{"report_id":"8de37cf3-d842-4010-b5e9-5e1140eaceae","version":6,"status":"done","tags":[],"date":"2026-02-05T14:00:06Z","url":{"schema":"https","addr":"claim-downbad.xyz/","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"172.67.152.238","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"claim-downbad.xyz/","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"title":"Downbad!","dom":{"size":31930,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (10131)","md5":"498c977ac099234ea269e51723949009","sha1":"823b33c1ea9cae9257d8cf618ebeecc6bb463a12","sha256":"7b1290e4de50a280804f6e765b4f7420ac87ec76ab869c4e3fad2f518851f4a4","sha512":"4c7ca7307e6a5be337dd9e26cdb0ff6a89260cb4daaf7e56823b888bce9a6c716e5783f198f660c4f4063d28a3bf1b5b05780d7856669de23d6e0e81ac60e660","ssdeep":"384:lJ2gPgvUSrIGnQPhlQ2o3cYBSm/wqjGU+QN4ZSpJJwnSulA7TpXrgjs9ngqKfiQt:lJHRC5kjGD5ESuO7TpXUjs9bKfWo","tlshash":"1be2f8ec4635165470038f81f2a7476d339fa11b9f0206e8f79cd230bb85c9ddba29a9","dom_hash":"domhash74698cf405a4682bf2d9ebc6a3c64509","first_seen":"2026-02-05T14:00:08.690687Z","last_seen":"2026-02-05T14:00:08.690687Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"claim-downbad.xyz/","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"172.67.152.238","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-12T14:00:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"claim-downbad.xyz","ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-01","domain_rank":0,"first_seen":"2026-02-05T13:18:23.842761Z","last_seen":"2026-02-05T13:18:23.842761Z","alert_count":16,"request_count":16,"received_data":1418125,"sent_data":7511,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"claim-downbad.xyz/","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9440c56095563951ff6dd6f989267ff8","sha1":"825cae8e813f69f6a011e72ad9d981db16e43a6e","sha256":"c877253c07723365c7f6b614e4774e96f679e925e61191319e3fbd11d4a3fa47","sha512":"ea11a880209df5be2f5baaed64354470c8dc494cb923bb29b0c6aedc4b502cb1d9c59327c184543395456e44f27b486ad856ee52aaf1a38de249e11592afe023","ssdeep":"","tlshash":"e7c022a4d930cd785a0800a62034a398338014a98116208ac3b9a8ce064cec24908a24","size":186,"data":"","first_seen":"2026-02-05T13:18:26.81565Z","last_seen":"2026-02-05T14:00:08.701728Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/secureproxy?s=%2Fipfs%2FnwLeLrWKv_wEZX_mNSKtEAc46233c1a2d24c53920df05164e78f70%3Ft%3D1770299985430","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"16b18b84db54261d4080986bb23905c1","sha1":"28af44ea00a51f2dc7d2159b4f7e4c69a678f0b4","sha256":"6eedb66c98e14e6b87a87d56571a967199c7947d448fb0ef3b21fecc8ae4aa51","sha512":"a0c071643867ee4b276c8f9146c57e539f70807bffcf14248542175a8c621a9add70b55b841078a441bf3d5cc75c2c2a8d5346a098f3b0724e0dbe9d6448375e","ssdeep":"6144:/ujB8gltIeTM5/S8g6zRh5gDQIHQHDk2tKM4aaFPjv8DjgYf0PfcfGfr7lFcuUkS:YhltVM/g61sdHH2tKBhv8ycKMf","tlshash":"07f43cceb78d1d7340a263e757b3d82eff880eaa854b595057c29c9122c4fa351e8d9c","size":727171,"data":"","first_seen":"2026-02-05T14:00:08.694463Z","last_seen":"2026-02-05T14:00:08.694463Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"claim-downbad.xyz/16a40f08093f262e7b5d7942374a7b71aa33b4f6.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /16a40f08093f262e7b5d7942374a7b71aa33b4f6.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-315\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b8UZNlDpMaqmJhrowP5e3mzoZLDHiE5L35PD0faO3dRH6Dug%2Bil2SWAAS8pWmjd5Toi%2FozomtkxmG5s5%2FK%2BaYufzzMBh8GomuKq3AoxK8A%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3556ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":789,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"48ca4996e46d9be77866f576b7f22d78","sha1":"16a40f08093f262e7b5d7942374a7b71aa33b4f6","sha256":"59e72e9845a5ea6a72826bbbd19df2ee7a85b6b74730068af4d23b682262accd","sha512":"603153b451d6f4346eab45d55dd50a64795179dd5a1bab340a0aeafb82098cd1571b2254b15255034e469c0386a31f280055919ed997fb294b0ac75dbd0faaf4","ssdeep":"","tlshash":"2b016d1ba79aee2b9999c10cd618c475512b91c37ec4c291d0f0ef1f290824339197c8","first_seen":"2025-09-10T07:57:05.31433Z","last_seen":"2026-07-31T18:03:20.924823Z","times_seen":11,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/d3add77c919057501b4dcc619a2178c3be401b85.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /d3add77c919057501b4dcc619a2178c3be401b85.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-676\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=49F7IGkivsTiUEXI%2BfeIpXQU6uTKJZOwMU%2B30L1Bv1IDa38ssn0SfpD7zx%2BjPQ7AtEDqHwUgFXqTFW3w%2FlrGkNRv%2Ba1E9vbIyEOoOeO6eA%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3656ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1654,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1515717ec860410450bca1a8ff648326","sha1":"d3add77c919057501b4dcc619a2178c3be401b85","sha256":"fe9211cd30dbcbbbf40bc3dab22c8f29e5e8c9159085c524e93ff0d555a4f7e0","sha512":"f51d8d0d53db239f3d0317bfc6e4405a657e6f406764355a29900c8a05b9726b344e2167fcffefe463a99c700d4b115a2fe16bb1b0d5ffcf6b0ff8f72524f545","ssdeep":"","tlshash":"3d311284e1b90bbd180357f0c528b5e375677cae6b6483e8248843b02107befc4d466c","first_seen":"2025-09-28T19:09:38.680842Z","last_seen":"2026-08-14T12:15:20.937049Z","times_seen":137,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/jupiter-CfN2gRJw.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /jupiter-CfN2gRJw.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-1561\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jmQ1wcaIP%2BBJCkURzf3tUIUJS4CJinTKSmGbozQnpF3ErjuJqweH9iYpgj4wQ7IAPVqPfJSMr9eIsl6vyOI87avdBnnpz8kWa6TVDKTYiQ%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3956ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5473,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0efdfa6d7667684c5ab600c3375d7a6e","sha1":"846c089fda30d558e6142ebd5734b875b500fc4b","sha256":"802a80de85b6a650bbbbe505896e6725000872e8c0787cd7fa94540245fe898e","sha512":"ec1aacbe14b822f5b5b7f9e085f71a8fa997046ccfadaebfe11191d2a61de39800c6c8f5494acea2bdc95a3e35c1a27736365b78777c33858489e13a23e9dffd","ssdeep":"96:+0Kx7pgm+8X6WLiXpya+hoNf0Xm6CIX6vc+Q82NLaaoy9U41K4yvT4X74c24BY44:+0Kx7+mbXpLiZya+hoNfiXrP82RaaoYo","tlshash":"2cb1d69573edf9b9f41af3eccd069064255824efe984c2b0c2f4bf0a99090962d0dad6","first_seen":"2026-02-05T13:18:26.81307Z","last_seen":"2026-02-05T14:00:08.693225Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/dexscreener-Wol7TYoZ.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /dexscreener-Wol7TYoZ.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-29c05\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JGBQWRIZ3XTsQUZerp8k%2F2cC3EW8pUK35uJ9MaiPnzWRJD82nKeBtTMdqipqTVII8fvX%2BBt9nM9MyCaHlMQgcaIIU4qPmFMZcavImpmQgA%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3a56ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":171013,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"618cb28e28f5747af87e2ea734065430","sha1":"6c58c71eb172b842cccbfb42f1b163055aa1f676","sha256":"2106d3387b9eede5d3d747a3661313fc6c602f2f6134f903382fb2fd4545f2b9","sha512":"3a2709b2e1077a87def50625e7bb95266fe453f2d23f817b220374aa097cccf2fa90446788b226fa6a8dc1a57e31ce8e961ae764f9a293108f1329a6886f611c","ssdeep":"3072:5L2CJpaCqQYyxa6MnxSgCNZXnj9gH3gkCL6A3joCAIQ0q8u:3DaCqv+cx6ZXZS1UViPP","tlshash":"f6f312e11a387470a62dd7a4747e604074b8bc3a4c9bdb8709a3558da6897c50b2fcfa","first_seen":"2026-02-05T13:18:26.808928Z","last_seen":"2026-02-05T14:00:08.693787Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/secureproxy?s=%2Fipfs%2FnwLeLrWKv_wEZX_mNSKtEAc46233c1a2d24c53920df05164e78f70%3Ft%3D1770299985430","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2FnwLeLrWKv_wEZX_mNSKtEAc46233c1a2d24c53920df05164e78f70%3Ft%3D1770299985430 HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:46 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: max-age=2592000\r\netag: W/\"b1883-KK9E6gClHy3H0hWbT35MaaZ48LQ\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=3oqhs_yi9uOVhoCmyrO1eA.js\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 02/05/2026 13:59:46\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: b003c02fd98d426c129866806c8a5a64\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h4F8lwZhBEHvyUbRrDDphxWC%2FnDA9913QirBPNn3relbAkLOrrA6haKshVSYpDDnsLAbRRAGL7MVqgA%2F5BYq0GM7gZ1rmasIoVAu76HA%2Bg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c92ee1d2b4756ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":727171,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"16b18b84db54261d4080986bb23905c1","sha1":"28af44ea00a51f2dc7d2159b4f7e4c69a678f0b4","sha256":"6eedb66c98e14e6b87a87d56571a967199c7947d448fb0ef3b21fecc8ae4aa51","sha512":"a0c071643867ee4b276c8f9146c57e539f70807bffcf14248542175a8c621a9add70b55b841078a441bf3d5cc75c2c2a8d5346a098f3b0724e0dbe9d6448375e","ssdeep":"6144:/ujB8gltIeTM5/S8g6zRh5gDQIHQHDk2tKM4aaFPjv8DjgYf0PfcfGfr7lFcuUkS:YhltVM/g61sdHH2tKBhv8ycKMf","tlshash":"07f43cceb78d1d7340a263e757b3d82eff880eaa854b595057c29c9122c4fa351e8d9c","first_seen":"2026-02-05T14:00:08.694463Z","last_seen":"2026-02-05T14:00:08.694463Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":846,"receive":327,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-05T13:59:45.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kyGQXHR9qwncWEMa6GVJuc6KSoqlvgEiS4bicinD9%2FfPPuRVY65kamnfOGLf4QI1EQYgZkWYE9mTGBScEMuLulpoi%2FXXzL5u%2BE7b%2BDZTW5P1\"}]}\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c92ee1b8ada1525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31698,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (10132)","md5":"4de9e22560c07289264f875f66755ab3","sha1":"cac43e76a041139f2a739b41494dcadf54825c44","sha256":"d5d16c1d9a5cb09a6b0f8ab150554fe020fc65a6799ae18b2cffeb33324294f6","sha512":"0b8065189ad9a5180254810000b2c367db1b8084270b211cf0b61e84fa641290a67b1193a244744b1acac71ee5aba507af11ead5c462d351ad0e8a9469f9c3b2","ssdeep":"384:VgPgvUSrIGYQPflQ2o3cYBSm/wqjGU+QN4ZSpJJwnSulA7TpXrgjs9ngqKfiQEpo:KRC59jGD5ESuO7TpXUjs9bKfWo","tlshash":"a6e2e8ec4635165470038f85f2a7476d339fa11b9f0206e8f79cd230bb85c9ddba29a9","first_seen":"2026-02-05T13:18:26.810493Z","last_seen":"2026-02-05T14:00:08.695295Z","times_seen":2,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":75,"dns":56,"connect":1,"send":0,"wait":11,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/downbad-logo.webp","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /downbad-logo.webp HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\netag: W/\"697f42ae-17c0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2503\r\npriority: u=4,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HWqjaC2u1%2Bu3%2BzTBIHPHVHJMTYGGAHnqA54DnicltSXPtkh%2F0CeSd8iPNnSdbJp7Nu1vRqKz1MFdBTpI1YNT2z2T2xD%2F5Zu2ah8lVuDkJg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c92ee1cbb3256ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6080,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 365x102, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4b076bce79453df37e22d9ea8e72ab92","sha1":"3cc38e3224d48b8fd951b4d31fdf8d268847a6d7","sha256":"cba5d1705dd59186574dc9cb5df0f1e8c18a08606564a98c5ec5effe6ea8610c","sha512":"2b0dce43990c0436264493b77b31bfb1570582a12409a95832cd10d628f0521456b57b593848b7e9c22f50b166420af74374b776a754e6110bb84dad6417d65f","ssdeep":"96:YPfqm0tppd7RHLgVZ08Tg0QrAI7RWOdhhEtMtxcJqfVRtAXhQXHW40/pZP29Y3Vd:YqmWTd7UW8Tg0mB7L9yN+X0Ze9SV2xYd","tlshash":"56c1af0a6755312014a441c7fadcf601c3fd3278435e895513dff2d82a3285aebbb39a","first_seen":"2026-02-05T13:18:26.802347Z","last_seen":"2026-02-05T14:00:08.695938Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/078a264cd05cec66acb42574be3caa03bcba5441.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /078a264cd05cec66acb42574be3caa03bcba5441.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-455\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N7WoVF3myWiCeBZu9U55RVH9fSeT36AUG0uDxWU6Ovtvs2MTzBXyYPAGYmctc9gicx8rJCnSHgOVX2B4Hgwg1K1azljTlcJyJ0UhtY4l7w%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3456ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1109,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8c03cefef7d2f9c744962ad68f1a8fac","sha1":"078a264cd05cec66acb42574be3caa03bcba5441","sha256":"f0568a024a8290d744ee7a548839ab9db336357a3fe1b8efcd881d8da1e57013","sha512":"d32da9d18f95111d9185a1ac32bb754aa91af1e3767e168d3acaa272e6c32f62a3346e85380b68682403637407ba104cc6621414563f0b22710fb5ffb677e97e","ssdeep":"","tlshash":"f811ccd53747d375c447eafd0a262dd06c1754f66725b47fc2813c0aa8560a53ca48fe","first_seen":"2025-07-22T14:10:16.992352Z","last_seen":"2026-08-14T12:15:20.953575Z","times_seen":143,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/wallet-CHMf9o-D.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /wallet-CHMf9o-D.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-46eb3\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x%2FcsD9byEAjDLDEy%2BXwv5o%2FNlfSWndXA%2B5JuryfziCTnO9ndMe%2BJxsVm0SxDjt9K1na%2Bxr1x2aeEGxKgt0%2BsNzO1p7xNDEyVpHAc6zWACw%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3756ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":290483,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ee1000b2a40caffc5d4b6da834cb4f4d","sha1":"41431bbd558cb947e8427d632d613f7fed260155","sha256":"66ae4de668659cb6cc7fd598fc2c4c0a382f064923b30f0a099da687f52a50f1","sha512":"a604cd136755c2595bbba3f683d3caf980d911a8e7c2ef34de83f70a279f2286689d507715f3c78522e96f116977f8f17aa984cf0a69365c8afab8ad424a8b58","ssdeep":"1536:xBtY4d+vtyiOqTScapG3wLzctEHKp80T7hYWOL73z6f035iKJlma2JfudAm0Uv63:vQ6xzY82U0Qq33uyMY","tlshash":"1254b3e5a3e4e3f1b006f7f8a612a4747a6f38f63a7ad304c7e61d44959305c99ac8d0","first_seen":"2026-02-05T13:18:26.812303Z","last_seen":"2026-02-05T14:00:08.697033Z","times_seen":2,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/schoolbell.ttf","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /schoolbell.ttf HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/index-DCkwevVm.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 47912\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\netag: \"697f42ae-bb28\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2502\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H3ue73ThhS4x28%2BhR9SoNK5pMt1DVksthjzJNNEy1rpZbfulG9%2FCAuc6oG2K6dQ4bi%2FiyZuAgEYg6cvAw%2BLsPpZ5eaMroS1JK1tBp8NukA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9c92ee1d3b4a56ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47912,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 14 tables, 1st \"OS/2\", 14 names, Microsoft, language 0x409, Copyright (c) 2010 by Font Diner, Inc. All rights reserved.SchoolbellRegular1.001;DINR;Schoolbel","md5":"4a7aed80c0ff6252887385d72a3fd7e7","sha1":"d7e91ce8f32d168643511405072e201bad2b6038","sha256":"5c95c4513ba2908d82ae7f2205dabb6c3e887181bd7ee4d78e1fb5f8b618d701","sha512":"2df06541b19dff858aa97fb84c942efaf6d89588769041e5bdf47ae2b0c84152513bee13528529763471d59a79bb0f6630d1481212ca5c7e36a5d78f99d93331","ssdeep":"768:7K4vZ4gzHDb0BCCOrey9hTNAXiPi6OiivJ7CqrLSV9Iool3SgXtFHxnX12KuzWHt:7KkfCCCOSyvNmrYcC+SPIjXr5TuGprUq","tlshash":"2b23f602174e6f4ee015117699002799eee3b52f5bfe3586f586affba28e0c13162743","first_seen":"2025-06-24T13:25:32.475026Z","last_seen":"2026-08-10T14:28:40.346729Z","times_seen":10,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/coingecko-CWf6Knzr.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /coingecko-CWf6Knzr.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-1147c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CqWfP6QyR5Eg1pVXo2awX2EpCWPZK2MPuuADb4MEOAC6a9J0UObW9aPbLtG395igAz53V7O%2FXlABecnjnqwkwf0b%2FBiFl%2BitapIHiuhcow%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3c56ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":70780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6868f07b550674f36aebfec19be6de21","sha1":"b762f406545e2e7fdbc4bf582cec9236f89b5b45","sha256":"4910d8e7c783fded7a91d7a2bb6d432d77663bb1282697c13b270fd5a89988c3","sha512":"2cc97f9d778347c48d8629def5119a8d977ccf3ed134cbea8f940c21b7f33631d6281be82c0191d74913d4ee9c7f0e61edf2c22a01b4721a13c733e25d4f7586","ssdeep":"1536:RgBgPJ4L7bxfYpesRQU+MWgiItZGV3X42d0o14GjEgg/q5P2spPe:2gR4XblYZR8MIIz0LUGjnFdPe","tlshash":"b063f1702317cebca823d5d8f50109e9fcc116cbe10753dada64e151e66d52c8b4fab9","first_seen":"2026-02-05T13:18:26.808089Z","last_seen":"2026-02-05T14:00:08.698261Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/background-bottom.png.html","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /background-bottom.png.html HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 2502\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M9nlJRbJbNWK9f9BYf%2FLawpBZhdlVniHg91Bxs3p1c0FNEFgdSx12YK%2F6Afh5ZiIIaHa5UOrl%2F1D62cLL%2FtSIp7BqguIFVGSMQQIIW%2B3ng%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c92ee1d2b4956ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":468,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"f13694864c17c2e84387b7b398584b07","sha1":"4a9fab83840a77bc2c888d02c24a5fab25181790","sha256":"cf1289642af84f0229f3701c6fe5882c8ffea9f8bc0b12bce3abd8188ff0c86a","sha512":"a5d6e5d6409bf851eba4a0ee8a769a06cf0c2c1a42f7f51b40c2e6a8fc60693e20c42bd38bbee7ee618ee6b54d821d63fa828cad51c5602ca91dfc09740a9285","ssdeep":"","tlshash":"4af0dc41e8b18d29123047642ec0f5449f87e78b8749ae0471a750b91fc4782cddf8bc","first_seen":"2026-02-05T13:18:26.805382Z","last_seen":"2026-02-05T14:00:08.699047Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/guy-head-transparent.webp","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /guy-head-transparent.webp HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\netag: W/\"697f42ae-56ce\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2502\r\npriority: u=6,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bd9NLR0LUWIaOeJU3cxIuGi0bANN287tBkxBcH4QOFhP0QvLu7OiU7lVLgxSjs5H%2BDf2%2BjcsaM7mEwI8laOm2Z%2BJrYEWonNHRA%2ByUW0KTQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c92ee1e8b6456ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22222,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"66e31e67542f39ce0ce4316fa2d8d17f","sha1":"c609d7f83b44781f292d689d65e30b24592a5dba","sha256":"8f777d739ecc99b8d6735a87bae1f859a9fb03ece66517e2bb7e5a559935af0e","sha512":"a93913bdb1f02d9dd78b3aa6f36747e48e819176c54d4791c1d632a094b7228e9e6002533b73e85231f86844fe62e27674389ac1073c0bd8cf625e82a58a1fc6","ssdeep":"384:ql5r8ghACLj7XbXWkYSeMIeXN6yi3wdXbvtGnDXl/N93tSeoofPvCPTez75jXZ1R:qTAghACP7XjWB4mwjMD1/ndoMv775jXd","tlshash":"7da2e15d1478ac223788231c0105bdd94a15ca8e0d2787b7f52dfe2f53f919c667296e","first_seen":"2026-02-05T13:18:26.814871Z","last_seen":"2026-02-05T14:00:08.699643Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/secureproxy?s=%2Fjmpd%2F","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:47.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim-downbad.xyz/\r\ncontent-type: application/json\r\nContent-Length: 1410\r\nOrigin: https://claim-downbad.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1410,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QBsQIgAxwACQDaAhcDKQD7AiEAAgEAKQMAAO8nhn2XtsKCAbcl7JNMPDaJlpzAiGgCAACC0wxkzL9gPOlGd4LlyTEyPPc4WniLA1sE7s3tqV7zW5z6xYVTqSh9wCa7CeLp0le-VKD1znf-KuJGWeHuyrU5wUfOmtuP3JkQZvlTC2xko2sCKdVZpbhMNVixGNd3Ag8K_NIFY16qJP0wP6GQQ_6M9770kYcDkUmxddvI9U_TF-jAMCl7aPQmZPFq_Ri2Z4L_FDortCbXRFS6bRTr_zLiybLJcXOtlFhSUOC1NRBSO4ls3x01aAfuvrF5P0-W1fdMm2DtXdg_av01-zk0XFb1H81_7VrzmJRoW_p1MRuxvuVe7VcpZqKPdZVH9dh53cGieBT-I4lOHNSI0wj0fGUV4er3JNuPEDKRS_TnveYmF_qA-BWEi_-D781T1j9oIa4T3vCHBNocn2nMY9J_HUUATXp3zmNzbcxtp6bKFQwJOdBDgLP1Eb-l7Je_cRQ1fZb7ovl6LCVIebHYWwECJGIyB3L3hq3EfvFWtNzOyYdwU1SBEvSkWjBawB7zxT78lzQ2nkCARAHGMBzdck-3hlz2oALOkF30oFttNHxh7BSS6RLHUl1dwtuHgaziVkGPF1fnGzD1NJMS7Zg8fE5O2AGVC3S1WgXOAMCqit5yGDAhKNvmwiJPAjgCFlS9a5Kg5K51BVLgvm2wSUR0X5lYQp3jRsaEdsTyhD-RwWeBiHfTK6hJxlbe1uJBAungs6xLJNFpd3vBYJ5kqOPcBjNZ2Sgle_Khz6o54wTfpk2G9tajG1VADKJ6ifrkTHTy9ABBLrXTJvZ4zf315dUTQmIo1AP4KgsYUHyyXPRKX2zZWJBplSKJD6alYhdX29K1d4uLjMYqq_JV0xI5FodllyWK7dAQFnjuQy3DGaOHiDCaiCYWXKqlkgNiLYUnDUm-t6-0anBEjnXVKjuSCiMb4akS_WV9i8HW6NXaoHZkuGUZ5qPXZwmFnxbKeuVhS1HNMAMBOtk-Mrmhi9dR__ABHUkbQVCkeUuLz6y8uHaIGvyX9PJwHeYC-Kzcx7Qy2IHVm-osIENqaqYdfmTj0ib6nFCffvKunnPTzw76KNKRvQJ4PCgoGpfRjhgMD6BHPeLBAIdw9KT4o7vRLJ7EeDWySsmQQTqTEA\",\"challenge\":\"eyJpZCI6IjV5clZiN2lZUEZDckp4WXdEaEQzanciLCJub25jZSI6NDU2LCJoYXNoIjoiMDA0OWI4YTJiNmM2ZDgzMmJiMDRlYTAzNTc2ZjRkNWE3MjNhODExZTQ4MjI1ZTc4ZjkwZDllMzQyNGE3OWViMyJ9\"}"}},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:48 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1770300047686\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 02/05/2026 13:59:48\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: d67c4e3d8b6b44586614e93350887fca\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jT7IJYOnS6O6tzdYYJp6OX2l4y1fNn4xN5PNyJo0pQ3BiR9soOQrAbLt613khAzkP0n9U7KmkmCPRzVK8TwadOTlUTY7b3%2Fmh8ZDSysK5A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c92ee294c1056ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T04:12:33.851907Z","times_seen":17929621,"resource_available":true,"data":null}},"time_used":927,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":927,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/index-DCkwevVm.css","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /index-DCkwevVm.css HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\netag: W/\"697f42ae-5afc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2503\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z2xP3nvHJgmf5Fk0G2bvXhNY2TfAFq45TsVNAie%2FbBgNiVgBU2qHKcwP7GC9tjGyxCMaxm9tWUgXMupAYA5J%2BQreP2XJJqo4H%2FMEMFHtEA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c92ee1cbb3156ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23292,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (23291)","md5":"c2c1f1a48e962e7b20e23760c52cf990","sha1":"b047d216c459f9d15472c0645164e4797a290a6a","sha256":"1c21af0d3c4db005758214f8100d13bdf3acece458b52db2cd3b2958d7b4f6e4","sha512":"09c1133e7decda5657ccd410895791b08c7f237d936f9f51260e7470306f2fbae8b72b53e9833924bd1e3898f85f108fc5a4ea506a8cb6d560244c2fe27c588d","ssdeep":"384:8kFEhYmJpFFsVkqtBbG/NZrJPpzSNSFXjSgb4GC7LbSg:OFFsVkqtBbGW6XjNbubj","tlshash":"0aa27594a327dc7ecc3758b7a39df41c9228a586cf3269d8ef42261386c67f20d15729","first_seen":"2026-02-05T13:18:26.809767Z","last_seen":"2026-02-05T14:00:08.700566Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-downbad.xyz/34388e0e1401e9cced6bc71cb82c7b83cb6153fd.svg","fqdn":"claim-downbad.xyz","domain":"claim-downbad.xyz","tld":"xyz"},"ip":{"addr":"104.21.57.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-downbad.xyz/","date":"2026-02-05T13:59:45.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-downbad.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Feb 2026 12:01:31 GMT","end":"Sat, 02 May 2026 13:00:04 GMT"},"fingerprint":{"sha1":"74:2D:20:9C:66:6B:90:C5:38:1E:94:9F:4E:4C:3B:DF:F8:CA:8E:D1","sha256":"43:40:B7:BA:D1:2E:51:5D:37:53:A1:5B:4A:59:5B:D6:DA:E2:AD:B2:72:A9:AB:67:A4:64:39:0D:C3:B5:4D:1B"}}},"request":{"raw":"GET /34388e0e1401e9cced6bc71cb82c7b83cb6153fd.svg HTTP/1.1\r\nHost: claim-downbad.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-downbad.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 05 Feb 2026 13:59:45 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sun, 01 Feb 2026 12:10:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 2503\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"697f42ae-932\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5il2UZ%2FY7IK8tJLzJ%2BEMmCDCe7BJ3SB3i2qNwFThunCK61CHB%2FqGAdAISftM33vNlavQudz8klK235LHCeOEhn3nBpUlKb729mF%2FI0fgfQ%3D%3D\"}]}\r\ncf-ray: 9c92ee1cbb3856ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2354,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c1e5bb4359d1b991a18d4cb647cdccbe","sha1":"34388e0e1401e9cced6bc71cb82c7b83cb6153fd","sha256":"88b45d29420f0c81f10b5f4bc9858cac2fb2dfa6e82a1b2bff9d6a01e805961a","sha512":"6b4133ba5eb8d552b56ff7dfbd56ad1070a16e918d9bc3ec4511ebea16ee825707f37112856e4ed38f1c5eb21999e5aa2a677d15137a23c85fbb2660d0ef0b79","ssdeep":"","tlshash":"e04192ec6758c628f406f3b78e32b8a1f896b8f3bd06e1b0d691dc94b50107928925d9","first_seen":"2026-02-05T13:18:26.803771Z","last_seen":"2026-02-05T14:00:08.701162Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-05","alert":"Sinkholed","trigger":"claim-downbad.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}