b1b8-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":367791,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (35542)","md5":"0f5656f42453d02c32996a5744aaadbc","sha1":"28cee2f3377baec606f36ce22cb990c05e6df30e","sha256":"f7aba3ef52738b24a7df4b57705eea8aca2b834f3fb4e8308a984aa4fa95d85b","sha512":"420809ab622420e9c1b030663458ffe710b09e56c9d9ecdd7cfc3e2bc62223b93ce24e8b03cddd5127e6c73c16fad8e2438a3f57d49cb15399abdf864ce69753","ssdeep":"6144:g+sP+2PnlHu2aoOvyJJtCN0NKw5q0yrti:urnxPOvyJJYL6","tlshash":"9a748e98327915796ea302e6a0af6507b1383423b40d88b1f518fc796bf45972077faf","first_seen":"2026-01-31T14:48:39.884529Z","last_seen":"2026-01-31T16:57:13.204329Z","times_seen":7,"resource_available":false,"data":null}},"time_used":857,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":351,"receive":506,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/api/config","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.593Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://4359238-trezor.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:17 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nX-Powered-By: Express\r\nETag: W/\"311e-XJj4VMFGh7rpBwvMllxInfDw9SM\"\r\nContent-Encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HWuCzJboCdLSuCPxB3PPkM0reIgIbSnV30yASK%2FVWN1iuoPN8wUhuCXRZMsSZjp2%2FyCDahKpKpUDC9i0QrizpWWi7xSUe1oShbOZPnW%2Bow%3D%3D\"}]}\r\nCF-RAY: 9c6abc5ef80a56b4-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":12574,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e86d13061458973bc9a306d9adbbc539","sha1":"eab3ea7f23f0cf548ce1aca58922287cc04da743","sha256":"eea38f51c9d5366c77a616964cfecb3544debda5672260456d6f5a2282cbf547","sha512":"dbb82c925469d5b487947dd6ce392cdbc2ea3267f6055b07506c522896c40b654669fdd707e95df0c2631169fa145f5caece492c023e78e86ba5f015cb52357e","ssdeep":"192:AuHDAlDKAr3xHb1I+WlWk5Jkvskehzc/+fJ6J9M06r09P:AujSDKu12lWk5Jkvskehzc/AJ6Q020d","tlshash":"5442c90f1e087cbacbcaca769d77af6fe070472b62e96d580dc9142840797fa5712463","first_seen":"2026-01-31T14:48:39.897595Z","last_seen":"2026-01-31T16:57:13.205665Z","times_seen":7,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"manus-analytics.com/api/send","fqdn":"manus-analytics.com","domain":"manus-analytics.com","tld":"com"},"ip":{"addr":"172.67.195.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"manus-analytics.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 16:05:36 GMT","end":"Sat, 07 Mar 2026 17:04:08 GMT"},"fingerprint":{"sha1":"D8:8C:C5:54:BE:AE:D3:9F:8E:B6:13:D7:83:D6:F0:DC:8D:F3:92:49","sha256":"E7:5D:02:ED:6B:18:CC:0B:D9:98:94:03:F0:CB:C9:9E:39:1D:07:DF:17:13:E7:6B:62:C5:AF:35:A7:F2:15:9F"}}},"request":{"raw":"POST /api/send HTTP/1.1\r\nHost: manus-analytics.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: http://4359238-trezor.io/\r\nContent-Type: application/json\r\nContent-Length: 242\r\nOrigin: http://4359238-trezor.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":242,"data":"{\"type\":\"event\",\"payload\":{\"website\":\"ba2d773f-8dba-452b-9af4-5f155153e004\",\"screen\":\"1280x1024\",\"language\":\"en-US\",\"title\":\"ONE Bot - Premium Services Showcase\",\"hostname\":\"4359238-trezor.io\",\"url\":\"http://4359238-trezor.io/\",\"referrer\":\"\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 16:55:17 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, DELETE, POST, PUT\r\naccess-control-max-age: 86400\r\ncache-control: no-cache\r\nx-dns-prefetch-control: on\r\ncontent-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pAyB1tCgeRXrtuXVDo9XER9wKcjA0Ayc9bNGMX3UO78wDhjnJnf0KPGsXdg0ATOwu5YgcSZQdNHR%2FmFlyvUSl6rMio5Dh95BpO3HzANowsACVPM%3D\"}]}\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9c6abc5fbd89dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":419,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a8aafb732914a1e51e7e71a1a173368f","sha1":"808f613aff41cba0632d0f6f4ef39e1c350990d9","sha256":"f0663551ee52fb0f09998a7e323ad2f5d1771bcf1a5d5999104905aac2a5a036","sha512":"139b8c2a9540bdbdb7f1ba14ba843eeda2a0f9b4145bca7146d5e9bcf304bfe74891562ad8f65e45b637dae526338ed8dfddc03626a844da5220ec44f18ac1f7","ssdeep":"","tlshash":"c3e08152d1aedebe22c133c4cd86c79d4e0217930ac8203210dd4a804f5efcb604f238","first_seen":"2026-01-31T16:55:41.412544Z","last_seen":"2026-01-31T16:55:41.412544Z","times_seen":1,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"4359238-trezor.io/banner.webp","fqdn":"4359238-trezor.io","domain":"4359238-trezor.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://4359238-trezor.io/","date":"2026-01-31T16:55:17.913Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /banner.webp HTTP/1.1\r\nHost: 4359238-trezor.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://4359238-trezor.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 31 Jan 2026 16:55:18 GMT\r\nContent-Type: image/webp\r\nContent-Length: 54372\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=14400\r\nLast-Modified: Wed, 10 Dec 2025 10:04:23 GMT\r\nETag: W/\"d464-19b07b81458\"\r\ncf-cache-status: MISS\r\nVary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z7wmGMDruZz4NQXZzhr7JQ693d5j3Zo1qz1MfJQNQp6bu%2FFKJMkhj1Ec4bJ7DdVs21wmMhrj0c0v7TfpdS%2BUf1A5tvCHGHNnfBHkXhwQgQ%3D%3D\"}]}\r\nCF-RAY: 9c6abc60febf0b41-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54372,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9085f3b04603f7c2877c39345cd3b925","sha1":"18406d970ec68f51a50e5ead3afb582046121d91","sha256":"c01ada1593793349e9f9f70cd5f4ce25119c9fa392b01090454f56cad7ee317d","sha512":"b74e767639669e697ec39bc2a54006fe8b82ae26f1a09b9f2c8dfb3331f216457705f88cec2f43cccf129a6ac6f18cca3c81d48686a9e22d3cb9e7049c7c38ea","ssdeep":"1536:ZYGqBevtdhY5cEqCprkNMCBeyc9WN+2j5oTh:ZNqBeFdhbE7kjBC8zoTh","tlshash":"d633f1fabf465daafbd7837562405eed9c5804b8e3a9120449c07113520eece2839e7e","first_seen":"2026-01-31T14:48:39.8817Z","last_seen":"2026-01-31T16:57:13.215828Z","times_seen":7,"resource_available":false,"data":null}},"time_used":676,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":344,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"4359238-trezor.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}