{"report_id":"8d66bd4f-1926-4875-9cf6-885c0c3d032b","version":0,"status":"done","tags":[],"date":"2026-07-14T17:49:48Z","url":{"schema":"http","addr":"join-edr.com","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"title":"ETH Drop Lounge","dom":{"size":60616,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (328)","md5":"d59ad3df803a5ab2375e6a1674e0d991","sha1":"7c57dd80f41c43d124ed8c9759ae3bb14569d750","sha256":"b2767726977ceee9d6cc855165abab646c500a32724e25a5f1e5bac52b9d5bc3","sha512":"78126bce85fa5e6b55f7fdf2b310b85b056722792ab713f1735c72219fa436d3b3a1be46736195d95f07c1161a21a7b6ffdbe63938bf128aa364042cd0ca44c6","ssdeep":"768:PYaUMAmy0OzZISsRys1FAuF3XuFFF5FlX+fXoFoSJKUzEDgfcsXtUemBjbbSw:MV0OFISsRvWj5FlX+f4/XtUemBjbbT","tlshash":"674374ab56a310147c2795a42feb174e7271d003da0acc287fde5288df897ddada178c","dom_hash":"domhash8bd86247622b060cdad83c6d5ae62202","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"join-edr.com","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T17:49:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"join-edr.com","ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-05","domain_rank":0,"first_seen":"2026-07-14T17:47:55.111405Z","last_seen":"2026-07-14T17:47:55.111405Z","alert_count":0,"request_count":3,"received_data":57765,"sent_data":1403,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"bsc-dataseed2.bnbchain.org","ip":{"addr":"54.220.41.248","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2020-01-13","domain_rank":4924478,"first_seen":"2023-11-12T11:28:58Z","last_seen":"2026-07-14T17:45:25.20991Z","alert_count":0,"request_count":2,"received_data":1287,"sent_data":1067,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"zen.claims","ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-05T10:30:02.141035Z","last_seen":"2026-07-14T17:45:37.944325Z","alert_count":15,"request_count":5,"received_data":2502848,"sent_data":2678,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"guard-api-b4ca.pages.dev","ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-02","domain_rank":0,"first_seen":"2026-07-14T17:45:24.468227Z","last_seen":"2026-07-14T17:45:24.468228Z","alert_count":0,"request_count":2,"received_data":45519,"sent_data":1076,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"aeec6634ea72dadf2022b49146193409","sha1":"10921bd078f1653d92139db12ac6cd5890b0e593","sha256":"0c555f2c672e354d26025b921060d35f7dce837a02b865ca6251ef8c6cd818b5","sha512":"3cb7751ab079ac53cc77e2ee648049f991a94ef1bdbab8d6bd5bc279eb0d00a902797837caac4fadf9a3d6427de8df74e180bd8598eb0315cf1913e128275781","ssdeep":"24576:Lkph/sGj/qisZeIZTPXUiax7zSRyeP/q3H3/1ef6tKXkPDnuTC+qW6H5AQjDjFht:gSPXU3Z4Vzy1A+0a1kkv","tlshash":"0dc5029948338669639802f87c5f0bc83ea06bdcd098e73b9475d0f7b7861eb50d6876","size":2499186,"data":"","first_seen":"2026-07-14T17:45:36.983253Z","last_seen":"2026-07-14T17:50:59.851247Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f9be0d096f16f3c10609ed1baadc98e7","sha1":"cde36f1b9cf2ee038d818dc29599bf04f3f010d1","sha256":"d8a9615ce77dfb942c0624f8b2cc4021d80b4ea62ef682732e9427ee92e0b56c","sha512":"4f7d849ddf1ce9c42dec61322569f0d15d76ca5188fe1ce2f7b78a7abff72ff35943ba9cbb99599728ef784f12569f01fa11c950a38905252627f7df5d94dd87","ssdeep":"49152:pI6Dpd2EZTamfcSf3xBB4eBTETkugIV9y9HOwuLNImWZW22z3pjDegHuI9tQ0UU2:IOWDxBHuIualQ1x","tlshash":"9e168db173a1b065079352d814671001f239a84bb40d80ecf7acd9eb7fa99ca957bf36","size":4086223,"data":"","first_seen":"2026-07-14T17:45:36.985888Z","last_seen":"2026-07-14T17:50:59.845699Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"guard-api-b4ca.pages.dev/?host=https%3A%2F%2Fjoin-edr.com","fqdn":"guard-api-b4ca.pages.dev","domain":"guard-api-b4ca.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"030125497fcc7b8de5dbaeada99c12ae","sha1":"1eeb65c627fb6f825d50b78ea53184a393e61b52","sha256":"2b7537ddbe256bd2b435101e4f8076f4cc225548342ae58a1b4861a6c494a7f2","sha512":"c9d8b59527527c6f24b931e622a756936e5b87021ba851b28c9833a51c6d8ba036f10b9c810cec75f1995dfc26aee4e47d0e5248ae340c4dc1e5daf722b30804","ssdeep":"","tlshash":"310128a54a9700b108f7dae63f5f3f12776201460084c5103ebde7aaaf23d5b84199c4","size":733,"data":"","first_seen":"2026-06-11T06:03:26.798628Z","last_seen":"2026-07-23T05:25:55.417057Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"guard-api-b4ca.pages.dev/assets/index-BFMgf9ym.js","fqdn":"guard-api-b4ca.pages.dev","domain":"guard-api-b4ca.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"56294c73a80b3ddb73a406da7988fb34","sha1":"e43f2383d3f90812968b75f5179f4e9d50c90c8f","sha256":"e91887a772df8a5d107f9236ea55744971098342b25df684c157667521439f60","sha512":"94a648bf5058b6adf1185269ba9136b9e07021048ae095ac23c3c3d4b54a9fc6a7906f34d8af535ad76c96e7c1045175f1ff1e3dceae33f85a49b29e56628b9f","ssdeep":"768:2EmJl42/wD5Uk6Od+ghdKIx+Qoydzje4dvE7OYbN0jMyppQanIMI8:2Em82Idd+g3K/QoydG4UrbN0jMyrNbI8","tlshash":"7d13c09c3972224102ad1fe82e9f59c86e1ccfe1a55c986fc022c091df6a1ab14efdd5","size":42907,"data":"","first_seen":"2026-07-14T17:45:28.777315Z","last_seen":"2026-07-14T17:50:59.788254Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"guard-api-b4ca.pages.dev/?host=https%3A%2F%2Fjoin-edr.com","fqdn":"guard-api-b4ca.pages.dev","domain":"guard-api-b4ca.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"d42750fda9fed4d066f571a103c1f9f2","sha1":"850b5157a9915cc881774a8a6fc719ff16423fa7","sha256":"69f32fbd96c5f048587d9d15d82bbc5bd002446f80a78bc8aebd38822e51f912","sha512":"fd2372d735dd0f1d71677f5b524b0e26f0f585a04e0e13717b39ac3d49047d3e714038d70882215f0a2fa60d7410ff2d564916cff3597e86397ce903696598a6","ssdeep":"768:GWgxSgcPsNXCXWPrtfbqBSENokm+vliE8508Tggif7mP+OmnDhC6xQHo+WjWkhEV:GRfcPsNOB82yQL8xN","tlshash":"d733a66062d07d94274b5ff7332f7ae1f85f088e79644d8fc254bc94a6aa21bd6e0930","size":50716,"data":"","first_seen":"2026-07-14T17:45:28.831671Z","last_seen":"2026-07-14T17:50:59.847592Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4811c8868cbbc329ed583dde56c77912","sha1":"9b2c172a93e99d8b230d1070679e424b4d6d68a4","sha256":"499b17175c1035c5cb116aacd8e7f7f76796f6f2588b8097fd0eed5f43b588b6","sha512":"5c77338ac3b600b03ddc50d1854960f6d956c106c62ccf22e3205eb83bbf83f7492cdd3e1c4312ca60d93c0d85b31fb9edd8c0a46c554270447a3d76fca4af72","ssdeep":"","tlshash":"9d81421932b214704d6b666a67db33083131a1133d42ed083a0e87445fe5b5ba66dbde","size":3988,"data":"","first_seen":"2026-07-14T17:47:59.510586Z","last_seen":"2026-07-14T17:49:53.430067Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/53d6c0af35.js","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5665e68c75fe1afffeea0b1f29643232","sha1":"9c704a98f2d9f3d32915afed44f15b235a8991a3","sha256":"2075a685ee3f82d9b630e369c62f373d2279e68f7d6ece450b1b542cf212238d","sha512":"604068936278565ea89db0751172f86a40e85be75328771f839dd5f492d8e1ce00e9b5d958a5790339fb1b58ace6192a9faf42fccdf3b66037c9bba9d4779b12","ssdeep":"","tlshash":"3d21c0dbba92b4402785b7b6986f740d9777bd0adcd94428d40056c23dbeb1fd012568","size":1416,"data":"","first_seen":"2026-07-14T17:47:59.494065Z","last_seen":"2026-07-14T17:49:53.408025Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"142340339413a8e321d4d770f2d49804","sha1":"dd015d8a55cd08354bec4de85ae8edbf3158e875","sha256":"e26d2f5cfe82efe8ee8a4aff4323337f6dc44a7e9fb9b56ec4dd270d179a8917","sha512":"98da9f569c295407c31670eddc68017e311ce13667c53aa29fe4ad38b328cadffc216434ef0d7b2b870a9222ab21f47fa85d36881be12e9db50fda97a3b7a0a6","ssdeep":"192:YUJDhPTVxJKUDDgym0km4GdVGAemiLN2iYIx1:YOhPbQUHgyzkmUtYIx1","tlshash":"f0e16c273592b18e11ca47bd361993e5c166c906da9bc10af34cdee8b5dd893be0c2f1","size":7288,"data":"","first_seen":"2026-07-14T17:49:53.432486Z","last_seen":"2026-07-14T17:49:53.432486Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"join-edr.com/","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T17:49:18.700Z","timestamp":1784051358700,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"join-edr.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Jul 2026 11:51:03 GMT","end":"Sat, 03 Oct 2026 12:49:37 GMT"},"fingerprint":{"sha1":"99:00:6C:5B:1F:C5:C9:D1:2E:DA:E4:7C:CB:7A:3E:16:E1:72:08:D2","sha256":"A0:B4:6C:04:D6:1E:05:30:66:2F:67:F0:F5:2A:58:13:1B:6B:F0:E2:F3:DA:EE:17:43:FC:70:2B:13:91:DC:28"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: join-edr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:18 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fG9hVgVD0IzShfk9CgrM46Z%2Ft7ex2hR0ka4%2BJbp3UR8%2Fx9D1cvS7T5fi1jT%2Bvv%2BAwmnajFFatv2Bh2hjFfm9b8Hqcx8REVAnjn3xYmXPjNrKE%2Ba3WexmXkJ1ReeELcA%3D\"}]}\r\npriority: u=0,i\r\nlast-modified: Sun, 05 Jul 2026 15:37:14 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nreferrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade\r\npermissions-policy: camera=(), microphone=(), geolocation=(), camera=(), microphone=(), geolocation=()\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1b25d000b06b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53264,"size_decoded":13216,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (328)","md5":"76dd55b5f6764fcde726448a3fb3652a","sha1":"82b2c647e770f97da41e2e56e4fdb25189d623ac","sha256":"9dd91507631d24aebe5bd5ad0e47ca5a0538b4feca08d24483e47b1fc849f4b4","sha512":"8a377ad5be92bbafaf167030eb4105c2e745aa122b85c90512a156119f278e2a09dae81c81dfb75e88e6a443f7ef416b9e53d0bb31440330b25c69eb983463b7","ssdeep":"768:7YaUMAmy0OzZISsRys1FAuF3XuFFF5FlwJWFe1y1bXtUemBj9e:gV0OFISsRvWj5FlJXtUemBj9e","tlshash":"c533849b57a301147c23e5b42feb178e7271d007da0acc287fde52889f897dda961788","first_seen":"2026-07-14T17:47:59.486215Z","last_seen":"2026-07-14T17:49:53.400294Z","times_seen":2,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":5,"connect":17,"send":0,"wait":80,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed2.bnbchain.org/","fqdn":"bsc-dataseed2.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"54.220.41.248","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.413Z","timestamp":1784051359413,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 10 Apr 2026 00:00:00 GMT","end":"Sat, 24 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:51:35:3C:6A:BD:00:80:7E:C2:BB:61:75:B1:0A:D8:28:8C:62:89","sha256":"3E:F5:AA:B6:AF:7A:6B:4C:8C:99:02:80:C8:8D:C7:A8:56:7D:40:10:01:15:9D:68:B3:94:4D:05:F5:41:C3:94"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-dataseed2.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://join-edr.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x1AC7d768E37B147c993dE943D704c4e92d7861A1\",\"data\":\"0xb68d1809\"},\"latest\"]}"}},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 14 Jul 2026 17:49:19 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: 34f11f0de8466fb0eaf732d1a513c7e9\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":230,"size_decoded":682,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b05533c3ded95199b32b7c480697310e","sha1":"092bafcd630365d0928726d344168ab7bec24c39","sha256":"befaf2d30d1616af3da6f33b07ea357fc054a6893876626cb29ae47823483b56","sha512":"5d4f433937334a9c18074960b3b3b6083d1fb7c63a264faeb0440d8b6aa83cfe4c6612ca836e65f2f8e0c29f9f109cb298c57383f29ebb32cefb51ea83f80592","ssdeep":"","tlshash":"9bd012f4130b4b71d0ac4c449044720121217e8905c00e82080c0c8011842421725121","first_seen":"2026-07-07T07:20:30.02745Z","last_seen":"2026-07-23T05:25:55.395045Z","times_seen":20,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/favicon.ico","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.415Z","timestamp":1784051359415,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"join-edr.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Jul 2026 11:51:03 GMT","end":"Sat, 03 Oct 2026 12:49:37 GMT"},"fingerprint":{"sha1":"99:00:6C:5B:1F:C5:C9:D1:2E:DA:E4:7C:CB:7A:3E:16:E1:72:08:D2","sha256":"A0:B4:6C:04:D6:1E:05:30:66:2F:67:F0:F5:2A:58:13:1B:6B:F0:E2:F3:DA:EE:17:43:FC:70:2B:13:91:DC:28"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: join-edr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://join-edr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:19 GMT\r\ncontent-type: text/html\r\nvary: accept-encoding\r\npriority: u=6,i=?0\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nreferrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade\r\npermissions-policy: camera=(), microphone=(), geolocation=(), camera=(), microphone=(), geolocation=()\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xM5lYKUtUoAF4lxgYefkRk5jAg4TCfYpYC46NMOeg9RNHHGvBpUvdLaBjeMpbdtDRnXwNYNtCb%2BKhxt1YS7ysA7F2Hyp0Btz8OWtmg8XSa657kb4CEB1Dr6QNGfbvAc%3D\"}]}\r\nage: 120\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1b25d045c3db1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":1054,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-23T09:24:23.711107Z","times_seen":543098,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed2.bnbchain.org/","fqdn":"bsc-dataseed2.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"54.220.41.248","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.429Z","timestamp":1784051359429,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 10 Apr 2026 00:00:00 GMT","end":"Sat, 24 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:51:35:3C:6A:BD:00:80:7E:C2:BB:61:75:B1:0A:D8:28:8C:62:89","sha256":"3E:F5:AA:B6:AF:7A:6B:4C:8C:99:02:80:C8:8D:C7:A8:56:7D:40:10:01:15:9D:68:B3:94:4D:05:F5:41:C3:94"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-dataseed2.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://join-edr.com/\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Tue, 14 Jul 2026 17:49:19 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":458,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":33,"send":0,"wait":35,"receive":0,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zen.claims/x7k/gc","fqdn":"zen.claims","domain":"zen.claims","tld":"claims"},"ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.613Z","timestamp":1784051359613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zen.claims","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 14:24:48 GMT","end":"Sat, 26 Sep 2026 15:22:24 GMT"},"fingerprint":{"sha1":"E7:4D:AD:22:67:E0:E5:88:2C:ED:21:6C:9F:E4:D8:73:CB:3D:47:C8","sha256":"48:14:21:57:B6:65:54:B2:E8:E5:66:2C:C9:F1:89:85:5D:7E:1D:56:22:3B:5F:85:A2:25:D8:63:E1:D8:0E:86"}}},"request":{"raw":"OPTIONS /x7k/gc HTTP/1.1\r\nHost: zen.claims\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://join-edr.com/\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:19 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BMCTg48%2B2%2FyGFRkzckVd%2BkkQOKjxawCer2szrd1IcapSchOIQcPY3mSuFkZbQik4Xbo7DmYIW3f7xNNyqXYbOxIQyArqNJ6oiRWvhlLxx0OY2%2BueSDbukqvetC5u\"}]}\r\ncf-ray: a1b25d05b86d56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":664,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":0,"dns":2,"connect":17,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zen.claims/x7k/gf","fqdn":"zen.claims","domain":"zen.claims","tld":"claims"},"ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.979Z","timestamp":1784051359979,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zen.claims","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 14:24:48 GMT","end":"Sat, 26 Sep 2026 15:22:24 GMT"},"fingerprint":{"sha1":"E7:4D:AD:22:67:E0:E5:88:2C:ED:21:6C:9F:E4:D8:73:CB:3D:47:C8","sha256":"48:14:21:57:B6:65:54:B2:E8:E5:66:2C:C9:F1:89:85:5D:7E:1D:56:22:3B:5F:85:A2:25:D8:63:E1:D8:0E:86"}}},"request":{"raw":"OPTIONS /x7k/gf HTTP/1.1\r\nHost: zen.claims\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://join-edr.com/\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:20 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6UiN6hLetQ3g5OLflMxa7F83bnPV%2BjNUg7HI4fuUIGt8jye64WpfMHJMY3lypFWbFChVPNpT9c6dHKXVrb7gKXQsiN%2B3YrhPHoQhVkkOsPtliDCXe76ehq%2BUtjVJ\"}]}\r\ncf-ray: a1b25d07d88556bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":662,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"join-edr.com/53d6c0af35.js","fqdn":"join-edr.com","domain":"join-edr.com","tld":"com"},"ip":{"addr":"172.67.135.175","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.039Z","timestamp":1784051359039,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"join-edr.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Jul 2026 11:51:03 GMT","end":"Sat, 03 Oct 2026 12:49:37 GMT"},"fingerprint":{"sha1":"99:00:6C:5B:1F:C5:C9:D1:2E:DA:E4:7C:CB:7A:3E:16:E1:72:08:D2","sha256":"A0:B4:6C:04:D6:1E:05:30:66:2F:67:F0:F5:2A:58:13:1B:6B:F0:E2:F3:DA:EE:17:43:FC:70:2B:13:91:DC:28"}}},"request":{"raw":"GET /53d6c0af35.js HTTP/1.1\r\nHost: join-edr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://join-edr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:19 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a4a781e-588\"\r\npriority: u=3,i=?0\r\nlast-modified: Sun, 05 Jul 2026 15:28:30 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nreferrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade\r\npermissions-policy: camera=(), microphone=(), geolocation=(), camera=(), microphone=(), geolocation=()\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NJKj%2BIk3F4adjWwYcpS1PP9t3s7s%2F8L4AEYEr%2FWwUeVORk30h0MQdHXNxr0e3cG94vDb5ucoCa%2BqptuLc%2FREH0A203wXbjSTtVnUBWuKdZjlsRzNzfIowrwE%2B%2B02mI0%3D\"}]}\r\nage: 120\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a1b25d020b8fb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1416,"size_decoded":1736,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1416), with no line terminators","md5":"5665e68c75fe1afffeea0b1f29643232","sha1":"9c704a98f2d9f3d32915afed44f15b235a8991a3","sha256":"2075a685ee3f82d9b630e369c62f373d2279e68f7d6ece450b1b542cf212238d","sha512":"604068936278565ea89db0751172f86a40e85be75328771f839dd5f492d8e1ce00e9b5d958a5790339fb1b58ace6192a9faf42fccdf3b66037c9bba9d4779b12","ssdeep":"","tlshash":"3d21c0dbba92b4402785b7b6986f740d9777bd0adcd94428d40056c23dbeb1fd012568","first_seen":"2026-07-14T17:47:59.494065Z","last_seen":"2026-07-14T17:49:53.408025Z","times_seen":2,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zen.claims/x7k/gf","fqdn":"zen.claims","domain":"zen.claims","tld":"claims"},"ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:19.977Z","timestamp":1784051359977,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zen.claims","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 14:24:48 GMT","end":"Sat, 26 Sep 2026 15:22:24 GMT"},"fingerprint":{"sha1":"E7:4D:AD:22:67:E0:E5:88:2C:ED:21:6C:9F:E4:D8:73:CB:3D:47:C8","sha256":"48:14:21:57:B6:65:54:B2:E8:E5:66:2C:C9:F1:89:85:5D:7E:1D:56:22:3B:5F:85:A2:25:D8:63:E1:D8:0E:86"}}},"request":{"raw":"POST /x7k/gf HTTP/1.1\r\nHost: zen.claims\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://join-edr.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"vYuE_3TRik9vzh7llWG8\"}"}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:20 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1WZakBYusfy%2Fe7XfLgYlhqMtf9M8HeQf7oQ8p3hPKHu%2Bf9WqtPH1RGYFWz%2Fr6EODdym9ZvxTiw1rjCw1VG2CbX4dtRXchejprWZDAqq%2BzEbv0kA%2FIK%2BCkU4fkY2%2F\"}]}\r\ncf-ray: a1b25d08188c56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2499160,"size_decoded":1920457,"mime_type":"application/javascript","magic":"data","md5":"a24adffe63c1dec891d9a1ab8b00235c","sha1":"26b9d4634a6564b3dd9049cd9abdd2eb0495f64d","sha256":"8dfcba326e1d64917b092d1c0c2cc2b8dc9c2ffb898139cc9b354a899e6f8f0e","sha512":"d1740c2041d6aa868f49899c2d4b3ea610f8521b3a954f8ea8caa2f235cb650dda1111fbf888235d856a74a19c1e8afa2613453d0a54408f161057542ac58872","ssdeep":"24576:skph/sGj/qisZeIZTPXUiax7zSRyeP/q3H3/1ef6t4:pSPXU3Z41","tlshash":"5c35f299083342a5669c06f8785f1fcc3d646bdce088a72b9478d0b6bbc61ff50d6876","first_seen":"2026-07-14T17:49:53.408748Z","last_seen":"2026-07-14T17:49:53.408748Z","times_seen":1,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":139,"receive":187,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"guard-api-b4ca.pages.dev/?host=https%3A%2F%2Fjoin-edr.com","fqdn":"guard-api-b4ca.pages.dev","domain":"guard-api-b4ca.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:21.635Z","timestamp":1784051361635,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"guard-api-b4ca.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Jul 2026 13:52:24 GMT","end":"Sun, 11 Oct 2026 14:50:55 GMT"},"fingerprint":{"sha1":"08:31:E0:9A:C4:DE:4C:97:3A:3C:15:EC:09:2E:6D:9F:FA:23:C1:E4","sha256":"09:51:8C:5C:07:AA:86:21:E5:E7:BC:F8:84:2F:A5:0F:B3:EB:C9:A7:F9:71:12:FD:CC:D1:47:09:C1:EE:D5:A8"}}},"request":{"raw":"GET /?host=https%3A%2F%2Fjoin-edr.com HTTP/1.1\r\nHost: guard-api-b4ca.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://join-edr.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 14 Jul 2026 17:49:21 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=4,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=myCxuSK2droyzjiV%2BumvngBi1bZscwtCOpaVV82Y1faKSNFGhVt89eGXpDwNIbcNArGo72u4aDuJeqcE56RsaTx4PFyAnPtQ9zdmqHmxuZEReFDBvxTAsc5GS%2FFaZx%2B6x81CSGxtIuXXenU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a1b25d126d8a712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1086,"size_decoded":1186,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"dccd9e9ab7c59b0179197f3066815b4f","sha1":"c88f2217ef9b20f9fcebe05f1e532030e9936957","sha256":"9c7e96b7633e4aaeae6e0eab538aa4b370ef13241193e04e43fb4a34283b8b3a","sha512":"20f8f4962982e0e46980d2ba556c753ccefc9e5817b2f2cad9911d8489272be73dd95527cb5c5dc7a48fbc5cf189e511d5d2120e0584c9c44b49cc16cdf97ae3","ssdeep":"","tlshash":"69118e450d57407115f38a963b5f7e05a666924640c4c5002ffae2a7af53e4b8805ad8","first_seen":"2026-07-14T17:45:28.783981Z","last_seen":"2026-07-14T17:50:59.77625Z","times_seen":9,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":4,"connect":21,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"guard-api-b4ca.pages.dev/assets/index-BFMgf9ym.js","fqdn":"guard-api-b4ca.pages.dev","domain":"guard-api-b4ca.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.44.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://guard-api-b4ca.pages.dev/?host=https%3A%2F%2Fjoin-edr.com","date":"2026-07-14T17:49:21.771Z","timestamp":1784051361771,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"guard-api-b4ca.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Jul 2026 13:52:24 GMT","end":"Sun, 11 Oct 2026 14:50:55 GMT"},"fingerprint":{"sha1":"08:31:E0:9A:C4:DE:4C:97:3A:3C:15:EC:09:2E:6D:9F:FA:23:C1:E4","sha256":"09:51:8C:5C:07:AA:86:21:E5:E7:BC:F8:84:2F:A5:0F:B3:EB:C9:A7:F9:71:12:FD:CC:D1:47:09:C1:EE:D5:A8"}}},"request":{"raw":"GET /assets/index-BFMgf9ym.js HTTP/1.1\r\nHost: guard-api-b4ca.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://guard-api-b4ca.pages.dev/?host=https%3A%2F%2Fjoin-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 14 Jul 2026 17:49:21 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kmqfehif%2Fe8V9jwa0BMtKqKAWcHvVwAwQWut0nK%2BzOpL9FJ31sCaZvXCEZDHdFYEZbSluH84aLNxPpmvPmbp6SW8ePlDDF7eRiNEI6aXkuMe07sNeqWfsmmZ061%2B00dg%2F%2Fe9Cx080ILRIMk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"f607c59b23e15d664fe420da215b20a1\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a1b25d131e56712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42907,"size_decoded":31629,"mime_type":"application/javascript","magic":"data","md5":"56294c73a80b3ddb73a406da7988fb34","sha1":"e43f2383d3f90812968b75f5179f4e9d50c90c8f","sha256":"e91887a772df8a5d107f9236ea55744971098342b25df684c157667521439f60","sha512":"94a648bf5058b6adf1185269ba9136b9e07021048ae095ac23c3c3d4b54a9fc6a7906f34d8af535ad76c96e7c1045175f1ff1e3dceae33f85a49b29e56628b9f","ssdeep":"768:2EmJl42/wD5Uk6Od+ghdKIx+Qoydzje4dvE7OYbN0jMyppQanIMI8:2Em82Idd+g3K/QoydG4UrbN0jMyrNbI8","tlshash":"7d13c09c3972224102ad1fe82e9f59c86e1ccfe1a55c986fc022c091df6a1ab14efdd5","first_seen":"2026-07-14T17:45:28.777315Z","last_seen":"2026-07-14T17:50:59.788254Z","times_seen":9,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zen.claims/api/fp","fqdn":"zen.claims","domain":"zen.claims","tld":"claims"},"ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:21.837Z","timestamp":1784051361837,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zen.claims","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 14:24:48 GMT","end":"Sat, 26 Sep 2026 15:22:24 GMT"},"fingerprint":{"sha1":"E7:4D:AD:22:67:E0:E5:88:2C:ED:21:6C:9F:E4:D8:73:CB:3D:47:C8","sha256":"48:14:21:57:B6:65:54:B2:E8:E5:66:2C:C9:F1:89:85:5D:7E:1D:56:22:3B:5F:85:A2:25:D8:63:E1:D8:0E:86"}}},"request":{"raw":"POST /api/fp HTTP/1.1\r\nHost: zen.claims\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nX-Worker-Hint: 9a8760827bb851145bfdc94421e3d694\r\nContent-Length: 1316\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://join-edr.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1316,"data":"JuFmdEYEVxsEIVS+I1xq9aXBhtVuOjeI/HkRAfdwpqCNQ+LK8KQs+fS/Sf70Xv5MLBxexEsY/vz9p/BGlKcmVUc/8r7w27xiUcLBVFamgh+en1fpipiDk2yRq9E0DgoVU2eCOTpslYBYk8TldJ79TF+hwCg2YnTEmDhFzCeFv7IWPJfo4suw4pURhRxzhhL3JWin8CS5y+phNH45LrGl8zRiPlAQON8xKofP89y6xk/JB9ODe6h+c/7ECodHKnHibHWkoLLsq4k2OZbxXdk3MWPtD795E6cIXlVf9tW506It56HTsH/UPpl5Hb5bxc4wu2ujxnfhe9bdO6EiVi8ROXw6kxO1aU6iDnPo0YCkHjix4MJyNyO94ADrkO8zWZFsh1k2rSsAo98+Jc5xs9Ttn8devwIkVowu5TN4jvUAIGN/6EI6GMFCOOALkRW2ISo7l/sEstFsT/rsekpzAGzM375TSrjWED4h0TzrAdbwaKdtrPM7cSzBlWBjzBIZ4ASD6yyd08vu5luZyLu08fgUXn2LgR9isqMcwRSDeiaDJapf0jk4SdeTKDpnCfTagIMDOA1CNkBeCk2zV+p41fHiV+Y2Qks0n2brdKSX1CknFlLd0aXk0cmkAs+AX7NXy7qmJ96fSajlbFhOAPs/vRnOptwBY2vvn9M0iPbDIUCxvVx0TwytWPzj8Uzx9sHSYFXsMYwWF1GJvcGcL/O6UEwLty6OWZXBq0Z+SvvSsT6AFzH67fFYb9v/lj1y6bNnoyFAVyeuRUJQ5F6lenr1G2ufxUfNBWr561FWzGd4teSZK4GoFShAM6D4NRwgE4JUClvlV0aVJBVgmC8fGpgvPRq6Y8XAM6DhEUoAARMD9JG2EXaXmh4iVnCTiyGRtLNBfe1GcVzjSR7+v1Qi9lZHJiFeHjwv2GcXaG1i/OLfqvA8Qr6qNmNt+8Tydr/PdaMRSa6EHV0+j4u1OesSA4aBns7EugulSJ9ochOQoct+eFWtXZXCPXRYunZnEk1WOe/djjn93pYJsK5H0otM7BNl7jZ51o5p0bVYivV01oMJ7AWCw9TiJYOriokaVrRH1WBnhO8yMi9yAehACnbNJnVhgxOnQE12l/5+y7xTh3lU3y6AJX+uX1hl09mpLWzvZX/AZE0OJ3qWWUO4ksWwvpr9uQeTk6QGgwSzgiMP0RnqgFQdTo+EDlqt5Tc8mEYw6rnoX92SQVseBRZTPA4WM2pEuCMpE8fnheEp0pVp0Pd8poJ1Xze9OvVBIkzU1xkBNfSaWuHMfnJUkyXtG7eTeCaGsAakPwsNNC/A6EjKwTg="}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:21 GMT\r\ncontent-type: application/json; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YFMmpp3zjEpe81NtUone9ETwXHmfvKX9fu7AmXZLnvwCDgmzyohH28nbW8WLbxPvOANr1tEE7jyfcEKChHnlFmlJoj8FKZ%2B7wVvkOk%2FLYrpQ5zsfpaK9iRZ5yY76\"}]}\r\ncf-ray: a1b25d13b90956bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":270,"size_decoded":958,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"102a2ceaf76fd490051cb36943923cda","sha1":"af6cbe2ffe56b6279ef05f6edf2f85d287e3ebca","sha256":"1ba435b24d36528627c9951cbd26a0120955569d60a391c3f35702c21d22a0a1","sha512":"ada65a7ce828724f168ae6619675cd697232e110d03557caa3f024799097dccbd8705ae7fe2247dc2b5aa527543351e24a6deeb96cd5b90d47aa6e1c2ee28a7f","ssdeep":"","tlshash":"3ed02bc44a51973ebbb1e670548ce86a17e111119249e81839a65202a52753b30aa560","first_seen":"2026-07-14T17:49:53.411639Z","last_seen":"2026-07-14T17:49:53.411639Z","times_seen":1,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zen.claims/api/fp","fqdn":"zen.claims","domain":"zen.claims","tld":"claims"},"ip":{"addr":"104.21.70.23","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://join-edr.com/","date":"2026-07-14T17:49:21.838Z","timestamp":1784051361838,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zen.claims","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 14:24:48 GMT","end":"Sat, 26 Sep 2026 15:22:24 GMT"},"fingerprint":{"sha1":"E7:4D:AD:22:67:E0:E5:88:2C:ED:21:6C:9F:E4:D8:73:CB:3D:47:C8","sha256":"48:14:21:57:B6:65:54:B2:E8:E5:66:2C:C9:F1:89:85:5D:7E:1D:56:22:3B:5F:85:A2:25:D8:63:E1:D8:0E:86"}}},"request":{"raw":"OPTIONS /api/fp HTTP/1.1\r\nHost: zen.claims\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: x-worker-hint\r\nReferer: https://join-edr.com/\r\nOrigin: https://join-edr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 17:49:21 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8pmVvy0sBHyNNISvJGCTWSD3uR5IntMqAJz9o5KNgrS1zttU0Y%2BXl6SvoPj%2FGfSwDko3RZtpsn10QyG%2FGABKgjLFdib%2BaCyRlN7mCARg6%2FjvJX26wuxy88v8gWhB\"}]}\r\ncf-ray: a1b25d13790856bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":666,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"zen.claims","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}