{"report_id":"96dbeb3d-704b-4455-ac43-0f52fdc09573","version":0,"status":"done","tags":[],"date":"2026-09-06T13:06:51Z","url":{"schema":"http","addr":"mtoken.click/download","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"mtoken.click/download/","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"title":"Download Ethereum \u0026 Bitcoin Wallet｜imToken","dom":{"size":12543,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12453), with no line terminators","md5":"cc1d90f0413543f5237b85618075babc","sha1":"0fb96508085d926c1466d84fa757e6526e769e8f","sha256":"7b6c864bea0d56944ca15080b1dfb1c0f3e8fa6d6fe3527083524a3035da35ea","sha512":"970d4a49f59259b46a77d68e51880630107e4fe4757ff73575866254824c3fdc60e0a521e8b818a25d7b7ad55266dbaacbcf3a83930a2e6f41a56b28efb81996","ssdeep":"192:HuHr8peDedib/XatgOwfjJd5xAaMYVFq6fpJd+VaP:HSedib/f9d5xBMYVFx5+VaP","tlshash":"30423f27ec09d91741629cc9e0b7a77d95d6823eca72dc5881fc83caa7c0ed98f52846","dom_hash":"domhashc1b42832d498dc08cc9aa80bb502be85","first_seen":"2026-09-06T13:07:13.071399Z","last_seen":"2026-09-06T13:07:13.071399Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mtoken.click/download","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-11T13:06:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mtoken.click","ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-05T20:13:48.569075Z","last_seen":"2026-09-05T20:13:48.569075Z","alert_count":265,"request_count":53,"received_data":2448371,"sent_data":26705,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]},{"name":"scrollreveal","description":"","website":"https://scrollrevealjs.org","common_platform_enumeration":"","icon":"scrollreveal.svg","categories":["JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544_CSS.ff5578978733a40a67a3.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b54e11e9a03640be21a29dcee2e7436c","sha1":"49e578b58377bbe697aefa5ee7b278cde8beafd7","sha256":"a324955b6aaeec85e72d8160f86a6f1cbbafe0eb3ac848ca832b8ad2f158f3d6","sha512":"932e86a4440fb2efd0754b82e870eb4bd62b8fb4b79e71041ae3335a2ddeb7eb234117a75a96664128dafce247d8b7164993c18af287cfecbd6972f459596a65","ssdeep":"","tlshash":"f9a0026710117c9aa8fc024827a3a7b03858401c1f00cdf81b159071b071d0faaa01c7","size":69,"data":"","first_seen":"2023-03-07T15:16:04Z","last_seen":"2026-09-14T19:37:02.685686Z","times_seen":372,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/styles.8644ff0f5a975963f94d.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"de9d77950776a69ffa50f7234df7190c","sha1":"483ede0c4f7ab5df20cbd9ff21e83feb7ee4be5e","sha256":"60a1d40c6f02c26f052e84e5e2992893a59d08fa2d3d4eb486cd518711828d0b","sha512":"32ae10a4e27c502c1d1ddde36638a1b1c8a3945485bca60d892d912b04fe7d3ddca07fba3fed7018053ba2aea01396230b9c723294e14bd1e40e8b08bdef9f91","ssdeep":"","tlshash":"2cd0420839a03577a5e621e4215b31d81ca6121e36fcfc9817f4c19adb3278e145398e","size":256,"data":"","first_seen":"2024-08-22T11:11:23Z","last_seen":"2026-09-14T19:37:02.677977Z","times_seen":273,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/YOz1gQVypx2fvdmmbu1RN/_buildManifest.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c8a8b0f0b27c4d042081326b8459750","sha1":"01852002dd199069ac3fcac3c1f9f88a3eb2ad9a","sha256":"c78b42b5ba39311ed2c9a39b7a0ec73285e4b97853a2e491a4394a4a25728db0","sha512":"f54c153e1b03bd818ff9d4fa7ded49b9e25dd5b6ab6511c6918cc1a4f6742c752b5bc3b6480838122b988aa3bef4858fccd1e0d9bc7bd6305528afbe7525c079","ssdeep":"48:JrI7rapUm3hgnD0gj8EVL+o8camiFxeGVzmT+2ujpA6ZKSsjf9md:dYGpB349xVLxr2FMCLOmKSs0d","tlshash":"f081ac421d33bf452ed3fc496cbdaf3d45d015b1e9fa06a382ad482ec9804349f79695","size":4156,"data":"","first_seen":"2024-09-24T14:50:12Z","last_seen":"2026-09-14T19:36:45.60673Z","times_seen":260,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/YOz1gQVypx2fvdmmbu1RN/_ssgManifest.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"abee47769bf307639ace4945f9cfd4ff","sha1":"c0a0dc51ee8a2852baf5ff30c33b1478ff302585","sha256":"653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479","sha512":"2b074799106698df69a28fcd8255c3cfd1ccf40fd4c1bf5d463c42e63b32856f801e066706fbd960a0da4ebe645c070c398dcf01bd722dc4fa592266361ae81a","ssdeep":"","tlshash":"d4a001a0903cdc60aa63dd1c126013168fa05062651d28938afd2054c0341410300d50","size":76,"data":"","first_seen":"2023-03-07T01:03:45Z","last_seen":"2026-09-15T00:01:22.417973Z","times_seen":17986,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/24d5c77af3764ba53b59e4eb9084ad0db77fa666.b68303f7b559851a7150.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d94b2b2e4ceb3a8d3ffc54c28cca396f","sha1":"ce358f05fafd16a6131bdeed8419d087fe74d8a7","sha256":"641584ae9a8a6f63cc13b74de0502adf40d06224b8e44717c0c16716e6dfe1b9","sha512":"c69eb7c93e139050fa407943ec6811e94dda5a3c5d3c44a0d90999690f275f180f19cbfadf28c294bc251e65f5d3988d0d7d4039cddc7153d294c076561b3a26","ssdeep":"768:TlfughpHOCJlIx4/TTdCR1/f28NnOkJlIx4qfCxelhUtCe:ZdpuDyT0Xf49W6hg","tlshash":"6103939cb1d3f06643d22264802f210af27e5959b44ec485f729ecd2b97894fa237f79","size":38861,"data":"","first_seen":"2024-08-22T11:11:22Z","last_seen":"2026-09-14T19:37:02.679614Z","times_seen":268,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-09-14T23:37:41.050281Z","times_seen":128100,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/39b70e0b8818b2ed38d7d3012b8680c74b29b775.4c728255a8c13b372e67.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3671c7c9f419eb8ae66b0278e5875025","sha1":"cfce1cd0af151b59e103f30ef4c9559762a31a66","sha256":"6e49887c6a270ff031878e05ddcad3e23761a00d16687c40479623b363fe7883","sha512":"8d3dc94cc246502d115a8ea4a286dd07acfc31e9749c6de5141becf5d5b4e6117ece10c9d578dadf2be8766b2066d1bf0e498359a570632af82d966f36760960","ssdeep":"3072:SAjJvvYt0QXos88JJS06/65PrI50/eEFUR5vBLeL6KJKPHZXXbse47xZ8BIUJQnR:t5Yeg+k/eFg4RXQnMh/8L/U0d4ASnQ","tlshash":"5a34a60fd7355eb7086b51cd1dd96ffce8d2030641c8d87ac7ea55891b4c9beaa23a02","size":252443,"data":"","first_seen":"2025-08-30T07:44:58.098816Z","last_seen":"2026-09-14T19:36:45.622124Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/main-8151490efdf97440a17a.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b970ae78f33918cbef06cb859959bb9b","sha1":"9bb0949dfbdd7fa03f28fbfe1e9248a446c97c35","sha256":"126339554462e3a26bf9ebff853b05a396cca65a18d38888ebb629b755d1e281","sha512":"ac268198d7bbdd0c6ce569f005c93d5b2a6c1b10d9a7acb40bdaa8d2bbf81273b9be3297c2aac2c09051d016449720b79db8f94d9ae1f5967b3e58d0fb633f04","ssdeep":"384:X+laOqpTcr+3u+NtL+JyIKuWLnr+tCTruuL+vIQY6bMyld6SnhF/AT:ulMpIr+3ugtL+JVWL+CTrZ+pld64FYT","tlshash":"5cd2c8ddb6c6f02203d33134903f610bb37b2958a84d8454a759e9e67c7a94ea227f7c","size":28565,"data":"","first_seen":"2024-08-22T17:17:34.030065Z","last_seen":"2026-09-14T19:37:02.67741Z","times_seen":250,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/2ba9cc99e00816a1bd4c69c8eee2c1ab9d576565.56d59fd5717767992ec5.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"38c83f594ebc02b1eed76fd2f8e8eb6a","sha1":"4db6d88c8dcfee76d057bd44d2dafea77e1b8388","sha256":"bc8ebfd8a0dabfceeb6ee2255ce97d493988efafecb1211b34165a46d433e39f","sha512":"f493be4a7f1f9496bcf25d67587a29e53f3a83b90728b05b2b4a9a8b8acaa16873ee218a448278dc1a66222f7506256977f971376701286bd7ecd5c7f468eeab","ssdeep":"384:SqVx43DKuN95+ROmm3jbAAdTRbgT4NaYvw4n+6HHHHsglu8Rx1:vWZaj4nvHPT","tlshash":"4aa209d5f36091b2106a68d5681f204ba1b574176c19c1d4bf31c4e3edb4feaa47af34","size":21661,"data":"","first_seen":"2025-07-18T14:07:19.206042Z","last_seen":"2026-09-13T08:11:57.164094Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544.724b3e4d54c037e5a62b.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d3fc7fd99e1d4459a40e10694e15e6a","sha1":"c092d8c3f9cd79bf630519bc00557a8705363886","sha256":"27735c6194ccdf74f77e3ec21dbe8d5c7e171061513b078edd88921d82d59ed7","sha512":"f5792a07b494348eda75c2ecb41ab293be281ef0752eb218fc75d5722221dd70d60e45883240871d510ef67025f5c4abade098f6db5ca9fcdccdf0a45ee341ba","ssdeep":"12288:isJ1xoG0KTfTCZDzZiRxMXK5jnhFcLSUa:isJ1xoG0yfTCZDzZiRxMXK5jnhFcLSUa","tlshash":"1ed43c4abae260309167b1bd4b6fa405b134841f0d99fd043e8c92a99f1c43da7b6fdd","size":647753,"data":"","first_seen":"2026-03-31T14:52:48.778611Z","last_seen":"2026-09-14T19:36:45.654419Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/aec7d165.15f05aecd792e476c6d7.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"87176dcffa419147a6f9c4e1ba9a72e6","sha1":"59835a44be3f43788c2662906fda25ad8505f299","sha256":"81d1c0630f70d1831ac13e2e4f212b532052be907ceded265f49bb8ae934a54d","sha512":"26890c42b28d16e4d7690d68c203ee438c0f7ab487d5e40c2a798a5b2a84c5f6f754cc22a4e9c7121a6e4c8b08969fbe3faa7798a35ea1c0acbec960a3f3535f","ssdeep":"3072:9OPs5At4sA10x5rTzcck1I2cbwHYS8cbRmMrye3LgbxKGyJHgJxmjwKeYHAXAOhe:9OHjUHYeHJw9XZG3XqDUFmkMtEFcA","tlshash":"feb46628c51482bc9dba5ba88d325075a65e91ff71e14325e36eccb073610dcf7aacc9","size":494383,"data":"","first_seen":"2024-03-29T05:20:17Z","last_seen":"2026-09-14T19:37:02.684463Z","times_seen":308,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/pages/_app-ed560fec44d29c99d1af.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6d64273a1db46e38f54989e3c9bcf7de","sha1":"0b3557f37d77a4b2bebf2768e705fe8f98c852ae","sha256":"56d7cda8e785c97251fbc282b63646253a91a0238fe2127d28ec0f759ad518c0","sha512":"0e4c75809281ffbd0669238f3b5c47bccc56d69c17e546ec33b8ade182d75b47a05ea43bf29c920787713b3614a03fcedc6f557d2149846930928e16c2282a0c","ssdeep":"192:Rd7N1IZN0MQaZwCplOb3asz95NSXuxopz:RxYZeauCyb3ashSXuxez","tlshash":"510283897191f09517fb91f2503f510eb3f2692da499d4806762c4f89efa9ae4323f1c","size":8369,"data":"","first_seen":"2024-08-22T11:11:23Z","last_seen":"2026-09-14T19:36:45.653287Z","times_seen":270,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/pages/download-8d070118fe18b9547f73.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0a966bf51803b1a653870fe382301a15","sha1":"979063e02dd48eefa2e6423ef310a677128863d2","sha256":"d1a870f2ad9e2a6897ba3bfb6ada8ec1e5ec8c33dc65ea55015aee6f313dcc90","sha512":"f71626c11b8ccc74d5919d503cb64ad4625938dd26096bca915bc6c85f1bee81f6b339a54e03d3424626e9061a72c4a8a73288a39bf983ac39adfa8c7b904927","ssdeep":"192:RNvvDtQUYZcvCElGx6SDXdev4kQibtZVxb9oG:RNvL6UYCqE9STdevSk","tlshash":"8a82bb1ee0a1546a80b7b1bc0e6f2065a531018f8e68bc287ffcd1ccaf2d56d857579e","size":18602,"data":"","first_seen":"2026-04-01T03:52:04.083837Z","last_seen":"2026-09-13T08:11:57.164551Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/framework.a0cc4416b9424a5588b2.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f52502ac9007133582fe44e8c7b70136","sha1":"6f017871e79d3b5e08aab7db5080e287fc2212c5","sha256":"275ca0ad51cab700a7c66736740557494b815a03fc464577b9c0fdfaf9c41441","sha512":"cec19cb62a3e74b2d9be8d0049597049d6b0d53754c2d6f24d5d422b59a16998fbb33ecfd5cfe53af0f1437f98056517e44e2a16adae3e1865a1fab6609d01ff","ssdeep":"1536:U4v3hV6X5JRGNeG4XFmkXdKwDSuSdDp7FktuGhR8XvCi0AHlk:nfhV6TZ1YwKt7gRwCi0AHlk","tlshash":"e7c3f8d93992f5626bf311b7109f1813733d161b280c4960a212fddeb9bd05ea12bf9e","size":129218,"data":"","first_seen":"2023-09-20T16:39:30Z","last_seen":"2026-09-14T19:37:02.68878Z","times_seen":333,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/scrollreveal.min.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"126cb7c432914f6c726ff146110dcb75","sha1":"e5358bdb7769288dc7c2dc10508e98387e85b6e2","sha256":"fd08659fe0f20fd14dcf4c3c5acdde64de96028174f59b0b3dc776b62be789b9","sha512":"005fd83d6e18b49ad8bc8e46c853e03eb34808c7913aa6df836e6f57a4f41a1256c901b78697c85e6001ddc6c5870dc46f1f3cb500fe74fe69f9ddddc980e4ae","ssdeep":"192:zjBEC60RtRcCT+Ytnvm1uvb/E3aQ6ZvxrTZ6fNrb:zNE312Ntnvm1MbEIZvZTZ6fNrb","tlshash":"cd12d68f3e1274339b5349d5e2df064f773849da2a0b9484b2b4d0bab8b101d6243f6d","size":9095,"data":"","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-09-14T19:37:02.694916Z","times_seen":1627,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/common.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f82ea3f9225dd45fec3eebd6e63c954c","sha1":"2d6886dbbb8be31c4b2e4da073ce5230a6bfeb2a","sha256":"59e2227be4a47a7fb1d43287da5e2df66f60a6dd98e606b7ec6995c46a14126a","sha512":"0d22f8b10915b50abc1e4ea28be4765384afa8f08fd08b1a87af2072ed2933b311d5da5fc1176c6cfdaa4a3895084d7093e6c1838ead3e709cf93917d43cdec1","ssdeep":"","tlshash":"f451118e72c9b5b766eb1dbd11af379c793a118bd80c8011647ac8d95a701858033eef","size":2743,"data":"","first_seen":"2023-03-13T01:47:10Z","last_seen":"2026-09-14T19:37:02.686233Z","times_seen":850,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/webpack-22eaaa575d3c455933b4.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2019297a9ccffe0e261600bad1b1f98a","sha1":"a7af96e8e11cadb4f053e78cc91cd7c531f1e877","sha256":"75fa1c4760ad6194a99710872e3612002c84c4df8339a57be0cb4aad1bde794a","sha512":"931b78e601e346f1ae773b8321cdf332b8dcc1fc2345d76f2a187c4c331f30c9f328ef72435b7302293d28b5ab1742685e5d89ce174c0af9c73ede3a9afff1a4","ssdeep":"","tlshash":"193131d536a4fcac53821d5d083f7006f2291d65127cf5c19384e8b2bc6488e9166eaa","size":1539,"data":"","first_seen":"2023-03-07T12:08:00Z","last_seen":"2026-09-14T19:36:45.658111Z","times_seen":489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/commons.3563e86951c42a3cedc3.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8cfea2bb1577c5e0c431cc92cef9e0b","sha1":"cba31c9e3d0b79ec958595668cad4ce3c18339a1","sha256":"17d84657d02e74b9bc1f511e05473159531d2c86ff8de697e614986fc6ed3f4b","sha512":"e3b04deea299fb26fe1f025d73751bb94f5949905c2fc0befa2b0395240c18672e1810f70fb83b545218b9d9637c4bd1e469ec46b2f1f6feed6261dad958f6b6","ssdeep":"384:2EXRdmhT+b3C8zlDqUfLIJ0X4auaHKdxrQG21561sO2oXD9zs:9hdmhT+b3Rzlhi0oauaHUQj561Zps","tlshash":"26725ecab1c7b1255793f1b4002f160af62f98a9384f89a9e565d5c2bc7884dc037fb8","size":16971,"data":"","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-09-14T19:37:02.693292Z","times_seen":288,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/25f40c5d4ffc684edbd48828208d18e8523ffbe7.f6c9f91a53b30106312b.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"421d04a7ec3240edac3886632291b8a5","sha1":"2496f8a487537a6050fc87dd638f5f8a32a88cbb","sha256":"a7fa1ce27c749255d7f2ca802d68f2b5c084f99def6e2bc0f0a3288570e1dc0f","sha512":"733b38f17bcad00ca6e203b5000a430d1d9d923b65f11c6134402174749a9d4ae450fd2cc8849f1d1227ef33fbadf42defffa6a905541a65606d258fdd113b99","ssdeep":"192:JAev04mCpPJb8GkNz8OjgD2h5OCaqNRq7lftqn44W1sLdry1vK9yHEdBO:9WCALOlBJlIxWEry1vfZ","tlshash":"1a72628db1d2f06443a76270902f110af2ba2a69f54dd0c4e729d4e1acb498e9237f7d","size":16901,"data":"","first_seen":"2024-12-16T04:06:20.147627Z","last_seen":"2026-09-14T04:54:28.408566Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/29107295.6d4b8f5c00e5492aea21.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d8225dc49f0ef650c322d2a4964177e","sha1":"8704bb7a8a5cd075068c6d79e7d4b6c9aa08645c","sha256":"03babc01567b1d9af291b4de0a070ef189685c333c948136a31aa08e7ed51a5a","sha512":"5dc846622a7be3961ea31724b6ad89aec34a0f9935b8ac89e5dbc15b70ae4255956e0fa4ad412dcaf1edc0ee025572ef596cfddaa0e6bc3f448fc79942d72078","ssdeep":"1536:xhdVA1ObQbCbmExG502EoIWYwICTJSIHg:z7/mE8502EPWYwICT/A","tlshash":"b3734ec83ec2f016576760b1007f048bf13eaeb269ad9554d0a1e4ec7cb851ee6b7e18","size":73852,"data":"","first_seen":"2023-03-13T01:47:10Z","last_seen":"2026-09-14T19:37:02.686699Z","times_seen":867,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/baiduPush.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6bb24a2906b2b7777cf01e648727281a","sha1":"3ec92d0ae833464e696a1f2916857f6c05c81e47","sha256":"5462c841c26c4bc11177c959d92befdd7f9d7c02de5a2bb6d49b33f92189d03c","sha512":"098ea8e99c1dc303ce1d4c1193fff8a05a7bf1816825c439e1060e70eba3abdbd07963b12d951cae7418a80694ece565ef01224cabf2417319bf1943538050f9","ssdeep":"","tlshash":"44c0126d79558534374404bad57bda5df052303855699413c84edc453424dd74419a59","size":190,"data":"","first_seen":"2023-06-26T14:35:54Z","last_seen":"2026-09-14T19:37:02.687228Z","times_seen":241,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/analysis.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"97330450853d21edf4badf5b384ca25b","sha1":"bd48c020be1b41d9386cd30d10c8a81bb27a8a97","sha256":"96e39b302859f25ccc60a28271e00c51a73c4d8f7ae40b93c61320f17097df7b","sha512":"3283e67ca75264203c67053a049a0345185df2a96de8a68892d9d8f497da9e6a99d80fb275b1f254b425383c3fee40659ada7df0b263377a2d322290e3ede5b0","ssdeep":"","tlshash":"f021118e35591a747fda1bef2377d71c702360187920ea1246dfccc8602aed250276cd","size":1202,"data":"","first_seen":"2025-08-30T07:44:58.125982Z","last_seen":"2026-09-14T19:37:02.687708Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/help-zh.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"540bdce1a4de261ab7a227bb501ca319","sha1":"900ababb41b2dbf10245edfa16f495c355b3e425","sha256":"243fc598e4b794f61da4a8cead8f39d876148d347c11545cce724d385f5243f9","sha512":"0b5878027aeea7d9f7f58ea8937435b0288e67645469abfd522026a880458de3820c21017356d317aeef6ea264e383ab1e198556d9b3c9270f9e7cf9146a82ec","ssdeep":"","tlshash":"04f0ddfd7906b824877391e5a3afdb0c76d76201a98548c2d58bccc0b43cd5b050fa49","size":647,"data":"","first_seen":"2024-01-26T16:54:53Z","last_seen":"2026-09-14T19:37:02.682867Z","times_seen":255,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/styles.48026100.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.154Z","timestamp":1788699980154,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/styles.48026100.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-8359\"\r\nexpires: Mon, 07 Sep 2026 01:06:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33625,"size_decoded":5691,"mime_type":"text/css","magic":"ASCII text, with very long lines (33622), with no line terminators","md5":"c3b74c24f927e1a7b5f342f6ec6de76f","sha1":"f48eb2288490f9b863bef1ff0b4d98d8c3ba4926","sha256":"7453420a8c98ed97f5ca254057b2f275e10307581b741c53552045e8f9952c07","sha512":"78c4ca5ddeef22ae62cbd4fdbcc01106902611630a47775d801674c7af43f6d210ea994c6f20c02b982589374ff09db65ddfe83f99fdfa97cfef577cf37a8451","ssdeep":"384:oyJX0/4RYtTelIoWDv8Pb58QvymoCSkXhgNvCcRwzT1htmhCW5JX7yW0NMGvpryd:oqWzMPW07pryd","tlshash":"54e287012fd4303f6a5705e6b6457b4c772f6647433b94a8b3b2e211cbe817b062669f","first_seen":"2025-10-30T01:19:28.239892Z","last_seen":"2026-09-14T19:37:02.680669Z","times_seen":38,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/19f24c842955fbbab397f79015225d5d350aa544_CSS.2640c564.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.194Z","timestamp":1788699978194,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/19f24c842955fbbab397f79015225d5d350aa544_CSS.2640c564.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-3aea8\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":241320,"size_decoded":32089,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"1cbadc929fdbf62a67d75dbc75758a2e","sha1":"3871a21aad35918097020e5d44a02fb3afb9c181","sha256":"509c2d2341380abc5c6189d6efc50f605aae70bfc8cb7eecdb05d5b4815b6c63","sha512":"65d4a4982e19c65b001d00f83d791182b339da663b18621886a38296219b2f9ee433510e2e7814f52b05b7b9307894459aabf98cfec7b209d1cdcc7883842a31","ssdeep":"1536:gBzfkfXfkfuf+fyf+f80vaYGOxTOR9EOXor12HF:0fkfXfkfuf+fyf+fxvLdiEOXR","tlshash":"7234b99165d1312cba6fc727b6e49889a7204523d36f9dfea131329dcf85287239370e","first_seen":"2025-10-30T01:19:28.216508Z","last_seen":"2026-09-14T19:37:02.688232Z","times_seen":38,"resource_available":false,"data":null}},"time_used":719,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":719,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/styles.48026100.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.196Z","timestamp":1788699978196,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/styles.48026100.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-8359\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33625,"size_decoded":5691,"mime_type":"text/css","magic":"ASCII text, with very long lines (33622), with no line terminators","md5":"c3b74c24f927e1a7b5f342f6ec6de76f","sha1":"f48eb2288490f9b863bef1ff0b4d98d8c3ba4926","sha256":"7453420a8c98ed97f5ca254057b2f275e10307581b741c53552045e8f9952c07","sha512":"78c4ca5ddeef22ae62cbd4fdbcc01106902611630a47775d801674c7af43f6d210ea994c6f20c02b982589374ff09db65ddfe83f99fdfa97cfef577cf37a8451","ssdeep":"384:oyJX0/4RYtTelIoWDv8Pb58QvymoCSkXhgNvCcRwzT1htmhCW5JX7yW0NMGvpryd:oqWzMPW07pryd","tlshash":"54e287012fd4303f6a5705e6b6457b4c772f6647433b94a8b3b2e211cbe817b062669f","first_seen":"2025-10-30T01:19:28.239892Z","last_seen":"2026-09-14T19:37:02.680669Z","times_seen":38,"resource_available":false,"data":null}},"time_used":685,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":685,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/wallet.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.271Z","timestamp":1788699978271,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/wallet.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 757\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-2f5\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":757,"size_decoded":1029,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6915c49cca71038b14b965419caa13fb","sha1":"b725c16bca9bd7eb0467133e71e5486d90038f15","sha256":"5673afdd5a58ebd58ecc915b793502cbb417f308fd00dddd107c117e010bab4f","sha512":"f6111148dd2a57e66d5df3f53bb8863817ec2c71d6e4bc811404f3bdae15062154873d7e7e58c97a5c550b69e233ae41acb61bcb5ab7056e567851383704904f","ssdeep":"","tlshash":"6501155563e869bc74314634d79e3335427f24c63522482789b21c79856995d6c3f5f0","first_seen":"2024-02-20T02:17:37Z","last_seen":"2026-09-13T17:06:14.071758Z","times_seen":236,"resource_available":false,"data":null}},"time_used":1404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1147,"receive":257,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/footer/to-top.png","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.273Z","timestamp":1788699978273,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/footer/to-top.png HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-2084\"\r\nexpires: Tue, 06 Oct 2026 13:06:18 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8324,"size_decoded":8694,"mime_type":"image/png","magic":"PNG image data, 124 x 131, 8-bit/color RGBA, non-interlaced","md5":"13eac2560b1b5d187f0632729627c7eb","sha1":"9d767610734797f5f8dd98c82329d072171b67f8","sha256":"64774fdbbbc520f5748ccf6f48ede71a843d30cb3ce4bbc8da64c7f64d95b3ed","sha512":"ac2f7c596a78b4554e146dcf757f23248f8895189ead847dac8884b4e9b2f02cb3812d03fa4c7821e9073042768b06dd567b6ea078f069b1c2853b04473e2bc4","ssdeep":"192:n64wmsnaCQVU/kld8QRX3ok8arbdUK+H4sWt:nLOaNVU/kVz6K+H4si","tlshash":"7502b08242c004a419cf4da444fbef8c9ff73970caaac5693e7c14c6bf2a6991a4f520","first_seen":"2023-06-10T15:14:48Z","last_seen":"2026-09-14T19:37:02.689888Z","times_seen":337,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/YOz1gQVypx2fvdmmbu1RN/_buildManifest.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.445Z","timestamp":1788699979445,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/YOz1gQVypx2fvdmmbu1RN/_buildManifest.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-103f\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4159,"size_decoded":1678,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4156), with no line terminators","md5":"1c8a8b0f0b27c4d042081326b8459750","sha1":"01852002dd199069ac3fcac3c1f9f88a3eb2ad9a","sha256":"c78b42b5ba39311ed2c9a39b7a0ec73285e4b97853a2e491a4394a4a25728db0","sha512":"f54c153e1b03bd818ff9d4fa7ded49b9e25dd5b6ab6511c6918cc1a4f6742c752b5bc3b6480838122b988aa3bef4858fccd1e0d9bc7bd6305528afbe7525c079","ssdeep":"48:JrI7rapUm3hgnD0gj8EVL+o8camiFxeGVzmT+2ujpA6ZKSsjf9md:dYGpB349xVLxr2FMCLOmKSs0d","tlshash":"f081ac421d33bf452ed3fc496cbdaf3d45d015b1e9fa06a382ad482ec9804349f79695","first_seen":"2024-09-24T14:50:12Z","last_seen":"2026-09-14T19:36:45.60673Z","times_seen":260,"resource_available":true,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/img/favicon-16x16.png","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.742Z","timestamp":1788699980742,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/img/favicon-16x16.png HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 564\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-234\"\r\nexpires: Tue, 06 Oct 2026 13:06:20 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":564,"size_decoded":904,"mime_type":"image/png","magic":"PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced","md5":"a9e72fde9756f0477fbdfce7b2725020","sha1":"cb8208cd7824a287db8d97e8750cd0b0c7b9704c","sha256":"d292c48434ad9c30f4220e220c5cb53f8221acdf0e93e59de5659f7b4e735af6","sha512":"507bfabd7f58d15d72b68a73565f019da129aa5f2d6e4ddd650dc41401bf844ac6ba402dfe020c5e60ba3174ab1c5a676149434a49d481d4b5798225c831e9b6","ssdeep":"","tlshash":"cdf096cae6286d7a2758900a69360770fc370b9344c151be01e43321f53ac316a8b8bc","first_seen":"2024-04-19T06:46:35Z","last_seen":"2026-09-14T19:36:45.620295Z","times_seen":877,"resource_available":false,"data":null}},"time_used":482,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/orbit/token-im/stick-note-en.json?q=1788699980913","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.927Z","timestamp":1788699980927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /orbit/token-im/stick-note-en.json?q=1788699980913 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: locale=zh-CN\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/orbit/token-im/checksums.json?q=1788699980914","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.928Z","timestamp":1788699980928,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /orbit/token-im/checksums.json?q=1788699980914 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: locale=zh-CN\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":483,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/styles/swiper.min.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.193Z","timestamp":1788699978193,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/styles/swiper.min.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-4d42\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19778,"size_decoded":3446,"mime_type":"text/css","magic":"ASCII text, with very long lines (19513)","md5":"13e3477e9b99b8653e80def106e569e7","sha1":"34a50a5848aea3d3b6345a2a29fea97d0b48e8c4","sha256":"cbd3907ccf320bf09a971e16978df6d2293228febdbcffd158ce25011a6d68a1","sha512":"54776d5f9ef56af29d4deeef3884c7385bdc0419698694a6c63481b53e17fd4af3c8ba89d95284944b23778cf66810b0ec705e9b757e7c798da15e7957398bcf","ssdeep":"192:dWaNv/lSSyJWCh8zfi5o/mXDN3eBxwdJ5c:dWa1/lS0Cifi5o/mXOGJ5c","tlshash":"5592612c17003057e6334f1a87d99778c724c9939e4358ef6250ee48c7bb96a32af766","first_seen":"2023-04-06T20:39:57Z","last_seen":"2026-09-14T19:37:02.67449Z","times_seen":1737,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":469,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/19f24c842955fbbab397f79015225d5d350aa544_CSS.2640c564.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.153Z","timestamp":1788699980153,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/19f24c842955fbbab397f79015225d5d350aa544_CSS.2640c564.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-3aea8\"\r\nexpires: Mon, 07 Sep 2026 01:06:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":241320,"size_decoded":32089,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"1cbadc929fdbf62a67d75dbc75758a2e","sha1":"3871a21aad35918097020e5d44a02fb3afb9c181","sha256":"509c2d2341380abc5c6189d6efc50f605aae70bfc8cb7eecdb05d5b4815b6c63","sha512":"65d4a4982e19c65b001d00f83d791182b339da663b18621886a38296219b2f9ee433510e2e7814f52b05b7b9307894459aabf98cfec7b209d1cdcc7883842a31","ssdeep":"1536:gBzfkfXfkfuf+fyf+f80vaYGOxTOR9EOXor12HF:0fkfXfkfuf+fyf+fxvLdiEOXR","tlshash":"7234b99165d1312cba6fc727b6e49889a7204523d36f9dfea131329dcf85287239370e","first_seen":"2025-10-30T01:19:28.216508Z","last_seen":"2026-09-14T19:37:02.688232Z","times_seen":38,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T13:06:16.377Z","timestamp":1788699976377,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Sun, 06 Sep 2026 13:06:17 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nlocation: http://mtoken.click/download/\r\nstrict-transport-security: max-age=31536000\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-14T23:51:34.565493Z","times_seen":18467719,"resource_available":true,"data":null}},"time_used":1157,"timings":{"blocked":0,"dns":179,"connect":252,"send":0,"wait":468,"receive":0,"ssl":259},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/commons.3563e86951c42a3cedc3.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.236Z","timestamp":1788699978236,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/commons.3563e86951c42a3cedc3.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-424e\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16974,"size_decoded":6436,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16971), with no line terminators","md5":"b8cfea2bb1577c5e0c431cc92cef9e0b","sha1":"cba31c9e3d0b79ec958595668cad4ce3c18339a1","sha256":"17d84657d02e74b9bc1f511e05473159531d2c86ff8de697e614986fc6ed3f4b","sha512":"e3b04deea299fb26fe1f025d73751bb94f5949905c2fc0befa2b0395240c18672e1810f70fb83b545218b9d9637c4bd1e469ec46b2f1f6feed6261dad958f6b6","ssdeep":"384:2EXRdmhT+b3C8zlDqUfLIJ0X4auaHKdxrQG21561sO2oXD9zs:9hdmhT+b3Rzlhi0oauaHUQj561Zps","tlshash":"26725ecab1c7b1255793f1b4002f160af62f98a9384f89a9e565d5c2bc7884dc037fb8","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-09-14T19:37:02.693292Z","times_seen":288,"resource_available":true,"data":null}},"time_used":930,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":930,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/24d5c77af3764ba53b59e4eb9084ad0db77fa666.b68303f7b559851a7150.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.239Z","timestamp":1788699978239,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/24d5c77af3764ba53b59e4eb9084ad0db77fa666.b68303f7b559851a7150.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-97d0\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38864,"size_decoded":11487,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (38861), with no line terminators","md5":"d94b2b2e4ceb3a8d3ffc54c28cca396f","sha1":"ce358f05fafd16a6131bdeed8419d087fe74d8a7","sha256":"641584ae9a8a6f63cc13b74de0502adf40d06224b8e44717c0c16716e6dfe1b9","sha512":"c69eb7c93e139050fa407943ec6811e94dda5a3c5d3c44a0d90999690f275f180f19cbfadf28c294bc251e65f5d3988d0d7d4039cddc7153d294c076561b3a26","ssdeep":"768:TlfughpHOCJlIx4/TTdCR1/f28NnOkJlIx4qfCxelhUtCe:ZdpuDyT0Xf49W6hg","tlshash":"6103939cb1d3f06643d22264802f210af27e5959b44ec485f729ecd2b97894fa237f79","first_seen":"2024-08-22T11:11:22Z","last_seen":"2026-09-14T19:37:02.679614Z","times_seen":268,"resource_available":true,"data":null}},"time_used":895,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":895,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/pages/_app-ed560fec44d29c99d1af.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.240Z","timestamp":1788699978240,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/pages/_app-ed560fec44d29c99d1af.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-20b4\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8372,"size_decoded":3429,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8369), with no line terminators","md5":"6d64273a1db46e38f54989e3c9bcf7de","sha1":"0b3557f37d77a4b2bebf2768e705fe8f98c852ae","sha256":"56d7cda8e785c97251fbc282b63646253a91a0238fe2127d28ec0f759ad518c0","sha512":"0e4c75809281ffbd0669238f3b5c47bccc56d69c17e546ec33b8ade182d75b47a05ea43bf29c920787713b3614a03fcedc6f557d2149846930928e16c2282a0c","ssdeep":"192:Rd7N1IZN0MQaZwCplOb3asz95NSXuxopz:RxYZeauCyb3ashSXuxez","tlshash":"510283897191f09517fb91f2503f510eb3f2692da499d4806762c4f89efa9ae4323f1c","first_seen":"2024-08-22T11:11:23Z","last_seen":"2026-09-14T19:36:45.653287Z","times_seen":270,"resource_available":true,"data":null}},"time_used":674,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":674,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/25f40c5d4ffc684edbd48828208d18e8523ffbe7.f6c9f91a53b30106312b.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.245Z","timestamp":1788699978245,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/25f40c5d4ffc684edbd48828208d18e8523ffbe7.f6c9f91a53b30106312b.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-4208\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16904,"size_decoded":6096,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16901), with no line terminators","md5":"421d04a7ec3240edac3886632291b8a5","sha1":"2496f8a487537a6050fc87dd638f5f8a32a88cbb","sha256":"a7fa1ce27c749255d7f2ca802d68f2b5c084f99def6e2bc0f0a3288570e1dc0f","sha512":"733b38f17bcad00ca6e203b5000a430d1d9d923b65f11c6134402174749a9d4ae450fd2cc8849f1d1227ef33fbadf42defffa6a905541a65606d258fdd113b99","ssdeep":"192:JAev04mCpPJb8GkNz8OjgD2h5OCaqNRq7lftqn44W1sLdry1vK9yHEdBO:9WCALOlBJlIxWEry1vfZ","tlshash":"1a72628db1d2f06443a76270902f110af2ba2a69f54dd0c4e729d4e1acb498e9237f7d","first_seen":"2024-12-16T04:06:20.147627Z","last_seen":"2026-09-14T04:54:28.408566Z","times_seen":40,"resource_available":true,"data":null}},"time_used":1174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.252Z","timestamp":1788699978252,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-302f\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12335,"size_decoded":4267,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-09-14T23:37:41.050281Z","times_seen":128100,"resource_available":true,"data":null}},"time_used":1133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/analysis.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.453Z","timestamp":1788699979453,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/scripts/analysis.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-4b5\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1205,"size_decoded":957,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (701)","md5":"97330450853d21edf4badf5b384ca25b","sha1":"bd48c020be1b41d9386cd30d10c8a81bb27a8a97","sha256":"96e39b302859f25ccc60a28271e00c51a73c4d8f7ae40b93c61320f17097df7b","sha512":"3283e67ca75264203c67053a049a0345185df2a96de8a68892d9d8f497da9e6a99d80fb275b1f254b425383c3fee40659ada7df0b263377a2d322290e3ede5b0","ssdeep":"","tlshash":"f021118e35591a747fda1bef2377d71c702360187920ea1246dfccc8602aed250276cd","first_seen":"2025-08-30T07:44:58.125982Z","last_seen":"2026-09-14T19:37:02.687708Z","times_seen":43,"resource_available":true,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/39b70e0b8818b2ed38d7d3012b8680c74b29b775.4c728255a8c13b372e67.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.238Z","timestamp":1788699978238,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/39b70e0b8818b2ed38d7d3012b8680c74b29b775.4c728255a8c13b372e67.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-3da1e\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252446,"size_decoded":77052,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (53398), with no line terminators","md5":"3671c7c9f419eb8ae66b0278e5875025","sha1":"cfce1cd0af151b59e103f30ef4c9559762a31a66","sha256":"6e49887c6a270ff031878e05ddcad3e23761a00d16687c40479623b363fe7883","sha512":"8d3dc94cc246502d115a8ea4a286dd07acfc31e9749c6de5141becf5d5b4e6117ece10c9d578dadf2be8766b2066d1bf0e498359a570632af82d966f36760960","ssdeep":"3072:SAjJvvYt0QXos88JJS06/65PrI50/eEFUR5vBLeL6KJKPHZXXbse47xZ8BIUJQnR:t5Yeg+k/eFg4RXQnMh/8L/U0d4ASnQ","tlshash":"5a34a60fd7355eb7086b51cd1dd96ffce8d2030641c8d87ac7ea55891b4c9beaa23a02","first_seen":"2025-08-30T07:44:58.098816Z","last_seen":"2026-09-14T19:36:45.622124Z","times_seen":45,"resource_available":true,"data":null}},"time_used":928,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":928,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/29107295.6d4b8f5c00e5492aea21.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.241Z","timestamp":1788699978241,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/29107295.6d4b8f5c00e5492aea21.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-1207f\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":73855,"size_decoded":25402,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4d8225dc49f0ef650c322d2a4964177e","sha1":"8704bb7a8a5cd075068c6d79e7d4b6c9aa08645c","sha256":"03babc01567b1d9af291b4de0a070ef189685c333c948136a31aa08e7ed51a5a","sha512":"5dc846622a7be3961ea31724b6ad89aec34a0f9935b8ac89e5dbc15b70ae4255956e0fa4ad412dcaf1edc0ee025572ef596cfddaa0e6bc3f448fc79942d72078","ssdeep":"1536:xhdVA1ObQbCbmExG502EoIWYwICTJSIHg:z7/mE8502EPWYwICT/A","tlshash":"b3734ec83ec2f016576760b1007f048bf13eaeb269ad9554d0a1e4ec7cb851ee6b7e18","first_seen":"2023-03-13T01:47:10Z","last_seen":"2026-09-14T19:37:02.686699Z","times_seen":867,"resource_available":true,"data":null}},"time_used":1178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/expand-arrow.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.270Z","timestamp":1788699978270,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/expand-arrow.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 225\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-e1\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":225,"size_decoded":496,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c3a3ba55d5d6d255b6dcaa80eaf21c97","sha1":"8f86b4851ee92482e597da0c1f8c2ac0e808d565","sha256":"e59ddb58b79f82468a2c5d497c2a80071e3041a57c38592bfda1ddbe1d40ca54","sha512":"bce1801fcd39ed1b9dc0ed47b3d9c80fd5aac58cef4e216d2059814252aef67079eb5f146a1a3110d1585570e51628451e0040ec9e08b74626c040f906fae005","ssdeep":"","tlshash":"72d02335734c8c3cb6238530e359717580fb5067154c5194d8726039e1155ce7c375ec","first_seen":"2024-12-19T13:43:21.405799Z","last_seen":"2026-09-13T17:06:14.064262Z","times_seen":24,"resource_available":false,"data":null}},"time_used":1149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1116,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/blue-arrow-right.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.271Z","timestamp":1788699978271,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/blue-arrow-right.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 220\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-dc\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":220,"size_decoded":491,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0c57dccb72dc697d60605f49256aa937","sha1":"9dc3f26e787377fbe86d93c99e3347b6cf379222","sha256":"25d0131decc5ea153cf018a7585d639b1b74dabce3d20c5373a545d8bb7ab11b","sha512":"c2f2d5e11d73cbf181a2681dbcf63f7a34e3f4a8cb85c29dc8fdb849561e83ad0fc07818fb9bb292bf90162557940efc1b5a661b308eb91e01e68fe3368d437d","ssdeep":"","tlshash":"4cd0231b538c0c2cf41e4510fb193131106704d34a4821d8c971213227069ef7d3fafd","first_seen":"2024-12-19T13:43:21.40771Z","last_seen":"2026-09-13T17:06:14.057128Z","times_seen":23,"resource_available":false,"data":null}},"time_used":1618,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1149,"receive":469,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/YOz1gQVypx2fvdmmbu1RN/_ssgManifest.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.444Z","timestamp":1788699979444,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/YOz1gQVypx2fvdmmbu1RN/_ssgManifest.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 79\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-4f\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79,"size_decoded":428,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"abee47769bf307639ace4945f9cfd4ff","sha1":"c0a0dc51ee8a2852baf5ff30c33b1478ff302585","sha256":"653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479","sha512":"2b074799106698df69a28fcd8255c3cfd1ccf40fd4c1bf5d463c42e63b32856f801e066706fbd960a0da4ebe645c070c398dcf01bd722dc4fa592266361ae81a","ssdeep":"","tlshash":"d4a001a0903cdc60aa63dd1c126013168fa05062651d28938afd2054c0341410300d50","first_seen":"2023-03-07T01:03:45Z","last_seen":"2026-09-15T00:01:22.417973Z","times_seen":17986,"resource_available":true,"data":null}},"time_used":483,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/hm.js?f4b3788b2247dd149fb7fdffe8aece79","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.136Z","timestamp":1788699980136,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /hm.js?f4b3788b2247dd149fb7fdffe8aece79 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T13:06:17.545Z","timestamp":1788699977545,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/ HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 28 Aug 2026 01:22:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a90e2c3-3096\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]},{"name":"scrollreveal","description":"","website":"https://scrollrevealjs.org","common_platform_enumeration":"","icon":"scrollreveal.svg","categories":["JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12438,"size_decoded":3738,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12428), with no line terminators","md5":"0da57059510c980fad3d762fe73fd401","sha1":"f5b2b48481adf8ea15d4d4cd02ee015e8a8cf995","sha256":"4a7697df8eaba46c0aa4b6db5b45be21f40e8a3410741e0dd7812ab03770aeec","sha512":"73d498e6931ec9abdf8fd9f4bcc65a085c7ca0afedc07b36fdb235bc845949aabb6dd037ccc36cc385b1c4576061a249448fc2838b25d20147b10d28b9c8c95b","ssdeep":"192:KHr8peDedi8tgOwfjJd5xAXMW3Fq6fpJWEN627:2edi99d5xEMW3FxqEN627","tlshash":"4d424423ec05d95b06234cc9e0bab77d91d6a23eca32dc2981fc838797c5ee55f12906","first_seen":"2026-09-06T13:07:13.103162Z","last_seen":"2026-09-06T13:07:13.103162Z","times_seen":1,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":469,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/pages/download.4d65f040.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.229Z","timestamp":1788699978229,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/pages/download.4d65f040.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-844\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2116,"size_decoded":1067,"mime_type":"text/css","magic":"ASCII text, with very long lines (2113), with no line terminators","md5":"bb7b85457f457587c61a191d5db2c15a","sha1":"4c96225d70287a4e42293cd849efa2ae0406725a","sha256":"d48ba0899ce6a5a9a5dec1a5d3f451cf830a7e3f04de8498661139528f7c0fa4","sha512":"2d6747a31b02372170525488c9be40d0b6a4a0c110f605a5ef77b4b6278b29b7bc9a90767dd04b61e72c81dcc6d0db4b769f2fa62e954f7f229b0f56d6ba8c1d","ssdeep":"","tlshash":"d341cdbbd1329714f672d027908cb4453726993ba523c716c96a312fd6b458716323df","first_seen":"2024-07-13T18:58:35Z","last_seen":"2026-09-13T08:11:57.142323Z","times_seen":32,"resource_available":false,"data":null}},"time_used":936,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":936,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/webpack-22eaaa575d3c455933b4.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.233Z","timestamp":1788699978233,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/webpack-22eaaa575d3c455933b4.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-606\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1542,"size_decoded":1117,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1539), with no line terminators","md5":"2019297a9ccffe0e261600bad1b1f98a","sha1":"a7af96e8e11cadb4f053e78cc91cd7c531f1e877","sha256":"75fa1c4760ad6194a99710872e3612002c84c4df8339a57be0cb4aad1bde794a","sha512":"931b78e601e346f1ae773b8321cdf332b8dcc1fc2345d76f2a187c4c331f30c9f328ef72435b7302293d28b5ab1742685e5d89ce174c0af9c73ede3a9afff1a4","ssdeep":"","tlshash":"193131d536a4fcac53821d5d083f7006f2291d65127cf5c19384e8b2bc6488e9166eaa","first_seen":"2023-03-07T12:08:00Z","last_seen":"2026-09-14T19:36:45.658111Z","times_seen":489,"resource_available":true,"data":null}},"time_used":683,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":683,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/aec7d165.15f05aecd792e476c6d7.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.242Z","timestamp":1788699978242,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/aec7d165.15f05aecd792e476c6d7.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-78b32\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":494386,"size_decoded":152100,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"87176dcffa419147a6f9c4e1ba9a72e6","sha1":"59835a44be3f43788c2662906fda25ad8505f299","sha256":"81d1c0630f70d1831ac13e2e4f212b532052be907ceded265f49bb8ae934a54d","sha512":"26890c42b28d16e4d7690d68c203ee438c0f7ab487d5e40c2a798a5b2a84c5f6f754cc22a4e9c7121a6e4c8b08969fbe3faa7798a35ea1c0acbec960a3f3535f","ssdeep":"3072:9OPs5At4sA10x5rTzcck1I2cbwHYS8cbRmMrye3LgbxKGyJHgJxmjwKeYHAXAOhe:9OHjUHYeHJw9XZG3XqDUFmkMtEFcA","tlshash":"feb46628c51482bc9dba5ba88d325075a65e91ff71e14325e36eccb073610dcf7aacc9","first_seen":"2024-03-29T05:20:17Z","last_seen":"2026-09-14T19:37:02.684463Z","times_seen":308,"resource_available":true,"data":null}},"time_used":1178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544_CSS.ff5578978733a40a67a3.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.244Z","timestamp":1788699978244,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544_CSS.ff5578978733a40a67a3.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 72\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-48\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72,"size_decoded":421,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"b54e11e9a03640be21a29dcee2e7436c","sha1":"49e578b58377bbe697aefa5ee7b278cde8beafd7","sha256":"a324955b6aaeec85e72d8160f86a6f1cbbafe0eb3ac848ca832b8ad2f158f3d6","sha512":"932e86a4440fb2efd0754b82e870eb4bd62b8fb4b79e71041ae3335a2ddeb7eb234117a75a96664128dafce247d8b7164993c18af287cfecbd6972f459596a65","ssdeep":"","tlshash":"f9a0026710117c9aa8fc024827a3a7b03858401c1f00cdf81b159071b071d0faaa01c7","first_seen":"2023-03-07T15:16:04Z","last_seen":"2026-09-14T19:37:02.685686Z","times_seen":372,"resource_available":true,"data":null}},"time_used":1180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1175,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/pages/download-8d070118fe18b9547f73.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.249Z","timestamp":1788699978249,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/pages/download-8d070118fe18b9547f73.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-48ad\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18605,"size_decoded":4372,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"0a966bf51803b1a653870fe382301a15","sha1":"979063e02dd48eefa2e6423ef310a677128863d2","sha256":"d1a870f2ad9e2a6897ba3bfb6ada8ec1e5ec8c33dc65ea55015aee6f313dcc90","sha512":"f71626c11b8ccc74d5919d503cb64ad4625938dd26096bca915bc6c85f1bee81f6b339a54e03d3424626e9061a72c4a8a73288a39bf983ac39adfa8c7b904927","ssdeep":"192:RNvvDtQUYZcvCElGx6SDXdev4kQibtZVxb9oG:RNvL6UYCqE9STdevSk","tlshash":"8a82bb1ee0a1546a80b7b1bc0e6f2065a531018f8e68bc287ffcd1ccaf2d56d857579e","first_seen":"2026-04-01T03:52:04.083837Z","last_seen":"2026-09-13T08:11:57.164551Z","times_seen":9,"resource_available":true,"data":null}},"time_used":1137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/guard.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.267Z","timestamp":1788699978267,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/guard.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-1840\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6208,"size_decoded":2857,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"de8e725ec7f9672cce0ea59e946bad04","sha1":"4eddacbb97c2fff93b8ad1b78de767859fd1b4a6","sha256":"7a170b2275e8afef43e8ddc1483d8884d3d841c8842a0e0c79d7dc9046ff1b3d","sha512":"be75d91b9c69a75ffb4f34ea089a7b1bbd487ab39fa25f3c08897f84cf4138b525b97fd01c3ea0267377536b4275007d2a68cd6f06cc545297cd84a3424f8d4a","ssdeep":"96:PTe1F7b769gjKat20cdvhY33Qm5Knd4EqRDsnfRmaNR/tYJPO062ukbzX:PTeP//Oa1cdvhGANniRsRmaRqdRueL","tlshash":"04d151c43738cbbcf81196bcc71376713c022a9797a29194cbb26e21b94511d9e7ece9","first_seen":"2025-04-09T11:05:04.880458Z","last_seen":"2026-09-13T17:06:14.078265Z","times_seen":30,"resource_available":false,"data":null}},"time_used":1118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/yellow-arrow-right.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.269Z","timestamp":1788699978269,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/yellow-arrow-right.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 203\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-cb\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":203,"size_decoded":474,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f47ce1227cdbc0099e2311c0b66a882c","sha1":"df9b66c733b778fe60b7b8868d262e4b5fa89edd","sha256":"53ea3bde61f22abe8d963f08375ff14792e742b4f25e69dc65b603f21206214c","sha512":"6869ae1791366fb4c083bf1df4e3414946dab4d97466b5aa9e6ebdd1aec16d1852e470f7cdee8b0e96bd2348d52ed661a1a99ee7205cd01ee9589f160a2f2640","ssdeep":"","tlshash":"dfd0226a53d80c2cf6614720eba8353a10ab0193438821eccee2303036040debd3baf8","first_seen":"2024-12-19T13:43:21.403919Z","last_seen":"2026-09-13T17:06:14.042109Z","times_seen":24,"resource_available":false,"data":null}},"time_used":1620,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1150,"receive":470,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/2ba9cc99e00816a1bd4c69c8eee2c1ab9d576565.56d59fd5717767992ec5.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.246Z","timestamp":1788699978246,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/2ba9cc99e00816a1bd4c69c8eee2c1ab9d576565.56d59fd5717767992ec5.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-54a0\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21664,"size_decoded":7884,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21661), with no line terminators","md5":"38c83f594ebc02b1eed76fd2f8e8eb6a","sha1":"4db6d88c8dcfee76d057bd44d2dafea77e1b8388","sha256":"bc8ebfd8a0dabfceeb6ee2255ce97d493988efafecb1211b34165a46d433e39f","sha512":"f493be4a7f1f9496bcf25d67587a29e53f3a83b90728b05b2b4a9a8b8acaa16873ee218a448278dc1a66222f7506256977f971376701286bd7ecd5c7f468eeab","ssdeep":"384:SqVx43DKuN95+ROmm3jbAAdTRbgT4NaYvw4n+6HHHHsglu8Rx1:vWZaj4nvHPT","tlshash":"4aa209d5f36091b2106a68d5681f204ba1b574176c19c1d4bf31c4e3edb4feaa47af34","first_seen":"2025-07-18T14:07:19.206042Z","last_seen":"2026-09-13T08:11:57.164094Z","times_seen":17,"resource_available":true,"data":null}},"time_used":1173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/gtag/js?id=G-3GR90RW2M5","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.134Z","timestamp":1788699980134,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /gtag/js?id=G-3GR90RW2M5 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/analytics.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.137Z","timestamp":1788699980137,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /analytics.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/css/pages/download.4d65f040.chunk.css","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:20.156Z","timestamp":1788699980156,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/css/pages/download.4d65f040.chunk.css HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-844\"\r\nexpires: Mon, 07 Sep 2026 01:06:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2116,"size_decoded":1067,"mime_type":"text/css","magic":"ASCII text, with very long lines (2113), with no line terminators","md5":"bb7b85457f457587c61a191d5db2c15a","sha1":"4c96225d70287a4e42293cd849efa2ae0406725a","sha256":"d48ba0899ce6a5a9a5dec1a5d3f451cf830a7e3f04de8498661139528f7c0fa4","sha512":"2d6747a31b02372170525488c9be40d0b6a4a0c110f605a5ef77b4b6278b29b7bc9a90767dd04b61e72c81dcc6d0db4b769f2fa62e954f7f229b0f56d6ba8c1d","ssdeep":"","tlshash":"d341cdbbd1329714f672d027908cb4453726993ba523c716c96a312fd6b458716323df","first_seen":"2024-07-13T18:58:35Z","last_seen":"2026-09-13T08:11:57.142323Z","times_seen":32,"resource_available":false,"data":null}},"time_used":484,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/orbit/token-im/stick-note-en.json?q=1788699980913","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:21.414Z","timestamp":1788699981414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /orbit/token-im/stick-note-en.json?q=1788699980913 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: locale=zh-CN\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":484,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/orbit/token-im/checksums.json?q=1788699980914","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:21.416Z","timestamp":1788699981416,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /orbit/token-im/checksums.json?q=1788699980914 HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mtoken.click/download/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: locale=zh-CN\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 06 Sep 2026 13:06:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-14T23:48:56.20381Z","times_seen":559430,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/main-8151490efdf97440a17a.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.232Z","timestamp":1788699978232,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/main-8151490efdf97440a17a.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-6f98\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28568,"size_decoded":10105,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (28565), with no line terminators","md5":"b970ae78f33918cbef06cb859959bb9b","sha1":"9bb0949dfbdd7fa03f28fbfe1e9248a446c97c35","sha256":"126339554462e3a26bf9ebff853b05a396cca65a18d38888ebb629b755d1e281","sha512":"ac268198d7bbdd0c6ce569f005c93d5b2a6c1b10d9a7acb40bdaa8d2bbf81273b9be3297c2aac2c09051d016449720b79db8f94d9ae1f5967b3e58d0fb633f04","ssdeep":"384:X+laOqpTcr+3u+NtL+JyIKuWLnr+tCTruuL+vIQY6bMyld6SnhF/AT:ulMpIr+3ugtL+JVWL+CTrZ+pld64FYT","tlshash":"5cd2c8ddb6c6f02203d33134903f610bb37b2958a84d8454a759e9e67c7a94ea227f7c","first_seen":"2024-08-22T17:17:34.030065Z","last_seen":"2026-09-14T19:37:02.67741Z","times_seen":250,"resource_available":true,"data":null}},"time_used":901,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":901,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544.724b3e4d54c037e5a62b.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.243Z","timestamp":1788699978243,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/19f24c842955fbbab397f79015225d5d350aa544.724b3e4d54c037e5a62b.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-9e24c\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":647756,"size_decoded":122825,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"4d3fc7fd99e1d4459a40e10694e15e6a","sha1":"c092d8c3f9cd79bf630519bc00557a8705363886","sha256":"27735c6194ccdf74f77e3ec21dbe8d5c7e171061513b078edd88921d82d59ed7","sha512":"f5792a07b494348eda75c2ecb41ab293be281ef0752eb218fc75d5722221dd70d60e45883240871d510ef67025f5c4abade098f6db5ca9fcdccdf0a45ee341ba","ssdeep":"12288:isJ1xoG0KTfTCZDzZiRxMXK5jnhFcLSUa:isJ1xoG0yfTCZDzZiRxMXK5jnhFcLSUa","tlshash":"1ed43c4abae260309167b1bd4b6fa405b134841f0d99fd043e8c92a99f1c43da7b6fdd","first_seen":"2026-03-31T14:52:48.778611Z","last_seen":"2026-09-14T19:36:45.654419Z","times_seen":43,"resource_available":true,"data":null}},"time_used":1175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/img/imTokenLogo.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.261Z","timestamp":1788699978261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/img/imTokenLogo.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-24de\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9438,"size_decoded":4473,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ff362ef3dd8481a8b6507fb545025cf8","sha1":"a728dfb3d393258924ce63dfbc3f638b59d3330a","sha256":"690e08204f91ce6958a804b11ee08546156e4b5dca35f0b1ce00dee6266156b2","sha512":"a25bd09b8e65b5188bc5efcaf54aa7a215217cd53f8e92337c06edc96cf82b3e116e7771ea3ed36ac51f42d869f018178f0429e15044e8a43cfe72126643124e","ssdeep":"192:LJYVRfONtbZ36T9/zp+beh4ciRBi6m/Z1BnMg+K4jnFJibZLI2R9TZx9R:sRfONtbZ36PPiRBivPBMgxKnFJlE","tlshash":"681286f13aa463f59503ebf8de2754746a2b38fabfc54ae7c190ac499422055cdc9cc2","first_seen":"2024-08-08T18:51:51Z","last_seen":"2026-09-14T19:37:02.689302Z","times_seen":2283,"resource_available":false,"data":null}},"time_used":1158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/header/menu.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.262Z","timestamp":1788699978262,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/header/menu.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 308\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-134\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":308,"size_decoded":580,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8c52b54d3fc658ed091ce44072ec8434","sha1":"d6fbb339e3640970de1891495a30d8854481449f","sha256":"468f795384b4e22c4f2f1f5f5a42000e031823b8f9eeaa05588500d455bb7caa","sha512":"776c0d646a21baf8606e986c1fd91e22a908dbf174ddbe638852080afc7930ecf8aa17cb8c3addf57e8733b87b1da6fa494146d5198cadf631c8f170c5a34331","ssdeep":"","tlshash":"5be0c222b59c2719c702db10c66ca599219df9c743190044fb80322e6378ad7acfd27d","first_seen":"2023-05-07T16:57:14Z","last_seen":"2026-09-14T19:37:02.680164Z","times_seen":609,"resource_available":false,"data":null}},"time_used":1628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1157,"receive":471,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/img/appLogo.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.263Z","timestamp":1788699978263,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/img/appLogo.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-82c\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2092,"size_decoded":1266,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f930429ac47c5914332bc8a7f977517e","sha1":"64965926dba9d797f608370b392ec1e1d52e9f7d","sha256":"1103f822d937eeec0ed7cadbb6772933301f5e7fd5a14653260611339e69c63c","sha512":"d344c933852f9a5f0be98093bf690287549546b69ba978f78d7e56a88bcce53f1123e0d450c3333a5b8bfc70620ec3e3da191a81dd61229e192d5f8b0791c685","ssdeep":"","tlshash":"404195ac3f3ec77fe104eabc0a9288308a8142d4db01d0b39a517d57bc494996d265fb","first_seen":"2025-06-29T21:18:25.163408Z","last_seen":"2026-09-13T17:06:14.037251Z","times_seen":26,"resource_available":false,"data":null}},"time_used":1156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/apk-zh.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.265Z","timestamp":1788699978265,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/apk-zh.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-2c60\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11360,"size_decoded":5155,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8ccfbe67aa531a644453220e5a3a5274","sha1":"2362fc52e0722310f4f52f3f773f65dc53a242aa","sha256":"b0de4aee4d98ae58f5b5f33afb32acbb058156367ab4870a3e5aa8b0808fb2c8","sha512":"b2e119b9127843621e573f3253a0b96e87da7d2bcd5c39d569f4df1f4118bf0fa5f8de023a7ef30907ce810b44666b340d68ddede3c15c66256f67c46e89e549","ssdeep":"192:oXTfvY4wFUYfPTJ1r4uZO1XjPTBJ9PAodPunY/9N/2MTylNTTtPlBsAYhTba:MfvY7UYfn4uZKXBxPh2MTyXTTBTsH6","tlshash":"5132a6cd7b76f2e0e444f7e5d32210b8372b68f72e32cd6cc79a5d49a68181c4469892","first_seen":"2023-06-02T21:11:30Z","last_seen":"2026-09-14T05:11:56.48073Z","times_seen":519,"resource_available":false,"data":null}},"time_used":1154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/google-play.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.266Z","timestamp":1788699978266,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/google-play.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Thu, 11 Dec 2025 09:09:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693a8a2c-3c0e\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15374,"size_decoded":6670,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"73c01ebb817309577fda320ef883b314","sha1":"8710d9e56382cd3843a325fa6a27291cb4f7b650","sha256":"e46d534b92668b873cdc56c1be524b4036d684b041ee6a0c1a551a0f9c4eacd7","sha512":"3074367dccb809b609a76371dd3f0378d1b220539bd069f307a815855744a988266113cc327e62774f4ff13ccc45103a8b88976084362dc5db96194a153d911d","ssdeep":"384:MSvYloIaCS2ktNLmso+5SCVZvM2s/iuVS/yOeA9uHrAgjT:MuNYC31k1VShnwT","tlshash":"e86295df679863e4e082f3f8ca1251727f4f68fa7a21cb6c83da7d85661205c9448cd5","first_seen":"2023-06-02T21:11:30Z","last_seen":"2026-09-14T05:11:56.490056Z","times_seen":677,"resource_available":false,"data":null}},"time_used":1119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/right-domain.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.268Z","timestamp":1788699978268,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/right-domain.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-23ee\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9198,"size_decoded":3760,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"42902a046b0b7ee6667adc60114f4bbc","sha1":"ed6be3f3d71c24ab6069f44533c0d97e39e467c1","sha256":"eb8738cf67f6781f8fd95c58e726afeb51d284bce669590e65ea83230a3f07dd","sha512":"5ec64bda74f8fd30d80f1c3510aa7c77796bee8651dfbbe59af48559570edbdacc7972c7f2a7dfc34e123766e87039f50530e1903b4ae3e779dee72f764deceb","ssdeep":"192:TIFUlINe7WDH77aTOouutQY5XtjTKdQnK1mvT4:TIFWINBH77aTOouutQ6tjT3K1m74","tlshash":"3112a4eaf7c4a0f0e81aabf4d75241aa339ba0f64f52c608c7527c2679014acc85cdc5","first_seen":"2025-07-18T14:07:19.210607Z","last_seen":"2026-09-13T17:06:14.070346Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/framework.a0cc4416b9424a5588b2.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.235Z","timestamp":1788699978235,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/framework.a0cc4416b9424a5588b2.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-1f8c5\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":129221,"size_decoded":41037,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f52502ac9007133582fe44e8c7b70136","sha1":"6f017871e79d3b5e08aab7db5080e287fc2212c5","sha256":"275ca0ad51cab700a7c66736740557494b815a03fc464577b9c0fdfaf9c41441","sha512":"cec19cb62a3e74b2d9be8d0049597049d6b0d53754c2d6f24d5d422b59a16998fbb33ecfd5cfe53af0f1437f98056517e44e2a16adae3e1865a1fab6609d01ff","ssdeep":"1536:U4v3hV6X5JRGNeG4XFmkXdKwDSuSdDp7FktuGhR8XvCi0AHlk:nfhV6TZ1YwKt7gRwCi0AHlk","tlshash":"e7c3f8d93992f5626bf311b7109f1813733d161b280c4960a212fddeb9bd05ea12bf9e","first_seen":"2023-09-20T16:39:30Z","last_seen":"2026-09-14T19:37:02.68878Z","times_seen":333,"resource_available":true,"data":null}},"time_used":1150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/_next/static/chunks/styles.8644ff0f5a975963f94d.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.248Z","timestamp":1788699978248,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/_next/static/chunks/styles.8644ff0f5a975963f94d.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 259\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-103\"\r\nexpires: Mon, 07 Sep 2026 01:06:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":259,"size_decoded":610,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"de9d77950776a69ffa50f7234df7190c","sha1":"483ede0c4f7ab5df20cbd9ff21e83feb7ee4be5e","sha256":"60a1d40c6f02c26f052e84e5e2992893a59d08fa2d3d4eb486cd518711828d0b","sha512":"32ae10a4e27c502c1d1ddde36638a1b1c8a3945485bca60d892d912b04fe7d3ddca07fba3fed7018053ba2aea01396230b9c723294e14bd1e40e8b08bdef9f91","ssdeep":"","tlshash":"2cd0420839a03577a5e621e4215b31d81ca6121e36fcfc9817f4c19adb3278e145398e","first_seen":"2024-08-22T11:11:23Z","last_seen":"2026-09-14T19:37:02.677977Z","times_seen":273,"resource_available":true,"data":null}},"time_used":1176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1171,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/images/download/market.svg","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:18.272Z","timestamp":1788699978272,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/images/download/market.svg HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 769\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-301\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":769,"size_decoded":1041,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"887895a974e06f78927bb0c5fe2e8d92","sha1":"ff82f8b6fc72266e11fb4611efaa9b52fbc82252","sha256":"e1919e3aa39d79812fc4e721f98e59349d2df73206f8f6040047daed62313c57","sha512":"458e6bc84b1a21b1a7c7b3b303799ed993a657e2af0baa9eacd85d47cd7adb0474b7f772374eb1ac5a14f44043e6287a62b0fc4a1cceb4154620d9eebcc6f451","ssdeep":"","tlshash":"1b01284663040c3cb6334728df557770512625533e456150ca7319770a96a4d7d3fee4","first_seen":"2024-07-13T18:58:35Z","last_seen":"2026-09-13T17:06:14.05923Z","times_seen":38,"resource_available":false,"data":null}},"time_used":1403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1146,"receive":257,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/common.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.448Z","timestamp":1788699979448,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/scripts/common.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-aba\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2746,"size_decoded":1407,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"f82ea3f9225dd45fec3eebd6e63c954c","sha1":"2d6886dbbb8be31c4b2e4da073ce5230a6bfeb2a","sha256":"59e2227be4a47a7fb1d43287da5e2df66f60a6dd98e606b7ec6995c46a14126a","sha512":"0d22f8b10915b50abc1e4ea28be4765384afa8f08fd08b1a87af2072ed2933b311d5da5fc1176c6cfdaa4a3895084d7093e6c1838ead3e709cf93917d43cdec1","ssdeep":"","tlshash":"f451118e72c9b5b766eb1dbd11af379c793a118bd80c8011647ac8d95a701858033eef","first_seen":"2023-03-13T01:47:10Z","last_seen":"2026-09-14T19:37:02.686233Z","times_seen":850,"resource_available":true,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/help-zh.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.450Z","timestamp":1788699979450,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/scripts/help-zh.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 650\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-28a\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":650,"size_decoded":1001,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (527)","md5":"540bdce1a4de261ab7a227bb501ca319","sha1":"900ababb41b2dbf10245edfa16f495c355b3e425","sha256":"243fc598e4b794f61da4a8cead8f39d876148d347c11545cce724d385f5243f9","sha512":"0b5878027aeea7d9f7f58ea8937435b0288e67645469abfd522026a880458de3820c21017356d317aeef6ea264e383ab1e198556d9b3c9270f9e7cf9146a82ec","ssdeep":"","tlshash":"04f0ddfd7906b824877391e5a3afdb0c76d76201a98548c2d58bccc0b43cd5b050fa49","first_seen":"2024-01-26T16:54:53Z","last_seen":"2026-09-14T19:37:02.682867Z","times_seen":255,"resource_available":true,"data":null}},"time_used":484,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/baiduPush.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.451Z","timestamp":1788699979451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/scripts/baiduPush.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 193\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\netag: \"68c197bb-c1\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":193,"size_decoded":543,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with no line terminators","md5":"6bb24a2906b2b7777cf01e648727281a","sha1":"3ec92d0ae833464e696a1f2916857f6c05c81e47","sha256":"5462c841c26c4bc11177c959d92befdd7f9d7c02de5a2bb6d49b33f92189d03c","sha512":"098ea8e99c1dc303ce1d4c1193fff8a05a7bf1816825c439e1060e70eba3abdbd07963b12d951cae7418a80694ece565ef01224cabf2417319bf1943538050f9","ssdeep":"","tlshash":"44c0126d79558534374404bad57bda5df052303855699413c84edc453424dd74419a59","first_seen":"2023-06-26T14:35:54Z","last_seen":"2026-09-14T19:37:02.687228Z","times_seen":241,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mtoken.click/download/scripts/scrollreveal.min.js","fqdn":"mtoken.click","domain":"mtoken.click","tld":"click"},"ip":{"addr":"23.145.152.44","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mtoken.click/download/","date":"2026-09-06T13:06:19.452Z","timestamp":1788699979452,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtoken.click","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 01 Sep 2026 16:09:00 GMT","end":"Mon, 30 Nov 2026 16:08:59 GMT"},"fingerprint":{"sha1":"FB:43:4E:1A:4C:3C:6F:AD:B9:31:FE:D2:BC:3C:45:86:BF:8B:68:F9","sha256":"4A:FA:4A:DC:E4:26:68:79:BA:47:E4:8A:7C:99:47:31:3C:BE:35:32:9C:5E:63:A7:2F:13:2C:56:3F:2B:60:D9"}}},"request":{"raw":"GET /download/scripts/scrollreveal.min.js HTTP/1.1\r\nHost: mtoken.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mtoken.click/download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 13:06:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Sep 2025 15:22:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c197bb-238a\"\r\nexpires: Mon, 07 Sep 2026 01:06:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"scrollreveal","description":"","website":"https://scrollrevealjs.org","common_platform_enumeration":"","icon":"scrollreveal.svg","categories":["JavaScript libraries"]}],"data":{"size":9098,"size_decoded":3489,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9095), with no line terminators","md5":"126cb7c432914f6c726ff146110dcb75","sha1":"e5358bdb7769288dc7c2dc10508e98387e85b6e2","sha256":"fd08659fe0f20fd14dcf4c3c5acdde64de96028174f59b0b3dc776b62be789b9","sha512":"005fd83d6e18b49ad8bc8e46c853e03eb34808c7913aa6df836e6f57a4f41a1256c901b78697c85e6001ddc6c5870dc46f1f3cb500fe74fe69f9ddddc980e4ae","ssdeep":"192:zjBEC60RtRcCT+Ytnvm1uvb/E3aQ6ZvxrTZ6fNrb:zNE312Ntnvm1MbEIZvZTZ6fNrb","tlshash":"cd12d68f3e1274339b5349d5e2df064f773849da2a0b9484b2b4d0bab8b101d6243f6d","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-09-14T19:37:02.694916Z","times_seen":1627,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"mtoken.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"mtoken.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}