{"report_id":"8ad16ee0-a109-43f2-bcfb-9e79d00b8b18","version":6,"status":"done","tags":[],"date":"2026-05-13T13:15:46Z","url":{"schema":"https","addr":"appondo.finance","fqdn":"appondo.finance","domain":"appondo.finance","tld":"finance"},"ip":{"addr":"104.21.54.119","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"title":"Explore | Ondo Finance","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T05:01:15.330506Z","times_seen":17737366,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"appondo.finance","fqdn":"appondo.finance","domain":"appondo.finance","tld":"finance"},"ip":{"addr":"104.21.54.119","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-17T13:15:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"appondo.finance","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-13T13:15:48.131222Z","last_seen":"2026-05-13T13:15:48.131222Z","alert_count":0,"request_count":1,"received_data":4359289,"sent_data":484,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"app.ondno.finance","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-13T13:15:48.132774Z","last_seen":"2026-05-13T13:15:48.132774Z","alert_count":56,"request_count":28,"received_data":5180273,"sent_data":12878,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"76244d8526da359429886b03a7ada498","sha1":"90415cd87cc2f928fc8e16b7740dfb09f7e5bc10","sha256":"3f699786f5f750c5ee9696bce7941003b51f5e5628b55aa6ca59917195d8b490","sha512":"3ba24210155df81c4378587bf70fa4a66f8eb44e60d01deca3b32a8ccdd092d350a1fd870334d90469b750c2fc86822743811cba384e7baa95635291061c3adb","ssdeep":"","tlshash":"dcc0125970206966048e787d4ccf088ebe268412a20849c999dcd8547fb1e6c42e484c","size":184,"data":"","first_seen":"2023-09-20T06:28:52Z","last_seen":"2026-08-06T03:48:35.761237Z","times_seen":1954,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed5c825c919aacfdc4abd854383175e8","sha1":"f488907c8ee1d91340f9e7bac37193572fbb9309","sha256":"0619733cb7f778a61a7d2233e4f0a7e43854ec92f526891118f5e6ef960d7516","sha512":"dfc4c7675124469980433fc66898596abb919291c85e7bd99b70df7303d62648a2c70af7cbb3fe3cf7c758b432bee9b236d16c764e3fe06c8ea34a5fd6faf6a9","ssdeep":"","tlshash":"2dc0c090cbfcdc62060900eb503092fc31802f3c010110cec6fec88f50cce801b6b910","size":186,"data":"","first_seen":"2026-05-13T13:15:53.153396Z","last_seen":"2026-06-02T11:43:42.036532Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-08-06T03:46:24.407744Z","times_seen":3236,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f88dc9cd23c6cd902f6fb9a1996b2936","sha1":"9db6d534ea4475ce50dd7c070e0428176d560c0a","sha256":"b83e99e46da8b5b4914ebac50a7330da9c2ba1af2802963b58944be4d3fa1981","sha512":"badf738e50b59ff5a961020224f307327bf60ffc90d692649ccf0b618a57dee9aa811a30c02d69ff716002130b8ce384fa38fa2a7e1858539f52e615a28c0565","ssdeep":"","tlshash":"21019e25117597311677812c170fb756a17440632248ba853e5f9b6c4fac20fc1f5bc7","size":749,"data":"","first_seen":"2026-04-21T09:11:37.896998Z","last_seen":"2026-06-02T11:43:42.038546Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1778678122578","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8ef0559ee319c3e89f25a82bb15d23c4","sha1":"61edb95fc2078686e8c585d3feb4fa789050fc8b","sha256":"76abae5c0eeba6f483333d952c50cb3b73b908df4ff55769104de2d8612d8a60","sha512":"270a975236545c9e6e758b4f33e2e29ee70da1c2d885abacb1d43cfdd99d7094ed40de0546a6a176db9a7d07e00a0078a22592c4c5f23114159674c5ee339019","ssdeep":"6144:rh5gDAimdV6bIK1GzE2nT36RzaILAzrryoMo2w64HollUz7rBdBQo7oSYbwI4LQO:zsAimmbNgTqmIMz6oD","tlshash":"52d4c6ea834e9777e08a22f71673447fefaa2d18856feae057c0ddd953c8b0214e4158","size":602454,"data":"","first_seen":"2026-05-13T13:15:53.143974Z","last_seen":"2026-05-13T13:15:53.143974Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"app.ondno.finance/26b9a48f6f36dcf1-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:22.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /26b9a48f6f36dcf1-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 25712\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-6470\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iskOKBPSZngZxHUE8gXlBIM3ZjNJUiggrAXGafpyxLwfzPja%2F2lYKKoKkX2fI9DMZSFCQyEE97w0tHx%2Fom7WM4l6i4I%2ByayWh7G%2FokUdPlogAgivrl2cFuuzvav0trGWFhyfrg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7abb5f0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25712,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25712, version 1.0","md5":"a35b4c03cc7737dad84a0d5f2b4a2460","sha1":"5535bad7544a481be36d70923edabf0d7236aeaa","sha256":"b508347f9e0a276ced4358c74d45a8fbeaea943dde03241a4dd2699f15f8449d","sha512":"1f0c3c0fe569ff7bce3260f1c8a39769830791c5b19124515c1eedc62eaa4a27a50459a44fc213eb02f9c4d04b89f394bcad3d283fe056ddba2116ccd1c9d936","ssdeep":"768:1Z3ebpCogIlkzRR2e5tkRG/o3lpAUdbYPAyqt:IpCoPWtRNGRGA3lpz1uqt","tlshash":"3eb2e13c857d2f8be14132be55bb4087a380e45b1f50910daecbe560d24fa94e7c86ec","first_seen":"2025-03-16T13:23:15.890573Z","last_seen":"2026-07-28T17:22:11.672794Z","times_seen":7,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":255,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/intcon_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /intcon_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2259\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8d3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ng4sSEjE88wMHnFe2AJwDQspvJWgZok%2BIdrytHjZvAjpdaDdwRuO%2BBWyMK4V1JS%2Ffg5O%2FK6SMoPpEuBmXOypsXWsEtzhijyetH0lSmcIJb%2BjnUVY4RpNhLeGQ1snsAnI7ZF4zA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d7eb00daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2259,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"68e32b1a6d5ff25704ea5947c92b7554","sha1":"0077c1b7efd501112404e04544d199d7a66febd9","sha256":"132d08c8cee0c810b8349e96ebd3c1a937ae36dfa95172e5f527b243296cb811","sha512":"ef4105dfd99a3af3edef6b47436159c5d7be1cadbade463c660ec186434b2cf8f921fbf37f6891ada5d4d4de50c22df6ffc9df9296b7a88e7088675a4a36c4e9","ssdeep":"","tlshash":"46411980b4b85554a886ddfd12c1a8ac2bf27b3498d0b1cf2a964ea71040f2c488a963","first_seen":"2026-04-20T10:51:23.408015Z","last_seen":"2026-07-28T17:22:11.667373Z","times_seen":9,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/favicon.ico","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 5956\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mNZT897RRzFf3KrnuXHCQpcqZT9ChadOo59qbIJWuu4frxByvO01snIYObapKlh%2FYuDMTZCbeM45KcwmIxWAgvKWMCMzVutHMFqN6Ag9W3BumZArnN089GUrUhJhyDaySF%2Fkfw%3D%3D\"}]}\r\netag: W/\"69c48845-2ee7\"\r\ncontent-encoding: br\r\ncf-ray: 9fb1ee7eebbd0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12007,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"055daa8924aedb430a5313283bcd28ee","sha1":"1fad23a11533b8408345267e9c34aac620153a1e","sha256":"700ab482214cac6ca7eddd4d74256860604ceabe4bedefd0324e44fd3b1576a6","sha512":"6eb664485d9befc1fa2a683a9f62fd088d29ba1803ba9cfdeee24a11ca79e05019a2555d45be6638ee70f082c43a5daa0dc9942f0ae3e9fbdefe27c2e7b907d3","ssdeep":"192:IRtVZVuKrC+g4lSBdzDowU+92mfbX2mlsTpUfn+TRaluaaOsEs/w9TM:IRtV75gpB9Do69ZmmuCneRLaa9Es/KTM","tlshash":"b642c0dc1310b2ab1f4d6575985e1bc28671690d0c6f4f8fde79cc0fea7e1841849b58","first_seen":"2025-08-14T22:56:29.206535Z","last_seen":"2026-07-28T17:22:11.665825Z","times_seen":150,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"appondo.finance/","fqdn":"appondo.finance","domain":"appondo.finance","tld":"finance"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-13T13:15:21.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"appondo.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 02:43:36 GMT","end":"Mon, 10 Aug 2026 03:42:21 GMT"},"fingerprint":{"sha1":"FA:60:B1:76:C2:A4:A3:1D:7B:F3:39:CB:06:0A:80:CA:50:EE:5A:C8","sha256":"49:38:64:C5:4A:C6:AC:AF:E3:11:E0:28:D3:F9:ED:0E:B1:B0:48:71:E5:24:1B:B0:DB:D7:04:05:B1:EE:42:E5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: appondo.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Wed, 13 May 2026 13:15:21 GMT\r\ncontent-length: 0\r\nlocation: https://app.ondno.finance/\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a6CCNKcsqR8ff%2BOJdVLav5LNMEud5XFF35n53tjJyH7gtarB3oRRXosYgkPf1tT3kxvtevuoZQ8GpkFrPKjJHawH4V0SlbsT3fTQYJuFA1Zq2xVxxap8GOHFa2hshb7H3AQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9fb1ee741acf5695-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4358774,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T05:01:15.330506Z","times_seen":17737366,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":59,"dns":41,"connect":1,"send":0,"wait":6,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/wdcon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /wdcon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 1864\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-748\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PaVJPwH4DSaOH88zpSnGktmmctkMTgJZFckaylBKnWRKtuJwaVmGh%2FGDY0oO58oh3jYW22MLez25i3T%2B8TCAsgFUO9jw74FB4NyRFmsnf7V1KL60Rj57wnVgMLOqPYA66kxJgw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e390daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1864,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"3dac0d9f1ec4e47cdd83a66109ee2e2a","sha1":"66db6280fcd1a2d42c1e366e60db742d09fe0e2b","sha256":"c8698de1c5743687bd00ff4a2f2b09447efa94b40c062ab99a7ec1a5ec6ec32f","sha512":"25fea4f2dba085be65c0ef9988052438b90204bed3a546d2a892c6b21bb81e2492cb73b465e1d41b3ad6b2e1ffd49cd5bebd5547c162682c2f1b593568025e3d","ssdeep":"","tlshash":"c831d5eca3e28cb19a098b200cd45092fe675df53ca1dbc9180b7e16603a6e45aa7159","first_seen":"2026-04-20T10:51:23.409285Z","last_seen":"2026-07-28T17:22:11.664026Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/favicon.ico","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 5956\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=heIUL1vbMVJp7HvLJ6sYY6u2uNka1nE%2FI%2BQwfugHEH5ah%2FoQFob91RnTzMWuBuW9YAep3KI%2F4SOik5DSg2%2BK%2Fjm6Al4UPyucO1zRE4WiQO8ZcvuIr0Tk7CRdFp2HzFnFdx9PYg%3D%3D\"}]}\r\netag: W/\"69c48845-2ee7\"\r\ncontent-encoding: br\r\ncf-ray: 9fb1ee7eebaf0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12007,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"055daa8924aedb430a5313283bcd28ee","sha1":"1fad23a11533b8408345267e9c34aac620153a1e","sha256":"700ab482214cac6ca7eddd4d74256860604ceabe4bedefd0324e44fd3b1576a6","sha512":"6eb664485d9befc1fa2a683a9f62fd088d29ba1803ba9cfdeee24a11ca79e05019a2555d45be6638ee70f082c43a5daa0dc9942f0ae3e9fbdefe27c2e7b907d3","ssdeep":"192:IRtVZVuKrC+g4lSBdzDowU+92mfbX2mlsTpUfn+TRaluaaOsEs/w9TM:IRtV75gpB9Do69ZmmuCneRLaa9Es/KTM","tlshash":"b642c0dc1310b2ab1f4d6575985e1bc28671690d0c6f4f8fde79cc0fea7e1841849b58","first_seen":"2025-08-14T22:56:29.206535Z","last_seen":"2026-07-28T17:22:11.665825Z","times_seen":150,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/5194627767da3bb2-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:22.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /5194627767da3bb2-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 53432\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-d0b8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MeabZ%2BtulP%2FoA1W7poFStnpAVfBZ7qxlXmBGRmr3hNMw9H1C604RNg1EiVfzRY1GADj7PD30EJFjAGQ%2BQ9lhiNjR%2BJu%2BvqpR9sFV5VJyiNFsSFxuu8dLkeNK5LldGGwsHyIIsQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7abb4c0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 53432, version 1.0","md5":"797f386d68cd231cbb898a348a1a302d","sha1":"0627a4505490f56b54222fd8706c387e681a8c5c","sha256":"881a2d3353817360311589e071c75ac7599c3f9196aeff49c1f64329c55ba03f","sha512":"a4f4d7e735680c1220d1b2c893ea6b39021ac53d8d70cadd479a646c3b3f4c4cfb2b4b4443f495948ff6e7913d2e30e61df8506691508bf6bbfd08dd75a1e2d4","ssdeep":"768:DenjtxI7CY6n2s8C53T+LHu4ltUnJMPFNlqofweQ9GmjOqgl80BSIUhnxTX+9mZH:DeR/n/T+LFAuNqoHsjOPPcTM0d33Bv","tlshash":"d333f1c66b69170de6b119b7098cfb35f2af7c91aaae99434b9c01e11c3150c887b1f4","first_seen":"2025-03-16T13:23:15.848192Z","last_seen":"2026-07-28T17:22:11.667866Z","times_seen":7,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/7d545a7aa2fd3fa1-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:22.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /7d545a7aa2fd3fa1-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 52896\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-cea0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q6mhZIJc0lkKo9%2FAh9DoriGjU8U90OCfpddxDMlcRZBqVz3oxD7aMO00XCRBe75IlLT3Nrp78t0H9DSUWddPDWlShSmJfIv83hKBMyFPVWkbL47wsLbJyWFLQjPzbPqucHdUTQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7acb800daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52896,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 52896, version 1.0","md5":"519fdff1b3ce5723da31fc8133b85cae","sha1":"c5680b5e0d043886a6cece3adedb63d3a632a27d","sha256":"1cdcf75a31d3aa45b11b430b61d00463f422109915d13e541f635f1fd40ac526","sha512":"c66c962737965b6228d40df702d0493a70ed44b02a35cd27cf55888b4dbad30ef0659e9fac8da12c160ec6287797296ffff7586a2cd344ea3a64b7110f04769e","ssdeep":"768:o6aHpt5yIekKDqO1CYKqZOJfUZjeq/Yqq4PsRPOnurztdPfl1FxQjQx2PNyEFEhq:ofH1IqO113CfUZlVqhpSuHvPd1FxdPkF","tlshash":"d933f24b1dca51ecc6909bbc8c5a2f63e9541b3e4e0b4c8cd066f90ad94fdb3b1154d6","first_seen":"2025-03-16T13:23:15.901963Z","last_seen":"2026-07-28T17:22:11.675056Z","times_seen":7,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":213,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/nvdaon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /nvdaon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 546\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-222\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rchZrPjXOW1LyjJhGEjzbv4neDcxuCuQZAQSlWmP88vuCsV1SquXPhBGf0Eeo14BQq8MNTKfYONux1XOdU%2B2af3YB%2B3JkW0rw%2FO5PYm66iKr5ksk3fOEJu8PjoCkGk%2FjKJmu%2Fw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d4e0f0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"b0e4bace98394be28674406af92b8d63","sha1":"299e7d30b0af4c60dddb4022fd928a22f74b8e61","sha256":"05c622db08e0676f5ec25f5b184f4e47730c62fcdc2f05c6d78fcccb574dc863","sha512":"c84a37d76c3ab959a05efa2f59e6263a9f37416f5b11b46cd376f746dcea897bbb65b10c7c9e0a7e19465e2910cc0813bbfd15e59bf4e1dd661e85a53d19cce4","ssdeep":"","tlshash":"81f026d16a81096fe46b87f5316526b15de910744da1c50bed9400740d11b457a9df87","first_seen":"2026-05-13T13:15:53.127687Z","last_seen":"2026-07-28T17:22:11.672219Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/intcon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /intcon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 555\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-22b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FGMoMiozdU6JbbPeZ%2BAJOw01tD%2Fs1ruagq2dDptcxrnmf6f7nRWxc37AjJOgsVrjoILVsfOdWndfePn9%2FyhW5%2BZyfeDb%2FH6cJWFuJz5RpcsV61oj12I%2Fu5C1sojuOiWKsuq7oA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e330daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":555,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"15242d2cd394ac3c7c8479c5dbca458f","sha1":"770ce4a5399e9ec4a318c2a442e1a5a801c5f2f8","sha256":"5187db1b97a243b6b1e9dc719fda75f591a97c1eec415ca1260245eb7fb68cca","sha512":"48cf7ad6a6491985e6e45ebeef253304a67f4bd735c1eb12aee5813c6bd0b823f14631fd66fc9b4a6735991ad33ce4084edad54ad84db654cae7906b151e50de","ssdeep":"","tlshash":"d0f0264a90d44410d64d93f7d620a9f4fea31821157dc61a8690d47b17557146061bdb","first_seen":"2026-05-13T13:15:53.128589Z","last_seen":"2026-07-28T17:22:11.671158Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/astson_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /astson_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 1805\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-70d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XDSgzmP%2BF8dhzTn2fnkra4pEfetU67Ou1561F3f0lhgChNuFmtFmYS1IgjMLegG7Ze%2BKvfKBziDGwG5FKxhy986oMaahFSi7wDr15TmAFPNygAQskpP6soiixcmcWdMI7eB%2FKA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e420daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1805,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"dd2f585845cf78b87db3eb9a4bd7b60b","sha1":"b9d94196aac72dc1098c0869a0f8c4e0ebffb8b9","sha256":"8f56565be4f830cb2b0ed90ac2407833354ef3810ee6f8a5dfb2a9cc65005dcf","sha512":"94620de9935b8aa94061f7d6b8eff0d5ab9833fe1cbc4c6582864c456770330ae4b658f36f6ba31188d2e48f4c009f3976d955ff2b3f566262c896924a8870fc","ssdeep":"","tlshash":"8431eba51fb62eec910c6b914b2d51a6b986d43410d51d54452c7d26743a32eccd07f7","first_seen":"2026-05-13T13:15:53.129452Z","last_seen":"2026-07-28T17:22:11.675627Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/sofion_160x160-3.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /sofion_160x160-3.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2404\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-964\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FFYr6ocSbIyrjdehn8YCZc4JoCnSwUQpt9%2Fi4r6vV9QXVqrG6r%2FDOgWlsHkt7v1UZ0Q2hl%2FQ9WyoeMlxGFmOM8s142ThSvBwE5gbwDDN40IGn7unMEq4UyRgRoi2OUlTF3CGXg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e620daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2404,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"9af491eac8e22d88fb88b3a9ecde9000","sha1":"9b7bed84537b9646e333d64f079db70fd1e8a1fc","sha256":"8ef9210e86db896481f84b63dc1b4eff873eaf22fb8099c46028a2eb8581f656","sha512":"206cf911975f1f3c144575dad7a8fef66eff789971a07d04d37d86940380d37b89100ec1715f384b6c6395f051f32575d130ef6aa9401534a72baba1c920c951","ssdeep":"","tlshash":"40410a184aa3cc4042dda60575bf265fb7ec320983e6f3a054457dd9b0d494b2055f5b","first_seen":"2026-05-13T13:15:53.130354Z","last_seen":"2026-07-28T17:22:11.669043Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/wmon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /wmon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 1875\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-753\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MVBJUth1m1qZE1J2r3%2FcAFNhERx0ryz5GVFfV6jAthvL21ceNWzcnnO4ZNGB9xBmunkxygAVbyiYDqfAw4xmzrbaHxEpjYoNfKPd3fh5TwIStwiulO6qWehNZXef%2FLI6vfZSGg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d6e7c0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1875,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"1f616acb8ff13871d024fb3e8af83e73","sha1":"cfc880e92eed5213176a6c69f387f5940474c5a9","sha256":"4cf410868388a7499010558b1e473a9b82bd874d6cf2bf6ea99e09df6dcf5599","sha512":"d0cb4156fbc39022a68efae6430c0312b7faa7c9445ca19a39dc2d34557edcb7fb38c5928eb3cb8167cdc7529e45ab9d6f6e9b5ee2d5f548f922b77d2f36feb7","ssdeep":"","tlshash":"2d31d9a5a9ea82f1ed38195163aa4a339323a311ebc725b470559ef316802c9431876f","first_seen":"2026-04-20T10:51:23.416584Z","last_seen":"2026-07-28T17:22:11.671717Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/sofion_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /sofion_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 542\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-21e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v1vhFHPZRoGt1e1a40YkmJ5DCnRfBuiEczQ9yyij6%2BBQDAPxMviXZbMVR3DZLjAji89VyrEKt%2BixNXp8c%2FI6YWbrOf2rwWeaDLWvyMmdLDEAQA%2FyzYKikxbup4SxxNsx81%2BB%2FQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d4e210daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":542,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"71d10f3acdf1c2ffcbf162c73e5668a9","sha1":"62b6654e45f963c604329a75efc881317857188d","sha256":"6248129c0b90e0b17ed63bdc039c85a908c1bd9a3b9754078396c03cbc9e7973","sha512":"cf53b3389cc6c66530563c27bebd6b7f9870ba379e22f25e6fb66980771957ac2fdef4c41be24230f19b50af1ddbacad8d4cbff95eeeccf27f39f184d8814238","ssdeep":"","tlshash":"2bf0755f23e4dc8e418ca67370624038379f10fe09f2571788b820b7081a9f08a80f17","first_seen":"2026-05-13T13:15:53.132861Z","last_seen":"2026-07-28T17:22:11.663276Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/spyon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /spyon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2240\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8c0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oUJD08dFv%2BSBWVDPZl2ZUdvmaUyqs5ve%2FvIY%2FYnOFzuM5YNULEYHS04KEhZTe%2FxBF4fm2qlnNUrqBD8w1kaBiIvnvqnNEGs88Kfniygai1Trq0GeFVRL0GQqtQQnJFGC4BkTCw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d7eb20daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2240,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"dfe6a0a0e5f065ec80e869fb9d9ca356","sha1":"edda9ba0be99ca4a6580dde952e787fae3ca78c1","sha256":"99768cf3f86d87b886d239f8455b0bf364a8632721ef82d84b5720e339693a7c","sha512":"6fe2ac326fdd8acc61a7c7ab1eb2435598f2fbdf4f0708a8e6ef07db10bd8ecd5d02624021091173aed638df6e61af6aaa61c91f581fca20af8941ea78bcf60e","ssdeep":"","tlshash":"9f411953e39d3a78c6fc64fb212629596912c119a06e7f6fb06ac735027819f1118e60","first_seen":"2026-05-13T13:15:53.133798Z","last_seen":"2026-07-28T17:22:11.664646Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/pfeon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /pfeon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2309\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-905\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4DwGITVwggakI9yQUmZdIXiS7yb0OEhKJAZQ1nGlDlgC5ibzF%2FShsQM%2BR43x6L8XOp9zhWLzmpikcWipgGIrWqKeWrMKSn3o8KK4Vv3aUGYoowqJTm%2F3Lq9Xcl79fGmK4dl%2F5A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d7ecb0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2309,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"5f1fcdfc385f0238532e9fb8edd66a4b","sha1":"ad23a313874e246a32c2dff8a042dce29773b015","sha256":"890d474745f56fd4bf241ded0f5a3de2c6c74513b4673ade3231e44a88d1908c","sha512":"226ca6e2182f02222eab5b752bbf96b7d58e4b48f3c9bb0b3bdf4865a3c762e5d183b8e2d0d669ac7c22a137991583e9e008c2bd16abfee683e1ec3a69775cc6","ssdeep":"","tlshash":"45411b76b1908e7c16bea4642ccfe565f191ae972457b06284520e5c4320fcf3978932","first_seen":"2026-05-13T13:15:53.134718Z","last_seen":"2026-07-28T17:22:11.678543Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-13T13:15:21.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 May 2026 13:15:21 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2%2BBNpbODXzbYLjQgiGFZxGmlBMy0dQ7FjRTgyYVcsrsvUf%2FsHgPqQED31xVXKbADu9fTZyK%2FzxFYYQxwG1JcxYuquMTNnDEV4OTu3wJMTZReK3scqX9fv04Sen8Ic7h5kmvKiw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9fb1ee748a245691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4358774,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28486)","md5":"e3a6b4b06d6226ab2ef84f7adf65d326","sha1":"4970b249a8ca67b30025a53f6f6fef5a0de4e0aa","sha256":"963cd108e5491349207d045856775056fcebbadc86ddcda429aeb3a542e09a67","sha512":"44cb591dfec75f77958aa8b425ecc669e9ed71a7c18a627ec3bd7b39ad76f06925d129e045a8025dda9567199afda871aceed03fc51e051647f782cf183ae97d","ssdeep":"6144:wYTCeZAW5huttpOzKh08G5CyhsiLoll5SGBvVO/D/7aFBIov+w75:fCeTzov5","tlshash":"8a253bb93300f7a6fa03caabb571427d212fa01cf7929edc41d06b9e14ef5c05919a57","first_seen":"2026-05-13T13:15:53.135537Z","last_seen":"2026-07-28T17:22:11.674481Z","times_seen":6,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":60,"dns":43,"connect":1,"send":0,"wait":211,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/8cc4ca7238341e88.css","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:22.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /8cc4ca7238341e88.css HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:22 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: W/\"69c48845-a27\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i2ljDA8RlUfmqryPqSty1E20s8esW4MbZal%2ForR%2FGKVctktTy01N6aMpW8Xtf9UmZ7wCsoNI%2Bi7oe%2BaEz1S5K0nuhmcpdpBc3idqpoj1jl7N4rQkPaJt%2FV6URJb3435XDdh%2ByA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee775f5d0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2599,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2599), with no line terminators","md5":"eb5a2972db949e6d04affd14d011f2d7","sha1":"49fa85a27abde5f5e5b1be4bb21e4c466d899d50","sha256":"88c4625f6a8d095742855c98b06e5e9bf56bf160bbd4cd4dd7f956009dfc344d","sha512":"e087a974de6ab70f3707422a3b98fcfcc100cae4287709c00b112f4b1c6e3319e3e038e34fc0c971b36dbb1f4d790b2d173a0190b5f5f79d9e6c0f2a42f41049","ssdeep":"","tlshash":"2451a124401f9070a5f28e83368efb22256a685589f64971f16b095c9cd7abf63f0f7c","first_seen":"2026-05-13T13:15:53.136514Z","last_seen":"2026-07-28T17:22:11.662722Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/aalon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /aalon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 560\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-230\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SPGkyTZddpKRiNdKMH7ildEhaxaIrzPNlP9StrPPVzMuF3c35wHXaXBbukoOsUEYtOOVTBtLeqk3XQeGGCXIRDgOL91GE7w9mymBUXC%2Bo4R1owKO%2FQE9DB0kSp6pRIFO8S4gWA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e2b0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":560,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"da0fd067d6e0e471474a09589f468f91","sha1":"147981ba7d554437b76ca63e3cc005a1e8b96c9c","sha256":"859705171ae964138d7e75773c05de75cf0ec49b5b585bdd2c15da8bab3067cb","sha512":"e04d80c3f0bf09b2cc02285c0657ae03fd7302e3684c681f83bd4c2def0ad2f9415aea9b98e19df29178a04e3a9b921a0730614d744947d602908c654a6f2563","ssdeep":"","tlshash":"f8f026d10bd1899df48c43a7c4a5587c88d74e3d3ad96d5ef45270308c4d046117dbc3","first_seen":"2026-05-13T13:15:53.140871Z","last_seen":"2026-07-28T17:22:11.668401Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/openon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /openon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2327\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-917\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2SRjyjhfrX3RoY94AGd7jECUVP2jiKpGaBudGGL0xhe9%2B8u1fXHrFzWwNCyAsWdLGP1M4VLJeG2QpoIn9Hw%2FL9MbVj4YBF7LfzXWi0YxaBOY9pDiVdWjwnMSnRpRP6G85ZT%2FoQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e4d0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2327,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"8a661f1154a1675b931ca1ddb45f7dce","sha1":"7c704e2ea02314581dd0864c6ee5170291ea4796","sha256":"c13f0f8afccb55750ce776ac24d8feb4d484e04074f46aef95ecf74b62765ff8","sha512":"4115a274d9bd5b9b813204ce4a5f562d90483e985b3f43a43366f30e68a18af82f6207d94a4a707f709fe10cbebd1624ca36adc89cf0d0b61fec8c92e3c57f00","ssdeep":"","tlshash":"d8414ed2f438c9b55f406237493f85bd7cf901b765421e9a2c19f340654931ad487a45","first_seen":"2026-05-13T13:15:53.141783Z","last_seen":"2026-07-28T17:22:11.666789Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/ondson_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /ondson_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2299\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8fb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dEfsITfLYOdXYK8Q9oVy19H6Nf5v8FNNF7lPQupByQNmBz%2BlZ6nSdxL%2BqpzhVaucuudENyotDPMiMKfsGMR8wIzpIHquUWw6BKGZemg2awJSsKO3zj9QErzmw8gO3oSmhGqjAA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d6e750daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2299,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"19304aefee9afc0bbfbf118fb3251542","sha1":"ecc34c5ef692d6ea74cfc6165b069aaa4f17f8be","sha256":"3e51e9917d5c96b4733c45459d5d5656710714b4475168cab973ac9ad8d2981d","sha512":"920c5480810934b1ba0b574141a633511132cdf706248ae8d4a4d3c20af029d2c31e0f7bb0dcf941c361d34fd9add39190b6be5968a4fb8d1547f086365d0378","ssdeep":"","tlshash":"b4411902d4b0318e538e0e71857e5118f9872965b9bbd4c57cf9d2299c387cc0b9ddaa","first_seen":"2026-05-13T13:15:53.142853Z","last_seen":"2026-07-28T17:22:11.677982Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fjmpd%2F","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:24.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://app.ondno.finance/\r\ncontent-type: application/json\r\nContent-Length: 1422\r\nOrigin: https://app.ondno.finance\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1422,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB3gLHAiYAFwCxAgEDIwAMAxYAAQACMgMAAO8nhn2XtsKCATYSuSJ06cMYJjb9KmgCAABfwQjPryGSfj4d5lntYj1of7J3vU3daNTc4oNzN7bvlik8cwbgOraGWX_HhDj3OV1-E5DVAcThBqTIFXvZr-a6kD5cjmp2t2BNWE0gePwm5oZ9Wg6uiiETMjt59X2Vr2clubtx_5hZDENAeCosiYD0fmjfsA0YH8lsNN-fMxz4vsp0aCsDnEL_kP0J2ebQYTPZH9GJzyxU_3kLRids-WtNEMUCUN-EIQ-MhnXG47kf5zXbXBPbd5jamhQMRo9FNrzUUMh0V_muesE7IppozJU-jRlIB6kAhAPzo6cS35Cb1BvyQIhhxfpkmA9rNWw7LsPf27Mm0iwsfxV1gd0YxaSktMd-GLCrwPtLr_xR4cHjV4eGapaRB2jCRDmoEYXWxskyK07T5HSkatnxMZ2CQ08dYVJb-OGzE6WTFKuhVoayGQMMROIaXv8zJRrrmXdg-fo21gKbUqdE0eZ8-WWr7pxjbIfe7DxDCTwKF3ORz0bR2Rp4m3dsC1ihm1EwCrO-TvQPz91BU4ffvrXESE6W0f3_kBHl5-WASg0DloeIsAFN9ZMEa1zUxmDGoVKxP5OxBM5lbpj1Cv3GxsWm9GR7SNoW20p0MWGrLj_P1k6c7K_dOWbHQQNxUxPRZQFRgKsnddu3p2T9G2BWfY38aoT6MiWKlPQc7wP0GuSlYnjz3EuZFd9mJIdL7erZQyxoj226QRKmgLrfrECIBHh9HH-hYJ5wEed_dhYfPeLkwNRD-Y0oEIAMEKMzzPE1WqylIA_Q7hXRnP6XGqZFVE6NdgJzbmO-IKXxUFjP5Uq7Aw7_0cElLYzRRv71Ix8WmdHl2znofBjoqi3zqqcu3ZhcUsa1GFpBEERdUrKqLnAnYkepwKDrB5P_qmqosW1k4m6zghKzTz0yLlImFUbcAJr0eoMJtmkU6umh6vIFkEYFUn_WwZlBhXY401bZFCYj-kTJzAgcFrY3LI7kwyQzTy_xWv8eWwmeMb63neoNay91ZqGLj4-PzVyPi9vU5zCP2dz0zFSivci8pnzZ7KTct8sFOGghTZGXrNW7fVhtMlQQXYpN13VlVZZpn2jkD4hLDyOxI8qu6vXnr9KujYo-KrbWcPtRJYqXl4o2FPwopFuZEA\",\"challenge\":\"eyJpZCI6ImNxY2I5YXJnY2NWeG50WFM0YXYxQkEiLCJub25jZSI6MzgyLCJoYXNoIjoiMDBiNDA1NjE5NjQ4ZDhmMjJlNjAxYjA3NjRlZDdlYjVmMjg1MjUxM2U4OTYyY2M1YmM0YjgyZmE5MzI4MzJhMiJ9\"}"}},"response":{"raw":"HTTP/3 204 No Content\r\ndate: Wed, 13 May 2026 13:15:25 GMT\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 18\r\nx-ratelimit-reset: 1778678185028\r\ncdn-proxyver: 1.53\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 05/13/2026 13:15:25\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 3be6f7edc1f0faf3ee84ef3609d57278\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EeH6jLa1XrUiB715snBRk2hTLVbSvvLZNbKBmw3XqYD8LMAApWY%2B1q7lcNfNNO7gGy9TVavWyYqqjBj20qwwFDbosCmTvjyqJZQZMtIQcmTfMr8cNeM5oUacrPEM%2FU3RhQ7WZg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9fb1ee88d9a20daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T05:01:15.330506Z","times_seen":17737366,"resource_available":true,"data":null}},"time_used":652,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":652,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1778678122578","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:22.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1778678122578 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"93156-Ye25X8IHhoboxYXT/rT6eJBQ/Is\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=BQDhydizLH2tGsJjl4S62A.js\r\ncdn-proxyver: 1.53\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 05/13/2026 13:15:23\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 6d3e4aeb84e70eb3c935ff236ad46a4a\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gt%2Bkql588HCc0sieej9W9WUVSuKXaqmT%2BBfIS3q6OtDf7HwJH8JygJNsZmYRMNQnNoae%2BNxE6e9kkjb76lRK6woeCUJd%2BeySI80Y6132Jf32KshPZcsIVOn9LcJ9UyEkuE43Ew%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7a291a0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":602454,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"8ef0559ee319c3e89f25a82bb15d23c4","sha1":"61edb95fc2078686e8c585d3feb4fa789050fc8b","sha256":"76abae5c0eeba6f483333d952c50cb3b73b908df4ff55769104de2d8612d8a60","sha512":"270a975236545c9e6e758b4f33e2e29ee70da1c2d885abacb1d43cfdd99d7094ed40de0546a6a176db9a7d07e00a0078a22592c4c5f23114159674c5ee339019","ssdeep":"6144:rh5gDAimdV6bIK1GzE2nT36RzaILAzrryoMo2w64HollUz7rBdBQo7oSYbwI4LQO:zsAimmbNgTqmIMz6oD","tlshash":"52d4c6ea834e9777e08a22f71673447fefaa2d18856feae057c0ddd953c8b0214e4158","first_seen":"2026-05-13T13:15:53.143974Z","last_seen":"2026-05-13T13:15:53.143974Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1074,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":967,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/ondson_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /ondson_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 611\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-263\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wa1HDfTZXvOCsujMZW%2F7vegBtWiT%2BeOjjn8EAyU1BR7Wi%2BkzSwLhoF7d14O%2BboFmFHxASfrhyZq%2BEq00xvaGdRxCnG6%2F8qNOuZkborOwM5tJluNbxQBz%2FdalGH3JaM7BL6MJkw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e280daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"e43e431e00cf249827c008b493ffced5","sha1":"31a3a4a2db35404fd91101b09da7798de824e51e","sha256":"6228f81f1a6a809dfb36622808f80684a7fb5c151a8478f3a91996edf5e7d877","sha512":"e6b0259f2d01a1389ffb4eb2ade2a52c063cceff851519fc6360cebfe09c7caa816fd33d22af35310b8e15544beb4d4b1a6cff1ed8d0555bb9fcb3ee3548b224","ssdeep":"","tlshash":"90f068c005952d5de9dcd45762272e7dd673151a38438d5d152010173e2b4b8111b602","first_seen":"2026-05-13T13:15:53.145008Z","last_seen":"2026-07-28T17:22:11.673497Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/aalon_160x160-3.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /aalon_160x160-3.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2041\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-7f9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Ti5oNRXC2THMdF6h4ZKbnA3%2Ft9FrSlJgVO%2BFa4TPU7EF6Vc%2B59p0uEFml0lwuclMWmc5QpGYAjVpJizWNpeqStNpVEOy6eeJkv3Pgv4jRy17U1sx4owrHyLZqZLcfEwhFpK9Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d6e9e0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2041,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"4b571e1d2bdac8e02a095733d6e997a5","sha1":"b515cd82feef8f8d92ce8a42a9aae444526d4765","sha256":"7a19641615a5f713d4084dec99dc478b5b24bece420cd7157b472439b39db882","sha512":"c4ebb49a63066a23ddf3a7ee64ad82f636417587db8b44fb45235616007156e47b50501c8f9aa35be9858f48ab660edf7651f3eece5d6ce5a0b099d525a0fc9c","ssdeep":"","tlshash":"5441eceb76d9d38e43f6571025b7612cb7ef859a3081851cd1037e20b90739869ac4f5","first_seen":"2026-05-13T13:15:53.146057Z","last_seen":"2026-07-28T17:22:11.669619Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/plugon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /plugon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2281\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8e9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a2ZuiWJyrn6B%2BUXfIi%2F9kc4nfo0o6aaLqDRsGeCA0szSTB5ip3Xq90s02xc95ipDO6w2hhoM2yhS5tREwJK2I%2F%2B4FV9ZEtWixJeC5Bg4EbGfKUBOTkudWQsM3TJ1TKaxM93MaQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d7ebd0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2281,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"035bea1f20f3240883935408be759bed","sha1":"a11de51afecad0732aea71fe91975856d0fff0d6","sha256":"35a69e110d79c9c1566169dbc893c15ae998dcb24c458744fcb0b1ce96d4fd48","sha512":"a81940335e04dcfa59b85693075f7bd127331854e898a624be0892af29f0f7f66ea9979737b1f9daf90b8780d279a6d696c5ac679ffcea458e58c01b9244fa11","ssdeep":"","tlshash":"0e4108af0a979682d230d92126310a3fa9c527f05ec1b60f0465c4b12df6fe802f04ef","first_seen":"2026-04-20T10:51:23.41752Z","last_seen":"2026-07-28T17:22:11.676724Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/nvdaon_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /nvdaon_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2230\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8b6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aTkdpt8BKBzFD7LDN4FI1Z%2F6kw8XMrOLQZAr2%2Bqz%2F8skjg%2ByaJ8%2Bn5IPRIiWCnPqKMwtHLlAZv6X59s9OKJVyW4TGib%2FfaTm4vVJrrGb78GA5U%2F7f7nXsMuPM7Zt8vvDXqnS%2FA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d5e5f0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2230,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"efa5bc835d99ccfec0b6a14d2eee91ab","sha1":"94eda4f90a68dd01782eebeafee3ad3551800115","sha256":"b296f60525600be45c2df8829b71425245e15169c9fa9f811128d3e48f9c12b1","sha512":"ed68c2995094bece8c36f99a03e3316827b125287379598a6b4c637999fd130867647d22983425cf47d4dabda65a95167c6d02320cba57bf51c7c3511100a738","ssdeep":"","tlshash":"854129771c490cbaafa696cd5128809923bd004d58318e17f8a379c74092d1f21bdf2f","first_seen":"2026-04-20T10:51:23.425153Z","last_seen":"2026-07-28T17:22:11.677288Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/tqqqon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /tqqqon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 2416\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-970\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lm7J4rQ2MkprCm2pLiIj%2Fil%2BHRdD%2BkbxJ5IBOKOgGS1vq57O6cxeN3rejHlTK6nxL2tnI7tQTv5v7JJk8gGYw%2B1Ik2aB%2BzBiXz7fSFzkBVB10hJ8XiZDFJPPE1kI%2FvurOTVgRg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d7ec50daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2416,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"242356e41367f403c0c6c0fc15a0401d","sha1":"75d3c7b3c723cc2d72a140aa362823452ca81529","sha256":"d771ed35e6e8de65ed76c0a03a0f8aecfc492a772fa41111c9f8cb0d86d8831e","sha512":"7f4f01a6eaafa7924ace757d66df869258dddbf9ed356cc85915264e98e2550044ab17d7f99ef42ee371cb4faa5eed5083e672d477a74e19725b964bbb7367dc","ssdeep":"","tlshash":"31411b8fb3ec58fc41f40af789a95577468a1259a3a36b9b0344c53c8c8590b35d8d89","first_seen":"2026-04-20T10:51:23.410348Z","last_seen":"2026-07-28T17:22:11.665221Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/vrtxon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-05-13T13:15:23.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 00:13:00 GMT","end":"Wed, 24 Jun 2026 00:12:59 GMT"},"fingerprint":{"sha1":"A4:BC:CD:B4:B0:E3:12:E8:3C:B5:A6:C3:4D:89:DD:43:4C:B5:62:E1","sha256":"7A:9D:C1:0B:05:39:66:8D:4E:87:CB:CC:76:14:A5:6F:8B:BA:C2:5B:48:EB:A0:72:28:16:9C:6D:25:7F:8E:AA"}}},"request":{"raw":"GET /vrtxon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 13 May 2026 13:15:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 1865\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-749\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 5957\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DCLLFF%2BNzNWFIpFnvxmXj93NVGUIqp9Gvq2ZLdCVd6ivTh24wEyyyXVZf0F3TT%2F03onfvGH37Rq2NNWwbv1e5o7SmLXo3Qt0Z4aGII7q6ie%2BulWyBZJcW7no0qxzDyAj7pn9HQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fb1ee7d6e800daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1865,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"52dd5a0963b567bc9e7d9b548d370479","sha1":"46cc0373cee5335bcd098f5b8f8ee9ac068ffd65","sha256":"91426d45dd44304fdf6fce36e5b12d6559da5457c8c4a756436ee3a746eeaf6c","sha512":"0c6ec5384215d156f2cff154cab67dfae1dd5085dc40d4abe55784eea84bc3925f9c4fb7d307b1c5d8ee57610ca1a3836e5fb498d95c9fede90071e1ebd5eef4","ssdeep":"","tlshash":"22311b9e22d4185ac5b6083354e1a29ac5dc2c1968a2811c7bff3c35eebd6b0616e114","first_seen":"2026-04-20T10:51:23.426458Z","last_seen":"2026-07-28T17:22:11.676195Z","times_seen":9,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}