{"report_id":"9153c551-379e-4676-bb40-b8dd2df4f085","version":6,"status":"done","tags":[],"date":"2026-02-07T13:09:40Z","url":{"schema":"http","addr":"onboarding.ledger-extension.xyz","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.51","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/select-device","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"title":"Ledger Extension — Select your device","dom":{"size":10161,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7747)","md5":"7cab6d79d20c59ec537edce182c4ef3d","sha1":"d493b19f437a2dab28479a4e1302c27e5a170c21","sha256":"8ebb6893fa85bff257703d3abc4ed0a8b1d08b6d5d2d9d627c572b62cf0e0ca2","sha512":"6de67f91013e7e5904b35e5a9f931acbd17bd252b9d6b509a672d700ccfd7b53826fb6939891c30fab504afef8be0715434142ffa6d922ba3b157f39e2c6880b","ssdeep":"192:B97Vf0/mkHtxyL3cyO3ZVk5GIYUHux10WPBMqHzmbWJFWXF2GdCRocF/h0snhEc/:B97VcJNSY7AGTfH2MGu/hThEYhmhkh9x","tlshash":"d822c6605509a52ef05fd4cab8e07ecd30609607c627068cbce561bfcac3aeb457fa09","dom_hash":"domhash204c42acf257d3d55119faaed00f29ec","first_seen":"2026-02-07T13:09:47.20158Z","last_seen":"2026-02-07T13:09:47.20158Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"onboarding.ledger-extension.xyz","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.51","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-14T13:09:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-07T13:09:18Z","timestamp":1770469758,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":32984,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2026-02-07T13:09:18.382274+0000\",\"flow_id\":881203699695718,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.7\",\"src_port\":32984,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3435,\"start\":\"2026-02-07T13:09:18.376934+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"onboarding.ledger-extension.xyz","ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-11-06","domain_rank":0,"first_seen":"2026-02-07T13:09:43.325017Z","last_seen":"2026-02-07T13:09:43.325017Z","alert_count":42,"request_count":14,"received_data":8779675,"sent_data":6803,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipgeolocation.io","ip":{"addr":"116.202.166.112","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2018-02-26","domain_rank":221461,"first_seen":"2018-06-28T11:07:23Z","last_seen":"2026-02-06T15:13:11.942325Z","alert_count":0,"request_count":1,"received_data":1803,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2026-02-02T08:38:00.779001Z","alert_count":0,"request_count":1,"received_data":271,"sent_data":505,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/runtime.d28a5f1129356308.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"66dc0a5b6467668eaa8331ea34881a08","sha1":"7a92fa47bf1fa78f99fc5c23b6c16119926fa5af","sha256":"c6970ab3f9eaf6dc79469dbd1562ecea79e12613e3c02bf99b81ca8c43b03c80","sha512":"e23091f6d6f836e155fd85c519cd1107a9ee91d43fc8328fc9668a816851a4ea9eefde0ff5c57be757628de297f65cc51ed9267716b41097a51535ce15d29969","ssdeep":"","tlshash":"d52174e222a464e92bade881041cc4d1b636653b006ee9e29b0bc5a5e409ae0057aa31","size":1165,"data":"","first_seen":"2025-11-07T08:31:47.470098Z","last_seen":"2026-02-07T13:09:47.206062Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"7c3c3ddeb80438dcbb3d081d2d00e152","sha1":"5a4016732ee72ec77b4f6ab17047bcea6d2ea34d","sha256":"321b4f657afbf8ba49518e6ab4cbad07ea967d0b4c68f71c7deed05ed09c1187","sha512":"b252f7dc795284fe8ce404711809130d8e16670a8e49b271f9a24b04a542a0fccb7a8c7238c12b37db35fe73a2fbf1cdb374468574db4e6d39975a17dca547a3","ssdeep":"","tlshash":"de6000f0003000000003c30000330cf300000c0f00ccc30cfc0000c000c00000000c03","size":16,"data":"","first_seen":"2023-04-10T15:57:29Z","last_seen":"2026-08-17T22:07:13.754012Z","times_seen":353861,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/polyfills.b081674e8a00885f.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed39a0382d43bc7d94cbd468e350895e","sha1":"9c32b47cfe41c7cbc51452519e55869f0ba20e87","sha256":"8b7d5f2e51abd8129b641264cd8327d85cc2f78b60aa1b359cb68cc97642626f","sha512":"8ab3600b2e02af7417f1cbeb7be1fb0cf33c402ae90dd47649fcd0df06663280689aff4ce7108d6ca200d99ded42f9bfc748a0350df87fe313a1c0a012546fe2","ssdeep":"768:AbJ3ND3HzlwGskR5TNmgadspC2FNMIw/kFWOlhfFcCyme5LWxGuH4e38ecSeNMug:izlvs+vk7oKtSTnDH","tlshash":"c5f24ad57392b8b6cbfa05f5943b4407f63625a0b84c88d8f14c48ea2d7b10ad46bf2d","size":37080,"data":"","first_seen":"2023-03-09T05:47:46Z","last_seen":"2026-02-07T13:09:47.226975Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/main.bb0289eb53e11e1d.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7473838a504f61f69de7f61c613ea039","sha1":"27af784becb46534c985b0744449b0f58de913d7","sha256":"6cb6bf7a15a0eafc4be7913a9f895391f0a1d8f55239c8c8cae499842dc214af","sha512":"d94be386d8e59c6539df9bec73744c9d5b677b73b9a19703357379d29154d854e8c72253dfd2c8da47cb1412ac5269e3148bf8edefa7635344a3b24385bb72e1","ssdeep":"49152:ewgt9OSn7bfrIXRUEeLOiB7EmKA9Gvt3M8it5VyttUYdQRZh2EQhKG8ztrHUYIH2:n8N","tlshash":"f96612b17781703e83ab44a450771509bf382857a14994ecf294eceab9ddad4227bf3c","size":7038211,"data":"","first_seen":"2026-02-07T12:46:36.807766Z","last_seen":"2026-02-07T13:09:47.234755Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/runtime.d28a5f1129356308.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:17.578Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /runtime.d28a5f1129356308.js HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Sat, 07 Feb 2026 13:09:17 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QzKXOferaRj3Rd3RDcHqdCHbsCjFuyEsrLm2RRhkO0Vyw8xnCsPx81Oh1HMItA4hsL0QhR0KNbweEsSx0gWAdk0GmGnvNPDSrLRVmaQcnH5Gjuc1%2BQVHWsBDDZtz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"315438165f65a7161c84e51c934acc73\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ca31ef0cda45687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1165,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1165), with no line terminators","md5":"66dc0a5b6467668eaa8331ea34881a08","sha1":"7a92fa47bf1fa78f99fc5c23b6c16119926fa5af","sha256":"c6970ab3f9eaf6dc79469dbd1562ecea79e12613e3c02bf99b81ca8c43b03c80","sha512":"e23091f6d6f836e155fd85c519cd1107a9ee91d43fc8328fc9668a816851a4ea9eefde0ff5c57be757628de297f65cc51ed9267716b41097a51535ce15d29969","ssdeep":"","tlshash":"d52174e222a464e92bade881041cc4d1b636653b006ee9e29b0bc5a5e409ae0057aa31","first_seen":"2025-11-07T08:31:47.470098Z","last_seen":"2026-02-07T13:09:47.206062Z","times_seen":4,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/nano-x-BRw24J_G.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/nano-x-BRw24J_G.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 6773\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"aaed66150d7652d0e63cb2b7b421c0ff\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bVcKO3gKcg4aL85cDZhyFxzS4RdU0kLKlrdDYxcoyFGdJIpUrBOo1zeC5nEVJQy9RvvHFAcJnESOMdIhp8h4vHNh%2FL51NsRWmbceAmxQ4QJdEomV5yD7nL6CgTg2o6s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce045687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6773,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 109 x 544, 8-bit/color RGBA, non-interlaced","md5":"56d6873901a9bf89f0ae17277f4a33a8","sha1":"cd040e4ce31d2fadae45014955b723111618a558","sha256":"8aae5e91e7ddadf1de9e7b39cf6e10d089f9d71d9abbeba6125fcafa5bdccdbe","sha512":"f3c51aead5389363fe30b222c34b4d3029b838c07c566eb0fd88a2add220a59745c01a7fe824e858499b76cf14849c00920c41bcd8dc8ffc010ae84e99773b83","ssdeep":"192:K9OxVLtd7S1JmolG2g5Ao3wuPxB7diKCgxShVRXT:fJSJmolG35AswuTWJhVRXT","tlshash":"30e14a89b54fda04daf7c6c02ad2ac587af725b13127317c01331a9b9110d2ac699beb","first_seen":"2023-11-09T06:59:04Z","last_seen":"2026-02-07T13:09:47.210561Z","times_seen":3,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/imagegen5-removebg-preview.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/imagegen5-removebg-preview.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 87416\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"9208be4a65ca2b4fbc8488eadd70e7e0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NouAxmQA781fNz0WDTgP2F5cYcxLU%2BS6AEr2Gbc3ES%2B0gYhX24MplOiSEcYYFPvNspFKJ5KHBmHeDufEpXjEAInf9kEtx5PUeO6UbKqBqM8hfe9uiKGO2ao%2B9jAV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce055687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87416,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"26e0150ce5c4b51276f001ef8d0573bf","sha1":"56094f2a043f760674b8cb275f551dee9fe949e0","sha256":"f34f0b8f7e1927e7c113165a97d6bcde2ce316047d1dcefa911688c478958265","sha512":"5bb5e11c31c9f4a496e2f696deddc61f29f99f8b95716a7263283f59affd3f5c484fd29586b5125d712df151ba99db4d07917b555c0629b6b52294ec8fa7bb2a","ssdeep":"1536:RnC9CxQgyMRO22hnQEFJUkoPPSG/zgwbEzp1cgvQLlWAVQmD1Ikl1KK:Zxg2YQEFJiPSG/z1bgrcFpD1XEK","tlshash":"958312536a6c24b9c857a0c24bd924e84bcfc9b92e3cfdd40579da036b8b41131e729e","first_seen":"2026-02-07T12:46:36.805068Z","last_seen":"2026-02-07T13:09:47.21242Z","times_seen":2,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/main.bb0289eb53e11e1d.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:17.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /main.bb0289eb53e11e1d.js HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Sat, 07 Feb 2026 13:09:17 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dV9Mb3NB32eL8BI%2B2cA2eEtpFoeh9M6w72et6OOHrXIrzRBZAYG%2BuVVpzIgWdsA%2Fjbksfe0Y34GTn0gZBvvpfytV5zq%2BKXfEpE%2B8znlnFNsKIGjbUZAO97k6b8yiU6E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"8c7065b57c7b4d7084514ebc80e2cd06\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ca31ef0cda65687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7038211,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4bd0df78b58e80d55f7aae31b5a51733","sha1":"6ae01c2f3b51fb36372526fc82d5251fae39ad3f","sha256":"b9102180732cd4164a6e39fe6466b97a13c6711cef482d5a3c7dd597702ddd21","sha512":"a559f1c7c4a576b95282eda8233f97835e76f0eeb2a521bc2503c1b3b413d6390f65476c4ace26856f325a5d47218d91c2bad8acbfd056992d54c8a84c642609","ssdeep":"24576:ewgt9OSn7DPfrIXcFrZmJUEeg3SOiQlY+YDLX:ewgt9OSn7bfrIXRUEeLOiBD","tlshash":"ad259ea43292b03647e600e500370147f639695a744d84acf26cecef7dadd89a6b7f78","first_seen":"2026-02-07T12:46:36.801064Z","last_seen":"2026-02-07T13:09:47.215187Z","times_seen":2,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":141,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipgeolocation.io/ipgeo?apiKey=34b6b2e6f5a04dee89bfd782d837d263","fqdn":"api.ipgeolocation.io","domain":"ipgeolocation.io","tld":"io"},"ip":{"addr":"116.202.166.112","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ipgeolocation.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:53:41 GMT","end":"Wed, 18 Mar 2026 04:53:40 GMT"},"fingerprint":{"sha1":"C3:90:0E:CD:36:57:47:2F:CD:A4:6E:D3:D6:97:8F:26:55:B4:BA:4B","sha256":"CA:91:3D:0B:D8:16:44:F8:FD:A6:C1:AE:84:AD:86:6D:8D:5E:9A:BC:06:59:A5:9A:3C:C7:1F:50:F0:F5:78:8E"}}},"request":{"raw":"GET /ipgeo?apiKey=34b6b2e6f5a04dee89bfd782d837d263 HTTP/1.1\r\nHost: api.ipgeolocation.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nOrigin: https://onboarding.ledger-extension.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0 (Ubuntu)\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\ncontent-type: application/json\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://onboarding.ledger-extension.xyz\r\naccess-control-allow-credentials: true\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1479,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"35e5b2318af4fd78e46a5e46bb02f1d6","sha1":"75f631f5004e7048ac664ab9ceeaab9517f5a749","sha256":"32a73033b85a9569825fea35d232512b0199d2463ef59d383f939718ff1aed1a","sha512":"5a6eb33547818ea6a4ad1837fe15da6075d7395268d36b7c53ebc742fa72f8d5e95139d2260ce6c9afdb89cc5dfa2180d282b4d9a0f67d46d56ee15ad5ce44c1","ssdeep":"","tlshash":"7531121c4265edae9cf302c4f21d6f6b2139711383854e429f9eef9dc04829ee245355","first_seen":"2026-02-07T13:09:47.217306Z","last_seen":"2026-02-07T13:09:47.217306Z","times_seen":1,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":74,"dns":11,"connect":25,"send":0,"wait":25,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/nano-BuiTUooz.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/nano-BuiTUooz.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 6359\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f0c144dd87e37268eb8571aa090a2c85\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F76A85TjkrgGlUB0qGQXBEsy6QOVCo3OnGkNPSDtAR%2BcP5JUQlx66fN3NRlPQHB9x6U%2F08SVEdFFb%2BLfs5kIj2vFBl8lFvG%2FKdiiUXeTEFAlkUFfzn4oOnadfIYg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce025687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6359,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 109 x 544, 8-bit/color RGBA, non-interlaced","md5":"aa0e4ab28558de92451ed8896b5b0312","sha1":"fae400d2555c6286b3099bc25954d36ef21dbe8a","sha256":"f7d789d7eea9c3756e584e2a2efe0324c2dce3222cc97499e305125e1a75328c","sha512":"5227442857398dad502bb317af44943be30fad091f9833bbf7f82359f126801b81d7a1501e88b8a8c348b4e3f6afbd75c955ec2573439e3bcaa7776df7222dce","ssdeep":"96:mXawBLJudQ+UqqOVvxGk4nxnsrOHwJvb570QAOt3Pm89vUE6+qRHNKQci8nj3Bc:mXawBQQ+t5veSrL30QfRlvUE6+st7a9c","tlshash":"9cd17cc3e326cec379971c7b0382ba75e685706d5b0d8f769d052898a00dfa0af37846","first_seen":"2023-11-09T06:59:04Z","last_seen":"2026-02-07T13:09:47.219515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/imagestax-removebg-preview.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.382Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/imagestax-removebg-preview.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 89603\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"682ac32db0cc00ee4eaa5c2e526cef63\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4NfwTS4OTFj%2FQmtAutQhu3ggsC47hE83GKIJlVw%2B0NSQXZExlbEATK4kox51QLGxqj4xalYqYsJN4zBWd9ZT9U1gTO7OV4LZ3ouiHn2XIdTaApFUWSOQOd7rg36M61Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce065687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89603,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"115710dc8426b652f793c7cc2a9f2842","sha1":"66743ac4961ad78b3a3ab653f4bbe9f8d3f710a9","sha256":"9109f47a3fc2f65e032578d87313ba2ec61623a40cd30953528f3efcc2e690f8","sha512":"6ca26a7a709d2d09fcd70f1e07fdbf53201e64e6bb0e691eb5903911477f6d04cd6c8b36d2acead05f035de8df06d00ae05f9993ee72031ab9a69752c3fc8761","ssdeep":"1536:QytwgZelB3N2lTNciAy+lDGNhkL6Dc2J4Kk5Am8kReSeKq:IJn3N2DzAHDGs6DcW4/5L8koNKq","tlshash":"a49302c5346205f4973b0038780ad5947d033b5e9c5bf6f0a58fb16a6e9f64ee030a6e","first_seen":"2026-02-07T12:46:36.797322Z","last_seen":"2026-02-07T13:09:47.220592Z","times_seen":2,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/loading.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/loading.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 21523\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"921629de8aaa6f50a3c205c40af59c3a\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1zSmZx9vH2IGrnCXQFCT%2FK7qAdU8bLVVvaEoCy26jptzyGJhPLVsPGzqx4Q2SKxuwlppmEp3i3x9a8khI5lLQvpPVxvA%2BJiLKqstmkwb9bhye9i9Q1C4bE4TmRwh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5de085687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21523,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 390 x 134, 8-bit/color RGBA, non-interlaced","md5":"f9d5722d6a008b088f5d89a1e4d1ca7f","sha1":"7dbee09f5fcb3f3ab1c1142a585af8e19b84d91f","sha256":"66a9cac85eb7d8fe0c54ff0f9fdf56f22c8d1b0f7d6054f72ad5825be315addd","sha512":"98be28fd6477e31cf6f9e9f79f99735974dfcc02625405fbd847c79e5ac7d25efe0082d9b0a087f361d1fa92014e3e172c25a0cba83c8f6399c0bf419ee3ce80","ssdeep":"384:bzV6EdTK/NC4aXKVi70RIXQ41Mkz6PMPQ0x+9CRktSxqm4+uD88:bzTO/c4+K0041Mkz6PZ1tQfA88","tlshash":"b5a2cfe21dccea6c417b25292ab532b53a3e96f518d824bb3c5b464062d3889d086ef5","first_seen":"2026-02-07T12:46:36.799376Z","last_seen":"2026-02-07T13:09:47.222015Z","times_seen":2,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/ledger.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/ledger.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 2558\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"8582d8c9310ed0d6d015f6319e52b640\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ygA0csfyWootw%2Fp4rBf9AqePcR9pavFeY7tdBd3WywyN09hqEafCnYFvoQGLQnrrTQ2efkxpWw%2FtL8ws55YHedAAGhxc87cTUULai7av1FwR021pk%2BNSDeS3venF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce015687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2558,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 870x200, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"66911e777d4ebab8da9e997c75cf505d","sha1":"590a4a440cc23bbed91afc27a3f146aeb1f00fe8","sha256":"98c1aed4cd8e482f0c807b9c4ed99f15353f8faab62b40e1c5aaf30d559ab70d","sha512":"acc7a21b94c1ddef5c35a93531f452ba5f56d0c257aa8a17e0212cce34f98d42881d4e133dcefcdaf9d96afcd3359371769e286ab2102eef2ae62f9fcf0c48c0","ssdeep":"","tlshash":"99511cbb74074aa25487a13eb7684b577465fdece468e507c25149d05e128403e9c017","first_seen":"2026-02-07T12:46:36.804279Z","last_seen":"2026-02-07T13:09:47.224055Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-07T13:09:17.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Feb 2026 13:09:17 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ar9lfumRmFnZNP4zB6XJysLZDWAz1oBUvIF6peVyEzPmU01tBGgu8YMSzsJ29XVbwc57i%2B1I3MwQ0c6ru7QmptVQ4OE5gaF8%2FHx9HrBBjsPnEeqFl0tdq7Rf6JVA1HI%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9ca31eef4ca41525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":758,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"b8ce11ed5e4dacd7c2f0b937396081d3","sha1":"ebf8c4150763db9ae75d6d6743e33833ae5f64db","sha256":"adef5e173d8306d39dffbc44339c3978a5111de7750ee1665ec0f6144634ca30","sha512":"17b867724944d48352dec525dee5abe3e890ba5b2af6a73d6e7c6d746e6851da36f78dea3103fc59ce042a0af04b9fb25104b3eca85727865b663dd55d744b0e","ssdeep":"","tlshash":"950115071c05c80aa7680bcbfcb0b81c2cc7ca4dc739aec06cce517b662879ad953d59","first_seen":"2026-02-07T12:46:36.792438Z","last_seen":"2026-02-07T13:09:47.225575Z","times_seen":2,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":63,"dns":38,"connect":1,"send":0,"wait":51,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/polyfills.b081674e8a00885f.js","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:17.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /polyfills.b081674e8a00885f.js HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Sat, 07 Feb 2026 13:09:17 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xfHh2EaoQqxvVQ0LfFl6VExcmmD9IVTzdq0wLmtb7Nf6Ji9oOMglfaH7K5wQbOmtx68OEd8zTVPRGUfNlp3NWRDpzBJF%2ByIBE%2FIUyQtYetQ9G0tBVaDpz4foezkT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"42827b7192cb7958ee0cc4a7f4e8a391\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ca31ef0cda55687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37080,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (37080), with no line terminators","md5":"ed39a0382d43bc7d94cbd468e350895e","sha1":"9c32b47cfe41c7cbc51452519e55869f0ba20e87","sha256":"8b7d5f2e51abd8129b641264cd8327d85cc2f78b60aa1b359cb68cc97642626f","sha512":"8ab3600b2e02af7417f1cbeb7be1fb0cf33c402ae90dd47649fcd0df06663280689aff4ce7108d6ca200d99ded42f9bfc748a0350df87fe313a1c0a012546fe2","ssdeep":"768:AbJ3ND3HzlwGskR5TNmgadspC2FNMIw/kFWOlhfFcCyme5LWxGuH4e38ecSeNMug:izlvs+vk7oKtSTnDH","tlshash":"c5f24ad57392b8b6cbfa05f5943b4407f63625a0b84c88d8f14c48ea2d7b10ad46bf2d","first_seen":"2023-03-09T05:47:46Z","last_seen":"2026-02-07T13:09:47.226975Z","times_seen":24,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/nano-s-B9bx24ZA.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/nano-s-B9bx24ZA.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 6197\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f70f006a656dc0e1ce84f61cb378786b\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MkSidhe10Cd29aleomHlBU1TBirtbaAjanuuqW8wo1KhQpwMSHVYd1VE4rFMKA5czWxu5J25bO0t4i1jejwGHgK5xhfv6PQpjU9z0ydcjcVBmXW66Ng7CGo8ej2e\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5ce035687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6197,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 109 x 536, 8-bit/color RGBA, non-interlaced","md5":"17684ea855891b06fd8cb1b293f536ec","sha1":"c5c0084552a389be3b2e22aa07e6cc108b175b7b","sha256":"24c82bb8e7e93cae864fec9f954be3fdd35edc19bd6b20bf0e398fa1e6d6dacf","sha512":"1a43d1242bcd43b7f5e2c4cce7e5efd3b5bf9554017e2ae595dec3293fb9735e0d93829e10532f041d88798413b7f4cae6044bff994e8a52397caa4da95be3f6","ssdeep":"96:IVxGA3PPHQfdKV3xr+xIXeg8LWZn40XUOKxQ/JwBJx51Y6zg/v6BCwegCb:PA3skh+muq5XsQ/SJx51Y6zUijE","tlshash":"5cd16c62f3df63564f34a073c9f130c156563e466ab6a7083311634c9112f8a1bdfca6","first_seen":"2023-11-09T06:59:04Z","last_seen":"2026-02-07T13:09:47.227906Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/assets/imageflexx.png","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /assets/imageflexx.png HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/select-device\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 1466383\r\ncf-cache-status: REVALIDATED\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"2794b72315d3f9097cca27ec25ade28d\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MSVleS%2FgLw24MzGQ%2F9XYlm5Af9Bn%2BLQd5Rpz36qzhZQFIbI0mMogMtMD8VJ4%2FHPvzELj6V81GJsW7CETaLsU%2Fz8RhA3jEIIyfT18Ncw2uOT8SIhUn2SGb%2BcpN4rNMf4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: 9ca31ef5de075687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1466383,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"0718ed5802001dbab109203882e18209","sha1":"d46478e24033767b4cd578584882d3ff9bb29476","sha256":"5248998846823fa744546e8d5f7b9dc06af9d738e42f10e82fc3620ee109be23","sha512":"6aeb4533f24b949ff5dfe9846cd097dfeb95ebbbc66303bd1ae224c2c46197ec94545ea9f55870088d88cac37b8f213cda08b4ed3ea77c5d4a96ab3924b60d8a","ssdeep":"24576:qextKYlyujyU0+OIhFBG0edCkwnx75ZF6:bxtzlFjzdhq1dBwnpTo","tlshash":"2f2533b21d819411c789f53d6cfbb96efc0470f222b3d8a7e9720d3b8a09eee2211055","first_seen":"2026-02-07T12:46:36.798465Z","last_seen":"2026-02-07T13:09:47.228796Z","times_seen":2,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":112,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/?format=json","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:15:50 GMT","end":"Wed, 01 Apr 2026 13:15:39 GMT"},"fingerprint":{"sha1":"E8:04:3F:4D:91:E2:52:D3:E0:EA:F7:1A:C8:8C:94:50:7C:2E:FF:FF","sha256":"A1:8E:F1:BF:52:25:E4:EE:2D:91:8B:1E:0B:E7:A1:C3:B9:7D:DF:7D:D1:57:11:6A:14:CF:F2:A6:DF:D1:B0:18"}}},"request":{"raw":"GET /?format=json HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nOrigin: https://onboarding.ledger-extension.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9ca31ef61ded5a0f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7d69c71af0f191e9a72db6153f8018d1","sha1":"f67c5f2887bc05654b47f76e9621e53a4091aed1","sha256":"5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65","sha512":"fdf43a8f3d843fe9008949d6709c8e2a5cd640f6101522319745f0a829f21dc8f4bd4d70ff3e2f6e1fd53ca0d2dd872bf3588c593a403071102ab28763cbdba5","ssdeep":"","tlshash":"b8700022000000208c80800eca0a032223a0000ac20a00088e800b2288a0b380282032","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-07T07:51:18.251001Z","times_seen":93313,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":29,"dns":3,"connect":1,"send":0,"wait":111,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/styles.6a4dd7d203fecf9c.css","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:17.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /styles.6a4dd7d203fecf9c.css HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncontent-type: text/css; charset=utf-8\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Sat, 07 Feb 2026 13:09:17 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iqNKERxRYQEzAKTESXSo90YU%2BqOziRcr5BCl0HNY9ED8MblnndRIemwpKem%2FjR6HFiVFTxNH8iTkMR%2FQnM5%2FrhN8a3Oh1FmHmXswHUiPtAIPnZU4GyTmAwZxnFdd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"3865fbac8b49e288b91e65b18ce05676\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ca31ef0dda75687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"773c178046d7bb0bd52a85ebc0ba8228","sha1":"8bbfc14e1d1c5104529778c79211aa7bd088ad1b","sha256":"9912f3fcfeb70843f5650c01ee842be124c70c6c68b3a40a21713b56f83bb317","sha512":"a3e85c3ea99193b1caa84bb00f463b01354b1918bbe1c1255f74b6aba91b1449e4ba1cd508099f1d4425d95470b76c90cb502312646814ffcc839e3c500acdfe","ssdeep":"","tlshash":"16a01205774982009340048a3003662e0c55040404843865380162e648956e75568342","first_seen":"2025-11-07T08:31:47.477962Z","last_seen":"2026-02-07T13:09:47.231081Z","times_seen":3,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onboarding.ledger-extension.xyz/favicon.ico","fqdn":"onboarding.ledger-extension.xyz","domain":"ledger-extension.xyz","tld":"xyz"},"ip":{"addr":"172.67.140.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onboarding.ledger-extension.xyz/","date":"2026-02-07T13:09:18.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onboarding.ledger-extension.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 06 Feb 2026 20:06:32 GMT","end":"Thu, 07 May 2026 21:06:22 GMT"},"fingerprint":{"sha1":"90:9E:02:49:31:50:C2:6A:EF:D2:B1:92:41:D9:5B:6F:95:3A:36:32","sha256":"7A:01:50:0D:51:55:44:C6:FE:74:F8:5E:08:89:58:7D:1A:0C:CB:A1:2B:58:2D:9A:EF:B3:F3:F2:56:98:53:F1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: onboarding.ledger-extension.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://onboarding.ledger-extension.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 4286\r\ncf-cache-status: REVALIDATED\r\ncontent-type: null\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"ee077ed83e0827280b9edc3e9b7ee136\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cr2U3UJrYdTS5VkhaczsdRoV3CsHH4MLzGTLueljr2A79eX195f5R04zTF6Fjh4n7hoEQHekJHwTW7H04M%2F6SlAzk%2FLk%2FPMyTHSXFJq2JboqsMajuIaZ%2BHq391lMzy0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 07 Feb 2026 13:09:18 GMT\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\ncf-ray: 9ca31ef58dfd5687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"aeb546d355d4564301a21d7e891ad464","sha1":"7850091b55a268df987b1cf525561ee3c9d9b9ae","sha256":"f49b091a0f6b85737bf7a576bc0588aab1d3250fcd54c649c9214fd54cb8bcf2","sha512":"963f813e2e0fb6f5e7a13465364a67106ce9f62a13c2cff15593885d1f8cc0754ad2da9e7cdcd27ea71d332eacead5b50ccb9383239af9c37bc6c7b9f2d9dc07","ssdeep":"24:suncDhM1+UxuDDYG477MUSzq5ZsbebYyyyyyyMyyyyy6OEiS7d:xnUHYGiIUmq5ObRyyyyyyMyyyyy6PR7d","tlshash":"7791335b73044b0bc87a937920c9ab90e3bfcc008727431b95c62f631e2a3459f54ae9","first_seen":"2025-11-07T08:31:47.481446Z","last_seen":"2026-02-07T22:40:40.779515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-07","alert":"Phishing Block","trigger":"onboarding.ledger-extension.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"onboarding.ledger-extension.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}