{"report_id":"8dcf75d5-65a7-4115-9756-96a409f1fe00","version":6,"status":"done","tags":[],"date":"2025-09-23T08:34:52Z","url":{"schema":"http","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":0,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"title":"TrustWallet官方app下载_TrustWallet钱包下载_TrustWallet安卓版下载_TrustWallet官网-全球领先的数字货币交易钱包"},"submit":{"url":{"schema":"http","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":0,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-28T08:34:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"trustwlallet.com","ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":186,"request_count":47,"received_data":1884500,"sent_data":25143,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]},{"name":"jQuery:1.7.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.caroufredsel.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ba5692a9fe6c99d02edd2688c0e09fc","sha1":"34ceb7c8ef10d0672f8f2eac9547147b00acb7c3","sha256":"9930f4e26cb466c1b9941f65c5b628e548d914c415d8857b143356264fb34855","sha512":"40e27d7b62f94770a2f7e8745361a26b70206d6ef50f40e89ae34a773f2fa9450c70610814177d2f0907c017c06d3f7f77f2173173f2762f4e7dd3f01921615b","ssdeep":"1536:EYQjF+MMjhPIkwFrHJc2Pyx9b2O68HOkXxEXy7l1pT9Hpyn220DTPRZmtxNpNxCy:a7DY9bfDjv9Hpyn8CxcrM4ODpZ","tlshash":"1233d99d3044b69256ab326f967f880f7b30a093e70f6990b055d7f42970d5a033bead","size":54795,"data":"","first_seen":"2023-03-07T12:10:01Z","last_seen":"2026-08-06T04:43:13.329641Z","times_seen":794,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/a1portal.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d6e61b24cc8ad8f39cc680f6cc7bf1c7","sha1":"6404ce1348bf33746e2a35c462739a75cc836bd3","sha256":"a4f2e1e1e5730e6e7c223af58fc241e21aa2a3f71a04505e3252eb6a1b0eebb5","sha512":"88655e7e3561b2950bf89b269bda8137dabac398b48a72b84c8311d8672c403fde8c16e4e99555f89fc6e61d86e176d0f88c19ee53a836bc3ecfb26fcfb23334","ssdeep":"384:qhZrEuC8dlATNfZJYAhOsqT/yAy5nDHDg3N8bFlxWU9QzYmUoa+dGvQMQSQMQZOK:qh1q8dlATVhOdKvdDgCbFlgUzw0QMQSC","tlshash":"e382841173aab1665ab9a096046f710eb026bc931c4080b8f5e4ddd4d9b9e8fd03bf78","size":18430,"data":"","first_seen":"2023-03-09T04:29:41Z","last_seen":"2026-08-06T04:43:13.33669Z","times_seen":150,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.touchswipe.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4224c565891e1902a10fc394bf3c6448","sha1":"710a581dcb01f00590bb801453bcc2691caebcb8","sha256":"cef27421c4b3f3576f397144c152e8b087762b89674b0f936f41e81ca7ce67f3","sha512":"5d2c719bf5f592b4b09d2eabeba6e8d8870b1838bf66cdb302f1c73e5c8e0282184336e7c6be5a1129e8ab0632e82ac3c201056864e48f72040a40ddd61f5d12","ssdeep":"96:NK3G8mIrPjBFkABoEqmr82JSrneCwLlsj6ktgHaJAWWsCXd:p8mAAWQVe7JottgHaJwsCXd","tlshash":"2191c6c57352b44bea7ae396e2270e01b01eae677c5a49547475fc94fd300bc435eb80","size":4313,"data":"","first_seen":"2023-03-07T01:32:17Z","last_seen":"2026-08-06T04:43:13.337278Z","times_seen":986,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/cloud-zoom.1.0.2.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0f7736dc4169a8f1963e9c4b9a697b59","sha1":"3b6a24c3783ee711787d86805dc6370505fd042b","sha256":"aaf7943255cbaaa52f89ad2a43c38efd6be610b58ec6edbe3cbbfe93a6d422a0","sha512":"3689fa9a4b30dd7e9bfa02e7f838c0e78d945011d4f514c49b4b954cd93868a612fd6924d7246c0486f506d535fda38cbcfa3c412b1510cd123bd7a7e779de04","ssdeep":"96:s/ZWzNEJTjj/zsbyfHHkVjTdpRohvjTrpgkqKH7GJQLFS/Nf0t1LT6v1:s/ZWzNEVDZfHE/EvPl+Kq6FS/NYa","tlshash":"9ee1c90c63395a19c4d3b3ed3c6f424a36334a17ce034b382269f9755ea29c89573b2c","size":7086,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.325085Z","times_seen":159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.fancybox-1.3.4.pack.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b5bb8a35405525b274873ed2c21abf9e","sha1":"560cc7d0e6a1386b9f0efaf337d9df916343a291","sha256":"20d98315749b92cd1e1101a4ce940c3cdacdd26221c8dcf5643bb8032efd1bc7","sha512":"b1c9f75e8d25ba9cb8c7f284fb8f502fd1d397691c717e5e70cb222f2a7bfa6ecf015b631d70c53b13436ed713eab6454cfe92b1e5497e231178951d7f13c14b","ssdeep":"192:EEYzwy0/HIae4FKhWP57PYKLKWCF5aYv8zXWevo:ENUyosohPYKLKjbF8zmevo","tlshash":"1e62e81676503825c27aa5b4d19fa20dd231dc719b4701b3e13ca5642fe1bc826fafee","size":15674,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.325653Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/animate.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"282febd399c0841c06d714a3580c6eb0","sha1":"a7cf4c4162c46a9c46f3ad462979a5c239d7e825","sha256":"d6312b41a8065bade3b52486bd4d1d43ab95f27eacea90f74bf4939b4a844438","sha512":"7397c8c0804282ad2ed3be919801c9bdacccf8d4e9abffcc903dd451e30d150fb6ec152001fbd01a23499307e7613f1a4ac6491bf26cc5fa39268204bc958629","ssdeep":"","tlshash":"1241f09930d2386643ff603d553f6246a8307126468a8067bcf9cc7838a2c52b82bd2c","size":2314,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-07-31T06:36:24.545361Z","times_seen":237,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.tools.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3208b2d11a1c45957e3cc2ad5e739db2","sha1":"34d90950f43663934b82606fc4b113b7bd94e8f5","sha256":"a096f452c32c0dd5df5c397eb06317ddef2d8f9d8853d799c84b891954f42ea0","sha512":"d21f77f7e00908e4ed7bec6b524be9aefc415e8354e38cc32d22a7f5f0be84d6855c3e9309d501625dc2418bf3925b15d8c088391299521c0cc26fd716b22184","ssdeep":"384:q7Ckl9jnbr7lNRJeNZJUtjLgZTzyofeCa:q7CQpb/RJeNTUtvCyo+","tlshash":"6842e58eb2c6f59386eb3578803f460ab1331c969d0d6950f06a88d1be7ca1e5263f5d","size":12686,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.33786Z","times_seen":162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.fixed.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"31ac0fb521de2f3701802711456d4803","sha1":"1a0d59665bc77ceabc73236939caac43f79e20d2","sha256":"8d1fed4e3784c1269f352f82fb0f473db8ded3f36de963835fe5189b52492e27","sha512":"942ca55d536c9a35120947aeedb3229a9c11f50fbb297dfc4eccee3223b2a1c15ebdcad0df158522a0258dff5a9f87510a5c1b48a7bcf8ad15d1c30712cb6270","ssdeep":"","tlshash":"534111d93f5e604848b7d1a99c3e8089ea3dc5331513a801716f45ccbf716e5aacef94","size":2085,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.33954Z","times_seen":145,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/device.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ccd1c11a6ba5df0cbfc470b04a3739f4","sha1":"a8864d81de7689672ef8f916e430aaabf563c22d","sha256":"a6ba246c6b7b60affbb369c8884d172dd3e4702a594f09bba678a7773a25e411","sha512":"31f7b74a31e796534d0f51bd9bc9004bdd30ee896d987300a220dadaa526753c9c6d00081f4e9d18ea2bf875c776d6ed55cba62404b22534bcd45a277ec45a79","ssdeep":"","tlshash":"435118cbf3ceb2a94227ec70197fa2cba13b4dd45c6d48daa19441963c24847c47dfa5","size":2778,"data":"","first_seen":"2023-03-07T01:34:45Z","last_seen":"2026-08-06T04:43:13.326724Z","times_seen":1002,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/pgwslideshow.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"67c2798bb54464962ced0988e69ee406","sha1":"e047de8c844c64c948928a21445e1c5011adc8e9","sha256":"e56e476ada86b25c708a26fc79b9b8236da6c0b5563a2f8d981469708ae161c9","sha512":"6100b33e662d9cbdd160d794ec2e89646215edb89db9c1d4ebeaa5442e0f7bea6750ebdbe39721003470fb9efcc49a40c124b6c11accb74be6051c8bddb1558a","ssdeep":"192:4YF9R6VNHRyUvITaXo0ZFo7LMs/EDRC2Z4UYEFY161pLWFyYDNJQno5n:4YlmJY0ZFo7Is8VC2ZqwYkpyUYue","tlshash":"095223c7525c3875c2fb212b60bfd96960becfb35b8be188a17650380d766854613f4e","size":13449,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.334937Z","times_seen":160,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/js/swiper.animate.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c65f46168f8b46c37f8394155793737","sha1":"a681bd4ac1d3972e7664e0f35d88e6ca9cfcd713","sha256":"d1136c5c805e2069d250b1036023cb10b424d690aee26525337957b67509ea39","sha512":"807167ab1c7b934efffcfa2628920a8586246d9149975c49350ce44d89212aed73eaaf8229aed203b34c45792da617e0aeadc17888d25d720a8d5b28d192ac32","ssdeep":"","tlshash":"1a314a52c30046beea123a92564f04582c305a9d5a859cb474f9af7f88ec63285fd7bb","size":1743,"data":"","first_seen":"2023-03-07T22:33:39Z","last_seen":"2026-08-05T21:36:10.566213Z","times_seen":1023,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/js/swiper.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5bb26def607ac0e0e114a502ac65e38","sha1":"2cd244e7a00c598ed9ec4e0d04325f8511667816","sha256":"770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b","sha512":"3db22c669b0df4cc315529cb2180e90d3318bec989cb5c01e130919c9889e7e6102150a138ea53114889965607add93ac5a5407a0bc10e4612970220dfc5ebd1","ssdeep":"1536:Fj2qhgxfeuGMfoqi2ZLjK8ieVlLXCiiSsWRLK7A3dnaKBjY4vHgZsUOUTqiqpBgT:wxoo6desFshaKi+HgZsUOUTqiqM37EO","tlshash":"d9d3194eb39061a551e36257535e8241a3b72809780ad0ac35b688e79dbde4c13bfffc","size":139191,"data":"","first_seen":"2023-03-07T01:06:35Z","last_seen":"2026-08-06T11:14:46.110173Z","times_seen":2089,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"93b0dc077391da0053ecb0ee4946263d","sha1":"aa68db029fc82356acdfa79eb5ee99989ce3466f","sha256":"ce766e92dd1233a75eae94e73292773f76b38ecfd5648348b7917f5b054004e4","sha512":"eb61491f08fc8951a5a056e716a8f72e6289d4c700c86f07c5c1f07e956c0879f5b5445e8ea08b7be38a3bb007a2498ae9572fc84936dd1a94bef97112e59599","ssdeep":"","tlshash":"da214988b0e6122051ff31572bfba4006f16bd0ba609da14f9bd9ac81fe1164b58775e","size":1298,"data":"","first_seen":"2025-09-23T08:35:02.79448Z","last_seen":"2025-09-23T08:35:02.79448Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/a1portalcore.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"21910238408b66ba54b9f5f90f5fbcd6","sha1":"ccf9590b4ed427bf8bd710ec023e5c76c1bdbb22","sha256":"1aca0db7071418fec21d567d2b187937b05d9c08c7546ed798c1aa9152f16803","sha512":"a22b234e5c715ab3f843a6559805748d60e8ae40f49a3490989918f49a0830282bd4f1feb2617fbf2b7954e2f85340afc5a14dccb76f42687fefe17d8dd51a01","ssdeep":"384:HJTenlxDpPRR+mLtpU5E7Wq/C01jXuqLuHNXavRa866Wqxm7yed3C8NNvC4lK:HJTFK7Wq7jXuqLuHNXavRa8pS7fg","tlshash":"3a92f108651512e595bb677aa766a48cf93648330d008000bdfdbe842ff2f2676b7df6","size":20891,"data":"","first_seen":"2023-03-11T23:26:03Z","last_seen":"2026-08-06T04:43:13.323553Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/superfish.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c07c28ec32e85210298d477a72d57078","sha1":"4a23239de208ce50da00821c644556a20a58b8ba","sha256":"5e1ffb618b51df9f00b76bf5ee0013aee4ceb29b256f4c7c74844181c9c9708d","sha512":"909ab5aea5d29de8ad0f9c7f30326154e093612a6eb93337ac5cc9b428b42945a47abccd6e150d9ad0bce3b6d8ecfbd79a521de2c7b0fab9ce4fa1c2a6cf0df4","ssdeep":"","tlshash":"c081518cf3cf75aba8a7623e403f8104eb7eca72d5498460b476485c6cd854957c6dac","size":3912,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.328529Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery-1.7.2.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8d64d0bc142b3f670cc0611b0aebcae","sha1":"abcd2ba13348f178b17141b445bc99f1917d47af","sha256":"47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4","sha512":"a684abbe37e8047c55c394366b012cc9ae5d682d29d340bc48a37be1a549aeced72de6408bedfed776a14611e6f3374015b236fbf49422b2982ef18125ff47dc","ssdeep":"1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW","tlshash":"b393e7d9b2d67123c7b731b850af510bb17698aa784c8c50f068d8e4be74a48907bf7d","size":94840,"data":"","first_seen":"2023-03-07T01:03:23Z","last_seen":"2026-08-06T19:37:13.978376Z","times_seen":24001,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/custom.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e240195c8a45e90a95ea2a265e2adc6b","sha1":"53f092f7f0d9f61dd1f13c2c1fb6da73b4788841","sha256":"c1c56607da3374a768da9acb34adc2283f7bca32189e17e8f2cbf398f9116086","sha512":"078710ebf92590e23c6e44d73f7b935b14cef35b2fb8eeb04e1c287a119ee7d340fc8f24c357aede857aff4881d6d8d4808501bcc2c9666d4728d1479b37a527","ssdeep":"192:lBfNtqR+Ja6ZzIGa1eIGQqM9LkLGqPMkjY97s:zfCV6gtW","tlshash":"cf227698b248b17c43fb3227023b9914ad3ad8234206d1b1f87d04782ff4a5957ebe6c","size":10181,"data":"","first_seen":"2025-06-07T13:52:29.884289Z","last_seen":"2026-07-17T03:27:19.350654Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/html5media-1.2.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1513f4efd484a26b33b923df4c7c9411","sha1":"577de88de97d2f0e9f4c227489902f6591366371","sha256":"82dc93a5ce18b4bc32f7fe05fd078f863b62a84c02db6928cd5b5373a5e77e8e","sha512":"75a3aa95fd49d4b6e23f15d0537029da75c7c7d89c8e12cb973889c2ffb61af88608e881acda3596cab8311d4c5ec1a8339bd30d0e35dbbeca3cca5955cf4072","ssdeep":"768:k6Ei9ddzgqc4bU0cQzVtZQw9YeSL0BdELwxLogdnH9N8vrSKEEh9qmPZB8dNKiac:sMddzgqv7cdw9JSL0BdEFgdnH9N8vrSV","tlshash":"dd03c58a76cab1394af6333552bf524af67ad277004d9000f86ce1686f74d2a4177fe8","size":39014,"data":"","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-07-31T06:36:24.568775Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d45342cbb587d97734b945b6e49c463","sha1":"7d5a68b3d18c94a0918b4838d9e437ec63be1256","sha256":"439a1699e55fb224ae575ef25fef8b7e6a43252bfd961166314d1a2f1208355d","sha512":"dbfefd7a36aee27645bd9dd22ab299494338f3cfa05b65b0f6eb67009adcb6ca1858b4aa803b28d5a3d46ce7ecbad885ebc09e6a8aa2f9d3c1ad4506a41506d1","ssdeep":"","tlshash":"6d31361ef4e6e52540b3317e0f6fc1043e20180b6659de08fdbd6ae28fac4347964ae9","size":1476,"data":"","first_seen":"2025-09-23T08:35:02.799144Z","last_seen":"2025-09-23T08:35:02.799144Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1ec6b419d7dc4d8deec400ffa594bbad","sha1":"9ec5ec6780c8055507bbcb45081a160e72e1ffd7","sha256":"2b9b339f663e0bd5c07dbdbc2dc0c8ac3b2425098759b7e7a8df3104032ef079","sha512":"f1dae243f026a7a0108e210db8a674aef193636e0462423a0a287ff335568585c03beacb1c830dae17c3adf1167d408c8f078f730390a85cc18349e7cbc02241","ssdeep":"","tlshash":"4d01ac97296064a24a2b79774c9f9500367281576d0ebedab54e0ca4cf5102c03bcbe9","size":723,"data":"","first_seen":"2023-06-10T03:36:53Z","last_seen":"2026-06-06T17:13:29.23441Z","times_seen":318,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"8bc85907539c5aeea5e43704d1343a89","sha1":"1d64c5fca3f8aafa2dedd3c955e70f74ac17f17c","sha256":"cb66b93e363563f6822d48755b05d8165a436df57c3ca74979593502ecb42e79","sha512":"1be0288013226a9f07415f421d67333b93068f0d5f0de00655ff54b817d1b7799fc62f697f81b4a87ec33c155b2c78918498434d6297bccb9ece069640b5c3bf","ssdeep":"","tlshash":"db01ab023060b532193322250b1b7110303811c7e666de50389fcb60af1c01d9279b9c","size":847,"data":"","first_seen":"2025-09-23T08:35:02.802055Z","last_seen":"2025-09-23T08:35:02.802055Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"trustwlallet.com/images/logo.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Jun 2025 08:37:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68551dc1-342b\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13355,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 48, 8-bit/color RGBA, non-interlaced","md5":"1337579eda79fb2019b069d0e01fad42","sha1":"4f9d41804581e030c88530a26af03d16f183ea07","sha256":"b0bd4d3afd369bc29d3c3184e94746963165a75b594e257bb6872a6d5e5aa75e","sha512":"7b865f1d556a0ae5793bf19117dfbeae8a0c8ae2d78f68e891a280db99f284e61d9bcd725691e271b31f3041b58490bf2cc02b554d9c5ae38c47d24d72d9f594","ssdeep":"192:A/LhlNAlnaebeZJqAVg+TgYvhTeH9goM41K2CWS74JNeaAqMN1489EXE93AotPmo:ASlna1Zda+kYRg9/KFTbaU3f9hBZ","tlshash":"9552c0062251c454c42d002ad85cac99c7fdca1b87e60a25bbfd519b7d6ec99cd9fc32","first_seen":"2025-06-26T17:56:30.607377Z","last_seen":"2026-04-06T08:28:59.306138Z","times_seen":48,"resource_available":false,"data":null}},"time_used":767,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":767,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/uploads/allimg/250430/1-250430142324-51.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-51.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-19fa6\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106406,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x669, components 3","md5":"9eee6cdd6bf1588bbc8f675e583a5496","sha1":"469c08ffc60ae968b4be1ad08fc74ba6d5e14abd","sha256":"47c22a0014a878a4fca5de7cc1a76324c2d6ecc3a641e152636d66c67c28ef46","sha512":"6601113b9a5e7d5b558fb03ed8f0b76761905ee322bd701fbb5eebc35b4d1adf9bd2ce9ffb525d055c7fcb08d27247e7166d6442eb3fef4374b6ca0bf4dc6720","ssdeep":"3072:SJSCNhw56CQIZjUSnhBuGvpkBBZvQKGlRx70H36vF:it9CvLuGGBZQjx70H36vF","tlshash":"fda30253eb172bdfda580772a1e71b35b72aab7623871b308ac515b50f006d93f04a91","first_seen":"2025-06-26T17:56:30.603836Z","last_seen":"2026-04-06T08:28:59.298789Z","times_seen":41,"resource_available":false,"data":null}},"time_used":765,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":765,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/ico-qq.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/ico-qq.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 860\r\nlast-modified: Tue, 01 Nov 2016 06:45:58 GMT\r\netag: \"58183a26-35c\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":860,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"e73c8556542e351d16747c16d19380d3","sha1":"3255ab43e4daa25cb75d9d511b9a29279dd5a98f","sha256":"62d8ca520fa45149eb924b157338eaf753f917cdcdea70cf0367787ef0a1c6bd","sha512":"6f220d54114d22674ecc290597e5abaa675f2a931bee70a4916c6b921d7902372356ff59043bb5e13e18c2b3f30bdab0db55916b6233fd703817988fdf26a907","ssdeep":"","tlshash":"661196e5b20426590b8d80706af74199ccb2489aa19f004df791f51e420f1a6609bfbb","first_seen":"2023-05-22T04:56:33Z","last_seen":"2025-12-19T02:09:25.684661Z","times_seen":8,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery-1.7.2.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery-1.7.2.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:45:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a22-17278\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":94840,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32769)","md5":"b8d64d0bc142b3f670cc0611b0aebcae","sha1":"abcd2ba13348f178b17141b445bc99f1917d47af","sha256":"47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4","sha512":"a684abbe37e8047c55c394366b012cc9ae5d682d29d340bc48a37be1a549aeced72de6408bedfed776a14611e6f3374015b236fbf49422b2982ef18125ff47dc","ssdeep":"1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW","tlshash":"b393e7d9b2d67123c7b731b850af510bb17698aa784c8c50f068d8e4be74a48907bf7d","first_seen":"2023-03-07T01:03:23Z","last_seen":"2026-08-06T19:37:13.978376Z","times_seen":24001,"resource_available":true,"data":null}},"time_used":689,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":689,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.fancybox-1.3.4.pack.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery.fancybox-1.3.4.pack.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:45:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a26-3d3a\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15674,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (752), with CRLF line terminators","md5":"b5bb8a35405525b274873ed2c21abf9e","sha1":"560cc7d0e6a1386b9f0efaf337d9df916343a291","sha256":"20d98315749b92cd1e1101a4ce940c3cdacdd26221c8dcf5643bb8032efd1bc7","sha512":"b1c9f75e8d25ba9cb8c7f284fb8f502fd1d397691c717e5e70cb222f2a7bfa6ecf015b631d70c53b13436ed713eab6454cfe92b1e5497e231178951d7f13c14b","ssdeep":"192:EEYzwy0/HIae4FKhWP57PYKLKWCF5aYv8zXWevo:ENUyosohPYKLKjbF8zmevo","tlshash":"1e62e81676503825c27aa5b4d19fa20dd231dc719b4701b3e13ca5642fe1bc826fafee","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.325653Z","times_seen":158,"resource_available":true,"data":null}},"time_used":772,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":772,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/pgwslideshow.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/pgwslideshow.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a32-3489\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13449,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13237), with CRLF line terminators","md5":"67c2798bb54464962ced0988e69ee406","sha1":"e047de8c844c64c948928a21445e1c5011adc8e9","sha256":"e56e476ada86b25c708a26fc79b9b8236da6c0b5563a2f8d981469708ae161c9","sha512":"6100b33e662d9cbdd160d794ec2e89646215edb89db9c1d4ebeaa5442e0f7bea6750ebdbe39721003470fb9efcc49a40c124b6c11accb74be6051c8bddb1558a","ssdeep":"192:4YF9R6VNHRyUvITaXo0ZFo7LMs/EDRC2Z4UYEFY161pLWFyYDNJQno5n:4YlmJY0ZFo7Is8VC2ZqwYkpyUYue","tlshash":"095223c7525c3875c2fb212b60bfd96960becfb35b8be188a17650380d766854613f4e","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.334937Z","times_seen":160,"resource_available":true,"data":null}},"time_used":771,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":771,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/index.php?act=api\u0026aid=1","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /index.php?act=api\u0026aid=1 HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":1004,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1004,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/animate.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/animate.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2e-90a\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2314,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1364), with CRLF line terminators","md5":"282febd399c0841c06d714a3580c6eb0","sha1":"a7cf4c4162c46a9c46f3ad462979a5c239d7e825","sha256":"d6312b41a8065bade3b52486bd4d1d43ab95f27eacea90f74bf4939b4a844438","sha512":"7397c8c0804282ad2ed3be919801c9bdacccf8d4e9abffcc903dd451e30d150fb6ec152001fbd01a23499307e7613f1a4ac6491bf26cc5fa39268204bc958629","ssdeep":"","tlshash":"1241f09930d2386643ff603d553f6246a8307126468a8067bcf9cc7838a2c52b82bd2c","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-07-31T06:36:24.545361Z","times_seen":237,"resource_available":true,"data":null}},"time_used":769,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":769,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/uploads/allimg/250430/1-250430142324-52.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-52.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-9c42\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40002,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 644x363, components 3","md5":"4301c16a63d529faaf57800d0339b09d","sha1":"5d944f044c817fb66e43a23a0198479473cc8753","sha256":"b879d709b7237b97f6c9dfc3a4770eac242dfc5aeb9f081d880f808312624bdb","sha512":"7e7bb519c51a42b3f6966293fe1d6d79e588c70bc1767b04c34d21bfaf30cba943fa0948ece031e7d2da9e2fa3ea1eab394d0c8afc4176fa45ae911c7b6c5ed1","ssdeep":"768:gZKSx/DpKXaL8GTCo2ivGyl3I/ebdJGsn4Wjd6VyVpUZ8jFq9uj9EeSIyFnj:gosacbT5i83I/ebNjMVyVp/k9uj9EeYV","tlshash":"9c03f1204fa7a3d0f6138ab5828ded45f3c67785792f8fa1a7d112881c0c5d49fa35a9","first_seen":"2025-09-03T17:25:24.678217Z","last_seen":"2026-04-06T08:28:59.313174Z","times_seen":40,"resource_available":false,"data":null}},"time_used":764,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":764,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/js/swiper.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/js/swiper.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Nov 2021 08:06:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"618ccf20-21fb7\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139191,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65280)","md5":"e5bb26def607ac0e0e114a502ac65e38","sha1":"2cd244e7a00c598ed9ec4e0d04325f8511667816","sha256":"770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b","sha512":"3db22c669b0df4cc315529cb2180e90d3318bec989cb5c01e130919c9889e7e6102150a138ea53114889965607add93ac5a5407a0bc10e4612970220dfc5ebd1","ssdeep":"1536:Fj2qhgxfeuGMfoqi2ZLjK8ieVlLXCiiSsWRLK7A3dnaKBjY4vHgZsUOUTqiqpBgT:wxoo6desFshaKi+HgZsUOUTqiqM37EO","tlshash":"d9d3194eb39061a551e36257535e8241a3b72809780ad0ac35b688e79dbde4c13bfffc","first_seen":"2023-03-07T01:06:35Z","last_seen":"2026-08-06T11:14:46.110173Z","times_seen":2089,"resource_available":true,"data":null}},"time_used":764,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":764,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/weixin.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/weixin.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 16 Dec 2024 03:08:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"675f9996-6e58\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28248,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced","md5":"f0e984c963b73c0999031bfb2086384d","sha1":"c95a43c5b03040cd22d63b7c6e17c85a387e84db","sha256":"0f62160499b6db67278ec914cd59564202614f9b60c09b1db71dfbb3e33371d7","sha512":"b5470e7b9de11692637afbf903e7bfa95090064b02e0e23bc16773ed2773ce84eaf784bd39b0d62c82e68cbea3c34fb51e5cbded4117c98e37f0e8c5ed07e159","ssdeep":"768:gEdoGbNjS8iySBS8ivbmMhn4rcvWF+xVryJOORd:VdpVGivKMhPlWIEd","tlshash":"47c2e1df5e7cd893aaa59cb145fee23e705e60f434925041994f80d2b94f043b0baead","first_seen":"2025-06-28T21:41:06.015183Z","last_seen":"2026-08-05T21:36:10.441287Z","times_seen":171,"resource_available":false,"data":null}},"time_used":762,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":762,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/qhdcontent.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/qhdcontent.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26503,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (610), with CRLF, CR line terminators","md5":"0ff89d2dfcf3ddaad70c362d85e4df42","sha1":"76da10f7c7ac20ec0d2b6485230de269f38a2f8f","sha256":"f8fcd46e3b6e323316482e4bfb8ee99992ee816819bff1812be68716fc7daf22","sha512":"f8469c1a6a4dc976ecbada90b0b17a6cc51e8040a4904065ff43b752c323af4c12c673a857371770cf4882538136c364ffe93a411334c7642a58cdce710bd673","ssdeep":"768:aTElJkeokRDEgVKqd/1Ti0FRSTO2zh3rN0WpFNa:/rokRDEgVKqd/1Ti0FRSTO2zhI","tlshash":"08c211f96cd92edf9379c686e3713205cd9dc0ba8602dbedb49969fab1c160114fc980","first_seen":"2025-09-23T08:35:02.721491Z","last_seen":"2025-09-23T08:35:02.721491Z","times_seen":1,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/jquery.fancybox-1.3.4.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/jquery.fancybox-1.3.4.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8524,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with CRLF line terminators","md5":"0c52490acf7a96e6656fd856f28f0d97","sha1":"05e15c3b6a44c17e813df5d55942d13ff1cefac0","sha256":"8774c94e0add0600683412b086e5928217f095f8ea8653ee266b9bd2e2a71224","sha512":"720dc128e4c82160b9d79260cdfa0b9cae2ea53955901ed1d8e44237a6343440d0e4b49ee63f599f1054ed8b80be2ddd0ebcb5e91c03110c47cf8439e7041f1a","ssdeep":"192:/MB7BIZBK60/hc1BZBC4Bszq4uuWqy7nhscRc0i8CE0K:/AFI/K6ohM/nAW","tlshash":"2602be1a95d5308a7526ee50f7ff4a19d93d1083b6124afff5acb56683c23c4a0f20e5","first_seen":"2025-09-23T08:35:02.723066Z","last_seen":"2025-11-14T07:22:28.884519Z","times_seen":2,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/a1portalcore.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/a1portalcore.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:45:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a26-519b\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20891,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"21910238408b66ba54b9f5f90f5fbcd6","sha1":"ccf9590b4ed427bf8bd710ec023e5c76c1bdbb22","sha256":"1aca0db7071418fec21d567d2b187937b05d9c08c7546ed798c1aa9152f16803","sha512":"a22b234e5c715ab3f843a6559805748d60e8ae40f49a3490989918f49a0830282bd4f1feb2617fbf2b7954e2f85340afc5a14dccb76f42687fefe17d8dd51a01","ssdeep":"384:HJTenlxDpPRR+mLtpU5E7Wq/C01jXuqLuHNXavRa866Wqxm7yed3C8NNvC4lK:HJTFK7Wq7jXuqLuHNXavRa8pS7fg","tlshash":"3a92f108651512e595bb677aa766a48cf93648330d008000bdfdbe842ff2f2676b7df6","first_seen":"2023-03-11T23:26:03Z","last_seen":"2026-08-06T04:43:13.323553Z","times_seen":111,"resource_available":true,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":626,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/superfish.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/superfish.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2e-f48\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3912,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"c07c28ec32e85210298d477a72d57078","sha1":"4a23239de208ce50da00821c644556a20a58b8ba","sha256":"5e1ffb618b51df9f00b76bf5ee0013aee4ceb29b256f4c7c74844181c9c9708d","sha512":"909ab5aea5d29de8ad0f9c7f30326154e093612a6eb93337ac5cc9b428b42945a47abccd6e150d9ad0bce3b6d8ecfbd79a521de2c7b0fab9ce4fa1c2a6cf0df4","ssdeep":"","tlshash":"c081518cf3cf75aba8a7623e403f8104eb7eca72d5498460b476485c6cd854957c6dac","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.328529Z","times_seen":158,"resource_available":true,"data":null}},"time_used":741,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":741,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/uploads/allimg/250430/1-250430142324-50.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-50.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-1bf5c\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114524,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x720, components 3","md5":"f11ba385f6e8b46d61aaa66eff745767","sha1":"9a067fe1d1b3ebc213ecc628d00e0282b834ed5b","sha256":"50112dd4efc8d06d94fa8ef15a26854ceb796ce26e22dee1148e57fbaf34d7bf","sha512":"d1a69e0b220048f7517e2ac98266b1aed140a6ff4ed7818f3d4a2dfeb0126748a1acb389a4f345eb94129211aa6072a2e13076f8279dc3e8ac86d24977e9c2fb","ssdeep":"3072:8JWDVwNY9K65GJQz75rXRklqmBlsmESj98ZCxNdoFP:88Ra65GiRR9GumEw7doFP","tlshash":"c3b302986176eccefd43ba39f1278474c39cfb45d18de2c5309410962a2f98d75abb22","first_seen":"2025-06-26T17:56:30.600402Z","last_seen":"2026-04-06T08:28:59.290562Z","times_seen":43,"resource_available":false,"data":null}},"time_used":767,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":767,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/uploads/allimg/250430/1-250430142324-53.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324-53.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-17f12\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":98066,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x720, components 3","md5":"496f1790bcd586dd26fc8b9500366121","sha1":"58e19279360e9dea1588c4bc84f5de07e76413a3","sha256":"4fc5824a5cda76338d16c9c9eebdac0bbd4cc1e6c6c9b1176e0c5f49ceb8e76e","sha512":"0e2999897359f11da3f6320506ab1a4a8451594475b53361123329d3b15cd2a9eaca6f88650575ed4df81757203b4cbbe72dbe2fe78b110dd2900c9b542052e5","ssdeep":"1536:lp54PC/ZseXBzhQPMkI17LgUe+lC9J7deiRRMIyHtAtXQry6SAptewfyP/prq:H54PIYEk4/e9xeoqIyNHSA/XaP/prq","tlshash":"9aa302271b7427e6f2742ef47f63eba56e6a70a773903686f042300d9d72b892905f44","first_seen":"2025-09-03T17:25:24.696075Z","last_seen":"2026-04-06T08:28:59.299918Z","times_seen":40,"resource_available":false,"data":null}},"time_used":765,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":765,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/js/swiper.animate.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/js/swiper.animate.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Nov 2021 06:35:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"618b6826-6cf\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1743,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (1690), with CRLF line terminators","md5":"7c65f46168f8b46c37f8394155793737","sha1":"a681bd4ac1d3972e7664e0f35d88e6ca9cfcd713","sha256":"d1136c5c805e2069d250b1036023cb10b424d690aee26525337957b67509ea39","sha512":"807167ab1c7b934efffcfa2628920a8586246d9149975c49350ce44d89212aed73eaaf8229aed203b34c45792da617e0aeadc17888d25d720a8d5b28d192ac32","ssdeep":"","tlshash":"1a314a52c30046beea123a92564f04582c305a9d5a859cb474f9af7f88ec63285fd7bb","first_seen":"2023-03-07T22:33:39Z","last_seen":"2026-08-05T21:36:10.566213Z","times_seen":1023,"resource_available":true,"data":null}},"time_used":763,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":763,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/module-section-title-line.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/module-section-title-line.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/templates/vip3mb00289/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Nov 2016 06:46:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2c-b19\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2841,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 600 x 5, 8-bit/color RGBA, non-interlaced","md5":"964fad868d684b9bc419f144ca088935","sha1":"6a9d9432081d7bf13424fa79ad1fc17f201fdaea","sha256":"bcdd1c2bcca30a8deeb59b1e090c2a8153b966ce3cbfc8dc3252291a33e2b188","sha512":"ee6c76ffcdfd043e4a6b50b222d411ff577a293cc7c7c4c67addb21bdfdc803f9a1a8602456dd08d87c6bf778f494b1791be1282a38fad6a177c067d93e5725e","ssdeep":"","tlshash":"37516d895450481e104d0bab397fde064a27eb84835d2e0c9efe834f8720c513d75b6b","first_seen":"2025-09-23T08:35:02.728965Z","last_seen":"2025-09-23T08:35:02.728965Z","times_seen":1,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/menu.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/menu.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3915,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"de1d80c7905507e8e207777e729396bc","sha1":"8661e27e65d5303b162b4f90554f767155ef2515","sha256":"24fbe0885f749be4ad895a7e11484f7c56a6fa1e5d67400ef21670be82670e83","sha512":"60eff7b66cb4a3050e89190ed7138ad25a34dd94aed99712f0ae633d6a561e414f218f5e658d8ca93ceee319522815f86449ee9262f02b0631811ab41acb7458","ssdeep":"","tlshash":"2b8104b902c6fa2e7b0df97451f541d59b9512f8f7c501e8b41b6170bd8a8dc02fb241","first_seen":"2025-09-23T08:35:02.73044Z","last_seen":"2025-11-14T07:22:28.877152Z","times_seen":2,"resource_available":false,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.caroufredsel.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery.caroufredsel.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2e-d60b\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54795,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32032), with CRLF line terminators","md5":"1ba5692a9fe6c99d02edd2688c0e09fc","sha1":"34ceb7c8ef10d0672f8f2eac9547147b00acb7c3","sha256":"9930f4e26cb466c1b9941f65c5b628e548d914c415d8857b143356264fb34855","sha512":"40e27d7b62f94770a2f7e8745361a26b70206d6ef50f40e89ae34a773f2fa9450c70610814177d2f0907c017c06d3f7f77f2173173f2762f4e7dd3f01921615b","ssdeep":"1536:EYQjF+MMjhPIkwFrHJc2Pyx9b2O68HOkXxEXy7l1pT9Hpyn220DTPRZmtxNpNxCy:a7DY9bfDjv9Hpyn8CxcrM4ODpZ","tlshash":"1233d99d3044b69256ab326f967f880f7b30a093e70f6990b055d7f42970d5a033bead","first_seen":"2023-03-07T12:10:01Z","last_seen":"2026-08-06T04:43:13.329641Z","times_seen":794,"resource_available":true,"data":null}},"time_used":773,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":773,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.touchswipe.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery.touchswipe.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a30-10d9\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4313,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4003)","md5":"4224c565891e1902a10fc394bf3c6448","sha1":"710a581dcb01f00590bb801453bcc2691caebcb8","sha256":"cef27421c4b3f3576f397144c152e8b087762b89674b0f936f41e81ca7ce67f3","sha512":"5d2c719bf5f592b4b09d2eabeba6e8d8870b1838bf66cdb302f1c73e5c8e0282184336e7c6be5a1129e8ab0632e82ac3c201056864e48f72040a40ddd61f5d12","ssdeep":"96:NK3G8mIrPjBFkABoEqmr82JSrneCwLlsj6ktgHaJAWWsCXd:p8mAAWQVe7JottgHaJwsCXd","tlshash":"2191c6c57352b44bea7ae396e2270e01b01eae677c5a49547475fc94fd300bc435eb80","first_seen":"2023-03-07T01:32:17Z","last_seen":"2026-08-06T04:43:13.337278Z","times_seen":986,"resource_available":true,"data":null}},"time_used":773,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":773,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/custom.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/custom.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a28-27c5\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10181,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"e240195c8a45e90a95ea2a265e2adc6b","sha1":"53f092f7f0d9f61dd1f13c2c1fb6da73b4788841","sha256":"c1c56607da3374a768da9acb34adc2283f7bca32189e17e8f2cbf398f9116086","sha512":"078710ebf92590e23c6e44d73f7b935b14cef35b2fb8eeb04e1c287a119ee7d340fc8f24c357aede857aff4881d6d8d4808501bcc2c9666d4728d1479b37a527","ssdeep":"192:lBfNtqR+Ja6ZzIGa1eIGQqM9LkLGqPMkjY97s:zfCV6gtW","tlshash":"cf227698b248b17c43fb3227023b9914ad3ad8234206d1b1f87d04782ff4a5957ebe6c","first_seen":"2025-06-07T13:52:29.884289Z","last_seen":"2026-07-17T03:27:19.350654Z","times_seen":9,"resource_available":true,"data":null}},"time_used":768,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":768,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-23T08:34:29.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:30 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D; expires=Tue, 23-Sep-2025 08:35:30 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:1.7.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":69541,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1092), with CRLF line terminators","md5":"8479224e682d99c99923bf6466d5eab9","sha1":"83adf6af034edcc5a14e1b903d3f257209d597bd","sha256":"68493f7906e1dc3f3391de47cf65a01b6640f6bf16e9f24bb3a1c25a34cccf80","sha512":"7a5ac4afbe654f3f0969a2d060b5a59e6ef2d429e9ee635e1e95874945b97436b60ea543db12aae335b7bc22808edff5766794b8b7205e42850e9b1f6f8432ac","ssdeep":"1536:0eN82SFzw7MXbCXbJGdAqwHAmAdAJ3AoA7AHAHACa:kFzw7MXbCXbJGdAqwHAmAdAJ3AoA7AHB","tlshash":"4c63217105c56d22037395e46a276baefe40c687ce43994431fc67e72fb2e58ec5320a","first_seen":"2025-09-23T08:35:02.741261Z","last_seen":"2025-09-23T08:35:02.741261Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2266,"timings":{"blocked":651,"dns":229,"connect":208,"send":0,"wait":963,"receive":0,"ssl":213},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/swiper.min.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/swiper.min.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14015,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (14004)","md5":"42a7b3b0e356d5d4b9a29a40e77f3dc8","sha1":"669df5ba901266814a7db67da57cc498433612d2","sha256":"2e6ab360427637e592549154e6fae3bd663ea67df74b1d6ee66c9fa7be573d23","sha512":"56af3fb6e844a7f9d8d2d23e2bccd124de60f88dd9b6b5064470dc99ad64edc761a7d2c6b5ea115a12c05e7a71575cb5ab71feb8801ce35a8841a59365ab6671","ssdeep":"384:3Ubeo7zOqgx9BUsm/XHCXif65W/1mXA82FHy8:kbr7zOlbDm/XHwif65W/1mXA82FX","tlshash":"4152236417003837f3774f6e46a1e6b59f60cc838a934dadb2c0dd44d6fa8b9122eb95","first_seen":"2023-05-13T21:20:52Z","last_seen":"2026-08-05T21:36:10.53254Z","times_seen":585,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/html5media-1.2.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/html5media-1.2.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a32-9866\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39014,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (15961), with CRLF line terminators","md5":"1513f4efd484a26b33b923df4c7c9411","sha1":"577de88de97d2f0e9f4c227489902f6591366371","sha256":"82dc93a5ce18b4bc32f7fe05fd078f863b62a84c02db6928cd5b5373a5e77e8e","sha512":"75a3aa95fd49d4b6e23f15d0537029da75c7c7d89c8e12cb973889c2ffb61af88608e881acda3596cab8311d4c5ec1a8339bd30d0e35dbbeca3cca5955cf4072","ssdeep":"768:k6Ei9ddzgqc4bU0cQzVtZQw9YeSL0BdELwxLogdnH9N8vrSKEEh9qmPZB8dNKiac:sMddzgqv7cdw9JSL0BdEFgdnH9N8vrSV","tlshash":"dd03c58a76cab1394af6333552bf524af67ad277004d9000f86ce1686f74d2a4177fe8","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-07-31T06:36:24.568775Z","times_seen":158,"resource_available":true,"data":null}},"time_used":769,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":769,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/favicon.ico","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/favicon.ico HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-07T00:55:29.406258Z","times_seen":547009,"resource_available":true,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/365jz.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/365jz.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3181,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"fd702f1b550a4635b42451d05d6ff7f5","sha1":"da55d202486d986c1be21ec76bcec88c56094dda","sha256":"7e1c45bdf4cdad65a00b63549fc4a152654cf3601c7a8dcff0f45b5615bfcc64","sha512":"a9cbab53c84d3fd39e8a7c768903c1519fe00f089639f0251910800b1e9bb503d7d7f6cca9b11a1507bc03dd8fd3471c50f86e2c0253730af17d47aafa255b61","ssdeep":"","tlshash":"af610e1597111102e637ccb80fa42335e2849063e70392b9bfc17646cffb9a892a9fcc","first_seen":"2025-05-30T20:33:45.1247Z","last_seen":"2026-07-24T23:21:33.069221Z","times_seen":50,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.tools.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery.tools.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a32-318e\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12686,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3904)","md5":"3208b2d11a1c45957e3cc2ad5e739db2","sha1":"34d90950f43663934b82606fc4b113b7bd94e8f5","sha256":"a096f452c32c0dd5df5c397eb06317ddef2d8f9d8853d799c84b891954f42ea0","sha512":"d21f77f7e00908e4ed7bec6b524be9aefc415e8354e38cc32d22a7f5f0be84d6855c3e9309d501625dc2418bf3925b15d8c088391299521c0cc26fd716b22184","ssdeep":"384:q7Ckl9jnbr7lNRJeNZJUtjLgZTzyofeCa:q7CQpb/RJeNTUtvCyo+","tlshash":"6842e58eb2c6f59386eb3578803f460ab1331c969d0d6950f06a88d1be7ca1e5263f5d","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.33786Z","times_seen":162,"resource_available":true,"data":null}},"time_used":772,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":772,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/ico-tel.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/ico-tel.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Nov 2016 06:46:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a30-bfd\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"4ee387ad634d2ca07ff88b832b34b6d8","sha1":"105fbbb0894e37dcb4ab18330eb4ea63f912af70","sha256":"337a2c5179338e4bdf75d30b9c5051a51f54937c0fa48058cc3a10bb2ea16cbe","sha512":"a0b64a593b8c35fd5831ef68d661144257fbfdf45b38f62a1cd597b338fe067340bcfee2df2fc87b5668eefde7d3eacfdb3904c6d6c5da913e8ed3dbac3c47ab","ssdeep":"","tlshash":"3d515e886c51451f110d4ae6347bdd054a27ebd853995e1cadfe838f8620d107c75767","first_seen":"2025-09-23T08:35:02.747308Z","last_seen":"2025-11-14T07:22:28.844018Z","times_seen":2,"resource_available":false,"data":null}},"time_used":767,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":767,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/uploads/allimg/250430/1-250430142324.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /uploads/allimg/250430/1-250430142324.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Apr 2025 06:23:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811c1dc-79f4\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31220,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 750x375, components 3","md5":"0acc6f12b13689c4eefd8a473bae5e21","sha1":"2917ca56c67b682b176ca6dc96ad46e3fbee8164","sha256":"a6e7b8a0da45d4e0f17a12988e15da0afc81b08f04fa3ec80c5ce4b085c10bc1","sha512":"47ad6afd7ae3ce56cb0fb946d02015f1b08b778b1872027fa3b6f52530c03405596b7813b013c0010b867e85c8e92b6bab3ff7a831effe740023d73a5573438a","ssdeep":"768:ffOEsqbaUkfG8H23TpC1GH0WEmOXiaTyGHjS/B6IOOMH1:uEpaZOE1eVEqaOG+P8H1","tlshash":"55e2f155865086cee0fd423e40b38f7ba3cc4deb3953605e02d60e42abfda67c81c0a9","first_seen":"2025-06-26T17:56:30.593431Z","last_seen":"2026-04-06T08:28:59.29441Z","times_seen":44,"resource_available":false,"data":null}},"time_used":766,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":766,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/favicon.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.797Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/favicon.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Jun 2025 08:38:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68551e12-6758b\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":423307,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1230 x 1176, 8-bit/color RGBA, non-interlaced","md5":"b9cdafdd1ae5ce684774213c2de6c539","sha1":"88e6d8bf57afd226ff1482adcb535c2bc99805bd","sha256":"bf263ba443a53699d0d4eccf634a0b1702bee88393213805c02d0caeae4d022a","sha512":"5e7166311b5718b78b5a8799f0166fc1e83ffb914e10dec767fee3ed5760e01bac24f917378b0cc3b875bc460110875661ae55b8bac156797ac4421dfe997693","ssdeep":"12288:6L04qVepvSJQ/FSQecdEyIBrnZ2wse8sxMW:6pK0aQFSI+yIBoteJd","tlshash":"6e941233da29647287dadb69482323e2451c7add683f9c50c3c67e61b37f2de3445909","first_seen":"2025-09-03T17:25:24.663113Z","last_seen":"2026-02-19T21:55:36.646213Z","times_seen":36,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/content.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/content.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24604,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"2e748d1e31e7644b8631b6cc7634019f","sha1":"5f33c46ab68dbf1d17a1a5e2122609277cde3f7b","sha256":"52a1d57717dc9735b1372ae381e07db713083da9cb354f95085e8041956d0e5f","sha512":"2d1cf20f0af74e42dcfb5f9c2aa2116d464d230137c0066890a6038941479255e7b698c8d81f5f892f7119cbec5e70417bd1273d3b70fce6b99f2e0c7a276ea5","ssdeep":"768:9M+Y+TA11Hd/E6tD8MSvfSDmm1rAW263V469mHj:9M+Y+TA11Hd/E6tD8MSvfSDmm1rAW26+","tlshash":"13b231a49e9a0edb92bbca6197703205ed958567c500d6fd3ac424e7aff0b1400fcf89","first_seen":"2025-09-23T08:35:02.755236Z","last_seen":"2025-09-23T08:35:02.755236Z","times_seen":1,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":351,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/style.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/style.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":227546,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"e87f38256e15d284ba557095705d5865","sha1":"0fe0cfbdbe377625c2b38ffb1101a50e596c4660","sha256":"d938847c5b4caf4df208e65933cae23e7d90c2bea255d6caa71fbaf6518deac3","sha512":"646216b91ceecbe340f8d8306f12e1f3f50155148263220c0c4d50d853cf7a65f7420beb2117cc3371c15abc4ae0e3eefdeeec2dde04d060283edee1b337369f","ssdeep":"3072:f+8zSKBCLtA+kQ8eHdpVTodVJr9Q8AQm4wucMA:Tk","tlshash":"492464acda1212426237db78ebe21319ff2460638b02056c7bddaa558ff52784671fcd","first_seen":"2025-09-23T08:35:02.763601Z","last_seen":"2025-09-23T08:35:02.763601Z","times_seen":1,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/jquery.fixed.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/jquery.fixed.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 14 Aug 2024 02:19:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66bc1418-825\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2085,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"31ac0fb521de2f3701802711456d4803","sha1":"1a0d59665bc77ceabc73236939caac43f79e20d2","sha256":"8d1fed4e3784c1269f352f82fb0f473db8ded3f36de963835fe5189b52492e27","sha512":"942ca55d536c9a35120947aeedb3229a9c11f50fbb297dfc4eccee3223b2a1c15ebdcad0df158522a0258dff5a9f87510a5c1b48a7bcf8ad15d1c30712cb6270","ssdeep":"","tlshash":"534111d93f5e604848b7d1a99c3e8089ea3dc5331513a801716f45ccbf716e5aacef94","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.33954Z","times_seen":145,"resource_available":true,"data":null}},"time_used":771,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":771,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/bg-rep-03.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/bg-rep-03.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/templates/vip3mb00289/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Nov 2016 06:46:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a34-bb3\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2995,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 31 x 32, 8-bit/color RGBA, non-interlaced","md5":"26c9cac854ead3c69907228a8b6358de","sha1":"1faad63c68cbd19a92c4d1890337d0257f63f183","sha256":"586633d5b2dedaa447978fcf5c511a3610fc05951a1c104ada0712446a058f95","sha512":"69560182fdcd3571e0c79f13f01e3b982ae7d26ccdf6ceb9af10ec1d7d075915e47bbda6fd12c972af87cb4aa2457c4b8cf2b08e1b99d764fe159db0c84ec284","ssdeep":"","tlshash":"57516caf9db0908f75cdb9920dcd8101976936ac96233638d0c115ef4055e472f660a1","first_seen":"2023-05-17T17:29:28Z","last_seen":"2026-07-31T06:36:24.557414Z","times_seen":40,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/cloud-zoom.1.0.2.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/cloud-zoom.1.0.2.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2e-1bae\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7086,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6747), with CRLF line terminators","md5":"0f7736dc4169a8f1963e9c4b9a697b59","sha1":"3b6a24c3783ee711787d86805dc6370505fd042b","sha256":"aaf7943255cbaaa52f89ad2a43c38efd6be610b58ec6edbe3cbbfe93a6d422a0","sha512":"3689fa9a4b30dd7e9bfa02e7f838c0e78d945011d4f514c49b4b954cd93868a612fd6924d7246c0486f506d535fda38cbcfa3c412b1510cd123bd7a7e779de04","ssdeep":"96:s/ZWzNEJTjj/zsbyfHHkVjTdpRohvjTrpgkqKH7GJQLFS/Nf0t1LT6v1:s/ZWzNEVDZfHE/EvPl+Kq6FS/NYa","tlshash":"9ee1c90c63395a19c4d3b3ed3c6f424a36334a17ce034b382269f9755ea29c89573b2c","first_seen":"2023-03-07T12:26:32Z","last_seen":"2026-08-06T04:43:13.325085Z","times_seen":159,"resource_available":true,"data":null}},"time_used":770,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":770,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/device.min.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/device.min.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:45:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a26-ada\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2778,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2754)","md5":"ccd1c11a6ba5df0cbfc470b04a3739f4","sha1":"a8864d81de7689672ef8f916e430aaabf563c22d","sha256":"a6ba246c6b7b60affbb369c8884d172dd3e4702a594f09bba678a7773a25e411","sha512":"31f7b74a31e796534d0f51bd9bc9004bdd30ee896d987300a220dadaa526753c9c6d00081f4e9d18ea2bf875c776d6ed55cba62404b22534bcd45a277ec45a79","ssdeep":"","tlshash":"435118cbf3ceb2a94227ec70197fa2cba13b4dd45c6d48daa19441963c24847c47dfa5","first_seen":"2023-03-07T01:34:45Z","last_seen":"2026-08-06T04:43:13.326724Z","times_seen":1002,"resource_available":true,"data":null}},"time_used":770,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":770,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/images/defaultpic.gif","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /images/defaultpic.gif HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Jun 2025 08:37:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68551dc1-11287\"\r\nexpires: Thu, 23 Oct 2025 08:34:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70279,"size_decoded":0,"mime_type":"image/gif","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x720, components 3","md5":"5198516a90928dac2ea019aee561ca55","sha1":"2491a58fc676f26e11904a09dac5e0ef9ce4132a","sha256":"93d307df4820f22603ec7f8c9dd75450a1a3f3a8536eebcb9d2aef2bed9384e1","sha512":"5ea7528deb74a6645eeee6ed6ce3dd6b85f2413551ec84ca164ef06a22209388708b8c1da53a319f1080126de0d3c533e1556011d8d33f6a86f269b51dc1e2aa","ssdeep":"1536:msrD0QtaNZDUfOHBx1jKoSG8mqzbNGSip3wNsz:/4ooSoq9GryNO","tlshash":"ee63f154bbba4f8ad907477a4491b2444fe53cd9708f9f4b1986cda3df0a201929e873","first_seen":"2025-09-18T16:35:37.921219Z","last_seen":"2026-02-18T10:55:48.482281Z","times_seen":20,"resource_available":false,"data":null}},"time_used":763,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":763,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/top-bg.jpg","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/top-bg.jpg HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/templates/vip3mb00289/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 01 Nov 2016 06:46:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a2e-77f2\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30706,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=90, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x90, components 3","md5":"64fcd6d72bd0cc0cc591a695a674fd1d","sha1":"db6492293dff37eca990419254409f6dcd11338c","sha256":"5506f99b09b6fe7376155028fea4efad6765d4e7459409282ec8d338a8181b8a","sha512":"cc691ad7b0b3e8e1cc5309cccbf5c167c7baa108ae4c5be2c82eac1b3e368afcec24dd606852d5612ade87c295d973058384df4cf54207d93966457c4136bc8c","ssdeep":"192:7YNMtKw8228y4MJafxNyYNMtKw89cknTzx5o+SiAKYNMtKwf9KKg92bsRqPg92bq:7YNg78P3vYNg72vnTzx++SifYNg7f4KO","tlshash":"50d2f47299b1ff02fa724d3823a06f96411d692f5be51204b4aedb473393ca534af483","first_seen":"2025-09-23T08:35:02.77247Z","last_seen":"2025-09-23T08:35:02.77247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/animate.min.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/animate.min.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61353,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (61191)","md5":"d6dfff213c31504dc0a27d36c8e320bd","sha1":"8411c1c0418521c96d07bcca0d9dbce7e832ccc9","sha256":"f89ad2fbc54ddd9e111ed8dc7b6e4d88e6c3463134b5264da879305866e5f458","sha512":"e1cd6bd615407b53490c25ae6bbaf21977d1339477772234631054f5213253a8b254a95fa006fd9f9a40cf5d4ba18ec988c03676cc510d899daeb51da4044ffb","ssdeep":"768:hkZlIuqI46CIBqI4IuwG1RASkMDs3Uyp5CrWeu0GT6sPasb:hkZ6IuwG1RASkMDs3Uyp5CrWeu0GTT","tlshash":"cc5347ae5891228991664b66c3cc4e684b3dc77714625cdf3385684b8f87f9f33ea207","first_seen":"2023-04-07T10:13:34Z","last_seen":"2026-08-05T21:36:10.537914Z","times_seen":1490,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/pgwslideshow.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/pgwslideshow.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4477,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with CRLF line terminators","md5":"19808b25ee63e37c4a49fc9e1d67e025","sha1":"174b8ed995213faf8273de2e5a32b79809dee80f","sha256":"04eba97145e8bbe1ce426881b9303db6e9539933c7b32675a418adb4412c7ed9","sha512":"c621520f53ee80f13b4a14cc547100cfd8e18be9a5224195c4742749102204876257e85a2eb01e8b3f881cad9a019625ba66b482914ee7ad30f7523cb8eff343","ssdeep":"96:7YEEVVnRDZ1PmRPRK57d/TBmJYH/tosUJqQd0zBzisNE/cV9zPsQtAA:7YEsnRDZC0rwJOOsUJ+hBBfU2","tlshash":"ed91ae9cd5a0a14e71b35f772772e6358c9ce8a07b7f8f29a8fb50b481863c814250e6","first_seen":"2025-09-23T08:35:02.777404Z","last_seen":"2025-11-14T07:22:28.812689Z","times_seen":2,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/style/style-yellow.css","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/style/style-yellow.css HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: text/css;charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D; expires=Tue, 23-Sep-2025 08:35:31 GMT; Max-Age=60; path=/; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"78bb96d09ba4253c8605bbf982126e35","sha1":"38e8439e736e8a83c813640c544ea8b8ca036c5f","sha256":"06f149957c126fc7ccffba648a9f949f0ed643d31639650020cd54f374fdd0eb","sha512":"53ac4b47a78b2d4d8a2db100b56d0fa2983d281dfaba7ea1f77179991f0af658337fbd32ab7e1183b0f4718f67e061dd8a29f8b911e2b95f47229a79d17232b7","ssdeep":"","tlshash":"2a90040cc0075413c3700574dd010c354d547141d10174cc7cd7137530150d30030dcd","first_seen":"2024-08-31T08:28:05.679292Z","last_seen":"2026-08-06T04:43:13.333061Z","times_seen":74,"resource_available":false,"data":null}},"time_used":438,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/js/a1portal.js","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:31.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/js/a1portal.js HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A1%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Nov 2016 06:46:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a28-47fe\"\r\nexpires: Tue, 23 Sep 2025 20:34:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18430,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (18430), with no line terminators","md5":"d6e61b24cc8ad8f39cc680f6cc7bf1c7","sha1":"6404ce1348bf33746e2a35c462739a75cc836bd3","sha256":"a4f2e1e1e5730e6e7c223af58fc241e21aa2a3f71a04505e3252eb6a1b0eebb5","sha512":"88655e7e3561b2950bf89b269bda8137dabac398b48a72b84c8311d8672c403fde8c16e4e99555f89fc6e61d86e176d0f88c19ee53a836bc3ecfb26fcfb23334","ssdeep":"384:qhZrEuC8dlATNfZJYAhOsqT/yAy5nDHDg3N8bFlxWU9QzYmUoa+dGvQMQSQMQZOK:qh1q8dlATVhOdKvdDgCbFlgUzw0QMQSC","tlshash":"e382841173aab1665ab9a096046f710eb026bc931c4080b8f5e4ddd4d9b9e8fd03bf78","first_seen":"2023-03-09T04:29:41Z","last_seen":"2026-08-06T04:43:13.33669Z","times_seen":150,"resource_available":true,"data":null}},"time_used":647,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":647,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/dropdown-menu-s.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/dropdown-menu-s.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/templates/vip3mb00289/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Nov 2016 06:46:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a32-c9a\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3226,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 180, 8-bit/color RGBA, non-interlaced","md5":"1135b3d382c66d190dd844283ee8ab0a","sha1":"e08b3779c653432b323d3962899bab189362e6f2","sha256":"85c1e0d6ef969a561002088c4c1d01bb5c378998d423891e07625602ae0c17f9","sha512":"df02feacb981d874bf6732c34e10b051c8b2648351020cdb7d438344e976b689ce257c327f42897847f9c474fe252d558310949bbf05eada48408cfe033eb311","ssdeep":"","tlshash":"3f615c8e5900453dd04a0bb929ffaf03473bd6a0624a1f589dfe811f8d21f103c62f5a","first_seen":"2025-09-23T08:35:02.785349Z","last_seen":"2025-09-23T08:35:02.785349Z","times_seen":1,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/language-close.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/language-close.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/templates/vip3mb00289/style/style.css\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Nov 2016 06:45:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"58183a22-b83\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2947,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced","md5":"399ad5cd3c2d9501b7c27d3aa1bc9269","sha1":"c4e235bd5957ea47c784e02096169e46fd15a1ce","sha256":"5d7d460626898b9c22ff551b879ed23c2568c1ad1559325d86679b9e7ae7f957","sha512":"0162b334b592eb5aa60b0f497dcac2de12845e19babfc5a3015592bea5c09f6c4e1567bcb8fa374ec40c92d8f75301788655112e2a4ba491ee942f052c4f3d09","ssdeep":"","tlshash":"85516e8c9411451e110e0baa35bfed064a17a7e0939d6e0c9efe831fc720d527d35757","first_seen":"2025-09-23T08:35:02.789378Z","last_seen":"2025-09-23T08:35:02.789378Z","times_seen":1,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trustwlallet.com/templates/vip3mb00289/images/ico-kf.png","fqdn":"trustwlallet.com","domain":"trustwlallet.com","tld":"com"},"ip":{"addr":"156.243.14.61","port":443,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trustwlallet.com/","date":"2025-09-23T08:34:32.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atrsutwallet.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 18:30:13 GMT","end":"Sun, 02 Nov 2025 18:30:12 GMT"},"fingerprint":{"sha1":"6B:73:0B:E8:D8:48:8F:51:56:51:2C:D2:53:85:82:F9:6E:1C:77:1A","sha256":"A5:FF:F8:2D:8F:FC:3C:88:86:64:7C:0F:B6:3D:D3:44:7C:8F:BE:9D:16:1B:A7:5D:60:8E:05:DC:9D:5C:55:E3"}}},"request":{"raw":"GET /templates/vip3mb00289/images/ico-kf.png HTTP/1.1\r\nHost: trustwlallet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trustwlallet.com/\r\nCookie: req_limit=%7B%22timestamps%22%3A1758616470%2C%22v_count%22%3A2%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 23 Sep 2025 08:34:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 896\r\nlast-modified: Tue, 01 Nov 2016 06:46:04 GMT\r\netag: \"58183a2c-380\"\r\nexpires: Thu, 23 Oct 2025 08:34:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":896,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"eb40e6969ba3427cc1c8fee7970e8a9b","sha1":"f5dd798946272e4acae570c20f4db9aa337b1500","sha256":"3d43ce2c0003d3c6130c14ab355abe66bf6100d9c815e9c21d685c18bb010970","sha512":"2e1b71199b8884289474258056b345a0e6c802a4415d5aaa8da8affe5834336ae96b50df259dbc8e33aece310e160b73e92cd740905fcbf750996c30d1147306","ssdeep":"","tlshash":"db11b3fa22802d6ab1955477138e82c09dbbe03ed3a0204f3229a03c9b0c08e0679a13","first_seen":"2023-05-22T04:56:33Z","last_seen":"2025-12-19T02:09:25.698845Z","times_seen":7,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-23","alert":"Sinkholed","trigger":"trustwlallet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}