{"report_id":"972d522b-ae19-46e9-9f56-4c25b4ff2fd0","version":6,"status":"done","tags":[],"date":"2026-01-04T15:40:37Z","url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"104.21.17.198","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"title":"$FAFO Airdrop","dom":{"size":263056,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1567)","md5":"e5665043ab02d015d9e87abe3a8c6e85","sha1":"cfab820daa7f092d496fa9ee85ec72008f502157","sha256":"90056a3569949eadd75f0e7861494d8b5de97199a472a76bfbf01ae5445cafd2","sha512":"2465fa6c6736fd5baf509392095653c9ac3a2214dad6e30659accd77d4e69212bc7a9e8ded858884b0a3ca058afb902cc79c48034b268783e143d6e0e878ed5e","ssdeep":"1536:9LlnkwVjyouo6NvHAO6pFKo00pJPzuwgh/kPxhw3RyATcuQZrG+UW4q1qGtH8UqI:Jln5youo6NqVnzIkPxhgRyqcuwG+B","tlshash":"6e44d92d167319547a1bc11c1bfe17c5e220594bed8adc6c7ade2e804f872bcb496ec8","dom_hash":"domhasha561fc4db9a1feb14d702104be420ee3","first_seen":"2026-01-04T15:40:42.833254Z","last_seen":"2026-01-04T15:40:42.833254Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"104.21.17.198","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-08T15:40:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"whaletoken.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"whaletoken.net","ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":4,"request_count":4,"received_data":4120471,"sent_data":1867,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-12-28T22:26:34.892336Z","alert_count":0,"request_count":2,"received_data":30622,"sent_data":1090,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"vhoiro.bet","ip":{"addr":"172.67.197.148","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":1458,"sent_data":1031,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fafo.on-bonk.fun","ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-03","domain_rank":0,"first_seen":"2026-01-04T15:40:38.156401Z","last_seen":"2026-01-04T15:40:38.156401Z","alert_count":0,"request_count":4,"received_data":179095,"sent_data":1768,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"c8d765f98e424c1037b6559815a1b59b","sha1":"56211121a7a159b14d0a05fb745adc5176df4fcd","sha256":"c9a6a56bc7e7583a0bef33d8e48cd532007ec27eb13d4b0075a02ba2de9d6d57","sha512":"8ceff5f8a4022f7f82efaf8ae31ca9411467fb58f0d878db098dcf5494a62559f8eb4ea1c1f679403a964c148442c0ea499eb3dc97958f71be1b975aa527cf3f","ssdeep":"768:WYyAK0hFsmI1q3SZX7MhXq1h5gCO1UacmYVVsOo7iqeF9Jz1hRCFSN1k1G99Gxqw:/q2SjDput696OM","tlshash":"fc43d5c263d0388462ef4ff2f327f4f5d46e1a5b3e54089be3547d606a96618ead4930","size":58183,"data":"","first_seen":"2026-01-04T15:40:42.847529Z","last_seen":"2026-01-04T15:40:42.847529Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"eval","is_inline":false,"md5":"73149b81507ef2b2aea6d71b537a3542","sha1":"447f08dd5b57f49c46dd7dc366c08678aa396df8","sha256":"95ce0e1c9270f6957bd9c248dd39a8b639f55164c8f72b6041ee2129d4a20d5b","sha512":"882149b0ca7a9a642bd71a2906da848cacf86c7f058eeab1d52e0011fbca9e68479da4ec38f0ab17fc552e468e528932a74f442ed72868c7e297f23405e48625","ssdeep":"24576:g/XGAvLMwXUMLcWrt3GmQ9WsI331Fyu27q9RbKS7ZY7Cg4a83s2uy83K6CLtfkzc:uLcWrEmQrIn1Fyu27q9RbKS7ZY7Cg4aU","tlshash":"1565f991e3d0f77c724bcb626b3fa4c4d2290b4a79c40f5ae144fd566a9920bdadc930","size":1541430,"data":"","first_seen":"2026-01-04T15:40:42.849888Z","last_seen":"2026-01-04T15:40:42.849888Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ab04b8d007b90b362a02f887f00db6fe","sha1":"c48fc5f41b57e3e7b20b3add98af0bb1c33b38ca","sha256":"e99763bde0be10057dad8c47c2b3c4f585e306b90ad149a899a9f1f5f7c48c0a","sha512":"a33fde10fdf0d1fe5258610426d60a8f4ccdb1e0afac35156565f05b60560f276096ffeabeab93b5fd3e544ae30c5c2fd33fd3cea693cb9d58ca845717f30360","ssdeep":"","tlshash":"e221ab189cf3d020861a34aba76b9008b23125073640dda43a8cf6466f537d7fa55eec","size":1214,"data":"","first_seen":"2026-01-04T15:40:42.850993Z","last_seen":"2026-01-04T15:40:42.850993Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a827e1628d6391e2a1e203699973add8","sha1":"1fa5f59f215e18ca89dbb695aa645bb84f752fbe","sha256":"c1a5ee1f7530b8d3915f24d12d4b618d4174ac21aa12569c2489ffc63a6ca0aa","sha512":"8773678e797557d9be248e8b284123f2e52064e65122814a747e8c19c951effb7877a358712ca7dba4afc26edfa49f9b1f816f59b2d603a55d87bbcb307b02f7","ssdeep":"","tlshash":"79315c497673057659b399abc3c312442634a043b58bc89c7a4cc74c6f9bf49c9a37de","size":1614,"data":"","first_seen":"2026-01-04T15:40:42.851904Z","last_seen":"2026-01-04T15:40:42.851904Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"c2f48b225bae1007f2cd6b9174e5cd1a","sha1":"997938e04f7fb6cb08b47ad8287a30c7673aa575","sha256":"69930088484a0cfdb0ff5adad1c36aa8a3fae571ec8bb5f4ad0ea4bce50461cd","sha512":"566cad44b8cff2f2ef28ff8950cae1e9526dd06811b7118793c3bd54bc5ce6a59bd0ce4f84bec9777e12c360d87ea10a517f0f1fa0cedc22111817d7ac3e8c07","ssdeep":"","tlshash":"f26186875cf2543c6905601f375b9108f321290b2500ee6d3a4e9e4a5f27f5ba855dfe","size":3412,"data":"","first_seen":"2026-01-04T15:40:42.85295Z","last_seen":"2026-01-04T15:40:42.85295Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/ndm5.js","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6785dd480c0022a6d3344436057b77f7","sha1":"20183747b61ac0efdd9ebce4607427e3e33f9011","sha256":"56bd2a2e71d26069e39cebebd6bb9e94929303b13b18029bb00441726c99e10d","sha512":"9187f5e5e98e09a8dbe341a02b391236d7d833fb78b81721b46a9362c02636fb6b685fa47b5aad55ef15834d97b332ca9f759e9ee6b0e995ecb1639670fe22ba","ssdeep":"1536:DcPwzsKLOdWIwBT1dsE346aITIiDsIOnidrIGA:uWJsEIAUiDTOusP","tlshash":"f4e3886b356e626fa40d7f55984d3eda8a24c0409d93dbc48fd103b6387e05ae8f439b","size":155449,"data":"","first_seen":"2026-01-04T15:40:42.841351Z","last_seen":"2026-01-04T15:40:42.841351Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-15T08:38:28.161559Z","times_seen":237773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-15T08:44:42.354092Z","times_seen":743801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vhoiro.bet/settings","fqdn":"vhoiro.bet","domain":"vhoiro.bet","tld":"bet"},"ip":{"addr":"172.67.197.148","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:22.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vhoiro.bet","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 27 Nov 2025 19:53:12 GMT","end":"Wed, 25 Feb 2026 20:50:47 GMT"},"fingerprint":{"sha1":"41:44:7F:AA:11:D8:22:DC:13:29:6F:34:AB:08:A5:A3:81:5B:76:0B","sha256":"AF:FF:09:A7:2C:74:50:25:F2:87:B3:E8:E6:14:04:EF:A5:BD:76:C4:CA:8D:C7:B8:2B:D8:81:9C:0D:21:4C:6D"}}},"request":{"raw":"POST /settings HTTP/1.1\r\nHost: vhoiro.bet\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/octet-stream\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nAccess-Control-Allow-Origin: *\r\nContent-Length: 1550\r\nOrigin: https://whaletoken.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 15:40:22 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 181\r\naccess-control-allow-origin: *\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"b5-xp6R8QXfFWvLF+3DKRj7G4jC8xY\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SyHHLeCOCN%2FlMM%2BkrRZpzaDlhdzZZWMpcWthwU%2FD%2BK2%2FlnxTrevAiXEfVhZNjVLbA9gRLTrpcZmyIvn3UJJ4jbWMqim2ZnCx\"}]}\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9b8bd5823cc27129-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":181,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"71c1545822eaff088e14d0f48eca2361","sha1":"c69e91f105df156bcb17edc32918fb1b88c2f316","sha256":"59baf5e54d9dffa97cc178027d397cd5a751beb4f5d6819dc812b2a1db810512","sha512":"3fd9fd287800be8fb10ea5998b0fc9080b0f061c222572eb49f7eb8efa6e92808cf8aa0dedc44e662224c6df9b822ee8d8aa304d4a4723947e82dfe81047794b","ssdeep":"","tlshash":"15c0c04ccc4e038e1e53007212840c560bb344c39b983108a75ffa23c27500583784c7","first_seen":"2026-01-04T15:40:42.835377Z","last_seen":"2026-01-04T15:40:42.835377Z","times_seen":1,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":1,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/logo.jpg","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fafo.on-bonk.fun/","date":"2026-01-04T15:40:15.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"on-bonk.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 19:44:04 GMT","end":"Fri, 03 Apr 2026 20:42:33 GMT"},"fingerprint":{"sha1":"6F:A1:B6:8D:47:67:FB:F2:26:15:39:E0:C6:4F:83:1B:EE:DD:F4:DD","sha256":"84:2E:4F:2E:57:D0:26:EF:0A:2B:18:0D:D2:96:86:94:BD:64:C2:0D:40:5D:2B:BE:64:77:16:46:D2:D4:76:AC"}}},"request":{"raw":"GET /logo.jpg HTTP/1.1\r\nHost: fafo.on-bonk.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fafo.on-bonk.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 04 Jan 2026 15:40:16 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 5577\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Sat, 03 Jan 2026 21:34:10 GMT\r\netag: W/\"15c9-19b85c83a25\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eJuxmXbajWKoOLNJIqepkLBDx1fcPMWhZV%2F7JtvWilOyjZjBky2NKUqs9jsg97kRgufunQwv%2FvGaiAGfUzw9QJax%2BQ5HPRwFIXVaWy%2FdcrY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9b8bd5579d2bc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5577,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 201x251, components 3","md5":"e012d449abcb8f85dfd5a0de6c8258ca","sha1":"2a0da11050ee26663ff343bf2d33699c07e7a385","sha256":"292cae8d1c1ec4fbd54cddaa78f27fd07dd0c06bc9b7ff9398220c134383d35f","sha512":"5fdfaa521ba3de5891d232ddaee645049bc15723f97dd9d0f9e4cc1194a128e4c7ae6768ad9cb51c99bba397abce2271ba7b398ca662589048c97c0a4971396a","ssdeep":"96:z/m5fwbToKn2bVcKrXyDiTFXqfJu87DFTZNc86jMgk4cbjyfn7qk:zWfwbnng31gf/Tc8kQb++k","tlshash":"abb18e6bcb326b32e7b4597b95ac214f838d1c752360d2d998c1a405eaa4234e30d54a","first_seen":"2026-01-04T15:40:42.836694Z","last_seen":"2026-01-04T15:40:42.836694Z","times_seen":1,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/logo.jpg","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fafo.on-bonk.fun/","date":"2026-01-04T15:40:16.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"on-bonk.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 19:44:04 GMT","end":"Fri, 03 Apr 2026 20:42:33 GMT"},"fingerprint":{"sha1":"6F:A1:B6:8D:47:67:FB:F2:26:15:39:E0:C6:4F:83:1B:EE:DD:F4:DD","sha256":"84:2E:4F:2E:57:D0:26:EF:0A:2B:18:0D:D2:96:86:94:BD:64:C2:0D:40:5D:2B:BE:64:77:16:46:D2:D4:76:AC"}}},"request":{"raw":"GET /logo.jpg HTTP/1.1\r\nHost: fafo.on-bonk.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fafo.on-bonk.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 04 Jan 2026 15:40:16 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 5577\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Sat, 03 Jan 2026 21:34:10 GMT\r\netag: W/\"15c9-19b85c83a25\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4HHP%2Fyx2qSBhS8lOk47kEqqlaqy%2B3avqakd5YL4nNX4VzlVug%2B6K2MUCj5%2BrnvkoZ7umAhG3v%2FRW3BiETJ7ODTjNlgk%2FJJPDPH5fZLhaMS0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9b8bd558fd70c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5577,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 201x251, components 3","md5":"e012d449abcb8f85dfd5a0de6c8258ca","sha1":"2a0da11050ee26663ff343bf2d33699c07e7a385","sha256":"292cae8d1c1ec4fbd54cddaa78f27fd07dd0c06bc9b7ff9398220c134383d35f","sha512":"5fdfaa521ba3de5891d232ddaee645049bc15723f97dd9d0f9e4cc1194a128e4c7ae6768ad9cb51c99bba397abce2271ba7b398ca662589048c97c0a4971396a","ssdeep":"96:z/m5fwbToKn2bVcKrXyDiTFXqfJu87DFTZNc86jMgk4cbjyfn7qk:zWfwbnng31gf/Tc8kQb++k","tlshash":"abb18e6bcb326b32e7b4597b95ac214f838d1c752360d2d998c1a405eaa4234e30d54a","first_seen":"2026-01-04T15:40:42.836694Z","last_seen":"2026-01-04T15:40:42.836694Z","times_seen":1,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/yDV0.js","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:17.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whaletoken.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"72:FC:41:FD:00:B0:1F:23:E2:F4:F9:CD:43:91:E6:2F:06:7F:2E:55","sha256":"C8:71:AB:12:E6:E6:C7:C3:75:20:9F:4A:9E:CE:21:6D:9A:8B:89:4D:7B:BF:F3:84:8D:23:1D:11:54:87:05:C8"}}},"request":{"raw":"GET /ff/yDV0.js HTTP/1.1\r\nHost: whaletoken.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whaletoken.net/ff/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Sat, 03 Jan 2026 21:05:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 04 Jan 2026 15:40:17 GMT\r\nserver: LiteSpeed\r\nx-frame-options: ALLOW-FROM https://fafo.on-bonk.fun\r\ncontent-security-policy: frame-ancestors 'self' https://fafo.on-bonk.fun https://fafo.on-bonk.fun;\r\nx-turbo-charged-by: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":4110773,"size_decoded":0,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (65259)","md5":"7bbcc6bab16e90ce3219e599bc5c39fc","sha1":"a439b0254f74244e24509d2e437c4ed98893ca35","sha256":"013be614dae3ae8ba11c77be2bfacb20ff8cd69afe4034a6b50c4f6c8fb307c9","sha512":"723a9cda081696e4bbc8e376d281f1b5ebcf7d554fc3e5a31f1bd30195ebdcc6f28d0bfdec3ecea47e5f6c986e3591d5963128d30e76a4c44e65d26ae0615c32","ssdeep":"1536:ksqDB4vyAHMDB4vRpreXY6pzEux+FRgx0x99pAfT7FsSE9hW5pIlYEHVzSQKnonK:ks59fxTnQQe//SzU","tlshash":"f625d6de322d76f7103d3f1c66041b7f852980a738afead14bf6036516e522ed4a4a4b","first_seen":"2026-01-04T15:40:42.838146Z","last_seen":"2026-01-04T15:40:42.838146Z","times_seen":1,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"whaletoken.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fontsource/dm-sans/files/dm-sans-latin-400-normal.woff2","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:22.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/@fontsource/dm-sans/files/dm-sans-latin-400-normal.woff2 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://whaletoken.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whaletoken.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 15:40:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 14200\r\ncf-ray: 9b8bd5816e2b569f-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.2.7\r\nx-jsd-version-type: version\r\netag: W/\"3778-fPihwUbFN/KHGQYBbTcAfGHH/mw\"\r\nx-served-by: cache-fra-eddf8230124-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 27851\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=braf%2FIa%2BX6SevwDHJ3nn%2Bbp%2F6ikpWhyLKUzfN5Vn3KhL%2FMeCrSUIfCBKx5h7DfcxkekVWT9p0YMoDgyj3ZQWjq%2B8qwxXbCDfmKoXocjuCGhWJ923XJ8%2FAU3uGToexWiuViI%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14200,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14200, version 1.0","md5":"a220a32881ae190f4784c437c1e467e0","sha1":"7cf8a1c146c537f2871906016d37007c61c7fe6c","sha256":"4ab51eb2cd7305d177187908d6397474d4520663f6c6e572feb0a64f4fa80006","sha512":"bf6503a157d8bb1c221812e845136fdfc4344e3c67802023647b0ff9be233ef2a1035a0a188e0a3612911b695cc142f5d8a874e27a0ec51da7b2a120f78c8e2e","ssdeep":"384:Po4q0QKjXsVLZ0e3mUS+4to3EXf/S5IXxVlU:Q4bFcVL4Uh4W3AHNBVlU","tlshash":"b852d1cded244eeec1744676038cc21996a9f36326f1b955bd90bf86937a8145f043b3","first_seen":"2025-09-12T00:51:45.933668Z","last_seen":"2026-08-15T08:09:38.652985Z","times_seen":2985,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":13,"dns":1,"connect":1,"send":0,"wait":18,"receive":1,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-04T15:40:15.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"on-bonk.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 19:44:04 GMT","end":"Fri, 03 Apr 2026 20:42:33 GMT"},"fingerprint":{"sha1":"6F:A1:B6:8D:47:67:FB:F2:26:15:39:E0:C6:4F:83:1B:EE:DD:F4:DD","sha256":"84:2E:4F:2E:57:D0:26:EF:0A:2B:18:0D:D2:96:86:94:BD:64:C2:0D:40:5D:2B:BE:64:77:16:46:D2:D4:76:AC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fafo.on-bonk.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 15:40:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0\r\nlast-modified: Sat, 03 Jan 2026 21:34:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=opMsnKa%2FwPvuf6Fzqm6HlUwkgPRGywmbsAa6VbrW%2BV%2FTD5JF%2FqSwTPg1HZ0D13nXgtp76QC1yGQoKWeIz7CfScPGXr1jCj8BsfIUe%2BAR\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9b8bd5541a20712b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":8685,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"180d76062a6a39ae2248e164f7445092","sha1":"195e7350228cf17e80e2e03d5f3927e609027d4d","sha256":"6c6d804fe444fc3b465b01bd835d7a6d48ece7036831d2c3c508e1495d62895b","sha512":"69b962b2ad712fbfa2325a61e7c8c7c91cadb2166db9d27d420e292baab902905e196c447cb8275214ee67da02f0deb0e3b890fb2c476c2a96a6eabb00abfb86","ssdeep":"96:4hIk2a5K9S5UdelxiixGRRkV/7FGhOwQ0cLkv7kbLjAeSyL6XIMCh0rgCil:4hIk9K9S5MeTiNkVjatcLWuQ+H2gCil","tlshash":"a702211aa9115012553393b5efe3430cfb785013a34389987bcc628a5fb6789ca97fed","first_seen":"2026-01-04T15:40:42.840131Z","last_seen":"2026-01-04T15:40:42.840131Z","times_seen":1,"resource_available":false,"data":null}},"time_used":552,"timings":{"blocked":74,"dns":57,"connect":1,"send":0,"wait":400,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fafo.on-bonk.fun/ndm5.js","fqdn":"fafo.on-bonk.fun","domain":"on-bonk.fun","tld":"fun"},"ip":{"addr":"172.67.178.63","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fafo.on-bonk.fun/","date":"2026-01-04T15:40:15.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"on-bonk.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 19:44:04 GMT","end":"Fri, 03 Apr 2026 20:42:33 GMT"},"fingerprint":{"sha1":"6F:A1:B6:8D:47:67:FB:F2:26:15:39:E0:C6:4F:83:1B:EE:DD:F4:DD","sha256":"84:2E:4F:2E:57:D0:26:EF:0A:2B:18:0D:D2:96:86:94:BD:64:C2:0D:40:5D:2B:BE:64:77:16:46:D2:D4:76:AC"}}},"request":{"raw":"GET /ndm5.js HTTP/1.1\r\nHost: fafo.on-bonk.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fafo.on-bonk.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 04 Jan 2026 15:40:16 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nlast-modified: Sat, 03 Jan 2026 21:34:10 GMT\r\netag: W/\"25f39-19b85c83a29\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zu82JrXk2uaorrFK76fmOYD0e2OAvRwGT9SWhySbJ8LBZLgcuw4DZ8hwm1h%2FG7SDtb2QAakiKaXXdLVMblnYR5S9rjEUWDepi6kkcfPXL7g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9b8bd557ad2cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155449,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (65259)","md5":"6785dd480c0022a6d3344436057b77f7","sha1":"20183747b61ac0efdd9ebce4607427e3e33f9011","sha256":"56bd2a2e71d26069e39cebebd6bb9e94929303b13b18029bb00441726c99e10d","sha512":"9187f5e5e98e09a8dbe341a02b391236d7d833fb78b81721b46a9362c02636fb6b685fa47b5aad55ef15834d97b332ca9f759e9ee6b0e995ecb1639670fe22ba","ssdeep":"1536:DcPwzsKLOdWIwBT1dsE346aITIiDsIOnidrIGA:uWJsEIAUiDTOusP","tlshash":"f4e3886b356e626fa40d7f55984d3eda8a24c0409d93dbc48fd103b6387e05ae8f439b","first_seen":"2026-01-04T15:40:42.841351Z","last_seen":"2026-01-04T15:40:42.841351Z","times_seen":1,"resource_available":true,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://fafo.on-bonk.fun/","date":"2026-01-04T15:40:16.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whaletoken.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"72:FC:41:FD:00:B0:1F:23:E2:F4:F9:CD:43:91:E6:2F:06:7F:2E:55","sha256":"C8:71:AB:12:E6:E6:C7:C3:75:20:9F:4A:9E:CE:21:6D:9A:8B:89:4D:7B:BF:F3:84:8D:23:1D:11:54:87:05:C8"}}},"request":{"raw":"GET /ff HTTP/1.1\r\nHost: whaletoken.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fafo.on-bonk.fun/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Sun, 04 Jan 2026 15:40:17 GMT\r\nserver: LiteSpeed\r\nlocation: https://whaletoken.net/ff/\r\nx-turbo-charged-by: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3548,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T08:46:19.269091Z","times_seen":17900155,"resource_available":true,"data":null}},"time_used":1651,"timings":{"blocked":743,"dns":188,"connect":159,"send":0,"wait":165,"receive":0,"ssl":392},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"whaletoken.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/ff/","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://fafo.on-bonk.fun/","date":"2026-01-04T15:40:17.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whaletoken.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"72:FC:41:FD:00:B0:1F:23:E2:F4:F9:CD:43:91:E6:2F:06:7F:2E:55","sha256":"C8:71:AB:12:E6:E6:C7:C3:75:20:9F:4A:9E:CE:21:6D:9A:8B:89:4D:7B:BF:F3:84:8D:23:1D:11:54:87:05:C8"}}},"request":{"raw":"GET /ff/ HTTP/1.1\r\nHost: whaletoken.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fafo.on-bonk.fun/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Sat, 03 Jan 2026 21:04:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1721\r\ndate: Sun, 04 Jan 2026 15:40:17 GMT\r\nserver: LiteSpeed\r\nx-frame-options: ALLOW-FROM https://fafo.on-bonk.fun\r\ncontent-security-policy: frame-ancestors 'self' https://fafo.on-bonk.fun https://fafo.on-bonk.fun;\r\nx-turbo-charged-by: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3548,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (1567)","md5":"786d211268fe2c824ba61a958537d789","sha1":"8390e10821b2bb0136e6484c8a54272885992b6e","sha256":"ef59ad879417e04e0aa9e3e8c1fbf4694f55c2bd84972549365b0a96c6b791d9","sha512":"91660fa7898c050d25cc6195428969bc025a8113b355ae8da0a3b760c4cbe184c43ba84865937083ad0a798a678af86977889c479946c00cb7a0504c3bd0dfdc","ssdeep":"","tlshash":"2a71a5875cf2443c6905601b375ba008f322290b2500eead3a8ede4a4f27f5ba856cfd","first_seen":"2026-01-04T15:40:42.843434Z","last_seen":"2026-01-04T15:40:42.843434Z","times_seen":1,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"whaletoken.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whaletoken.net/assets/a-B5JP7lE3.gif?a=1","fqdn":"whaletoken.net","domain":"whaletoken.net","tld":"net"},"ip":{"addr":"66.29.146.105","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:22.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whaletoken.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"72:FC:41:FD:00:B0:1F:23:E2:F4:F9:CD:43:91:E6:2F:06:7F:2E:55","sha256":"C8:71:AB:12:E6:E6:C7:C3:75:20:9F:4A:9E:CE:21:6D:9A:8B:89:4D:7B:BF:F3:84:8D:23:1D:11:54:87:05:C8"}}},"request":{"raw":"GET /assets/a-B5JP7lE3.gif?a=1 HTTP/1.1\r\nHost: whaletoken.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Sun, 04 Jan 2026 15:40:22 GMT\r\nserver: LiteSpeed\r\nx-turbo-charged-by: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-15T08:45:41.219102Z","times_seen":149636,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"whaletoken.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vhoiro.bet/settings","fqdn":"vhoiro.bet","domain":"vhoiro.bet","tld":"bet"},"ip":{"addr":"172.67.197.148","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:22.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vhoiro.bet","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 27 Nov 2025 19:53:12 GMT","end":"Wed, 25 Feb 2026 20:50:47 GMT"},"fingerprint":{"sha1":"41:44:7F:AA:11:D8:22:DC:13:29:6F:34:AB:08:A5:A3:81:5B:76:0B","sha256":"AF:FF:09:A7:2C:74:50:25:F2:87:B3:E8:E6:14:04:EF:A5:BD:76:C4:CA:8D:C7:B8:2B:D8:81:9C:0D:21:4C:6D"}}},"request":{"raw":"OPTIONS /settings HTTP/1.1\r\nHost: vhoiro.bet\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: access-control-allow-origin,content-type\r\nOrigin: https://whaletoken.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 04 Jan 2026 15:40:22 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nvary: Access-Control-Request-Headers\r\naccess-control-allow-headers: access-control-allow-origin,content-type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IXijopzyWTLDsiKym1ABFCDMXFjJHyVm0Vxilf1AYIeyKChKcqDY4nxZrxFrB1kbNCfWBQxhPmgsaYPPlJV%2FuFoLPQifPSOH\"}]}\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9b8bd580ebac7129-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T08:46:19.269091Z","times_seen":17900155,"resource_available":true,"data":null}},"time_used":290,"timings":{"blocked":42,"dns":19,"connect":3,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fontsource/dm-sans/files/dm-sans-latin-500-normal.woff2","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://whaletoken.net/ff/","date":"2026-01-04T15:40:22.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/@fontsource/dm-sans/files/dm-sans-latin-500-normal.woff2 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://whaletoken.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whaletoken.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 15:40:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 14304\r\ncf-ray: 9b8bd5817e32569f-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.2.7\r\nx-jsd-version-type: version\r\netag: W/\"37e0-ShYlIsEZ/zNZzN1TOeak6smzDSg\"\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-etou8220119-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 706\r\ncf-cache-status: HIT\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4LbodhBD%2BBi%2B3tLHF4YQJ4oufqeaSZT8K7QJxRfRhEQaetCvic3MmAhX8O6Gs054oUc3vjgDP%2BgS4bPVWc3BLi67e0sBhADzQISdt7XAZ7TkSe%2BnJ4DAW%2BgUod9rAEDcIy0%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14304,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14304, version 1.0","md5":"aa952242481dddcafa4d2fcc03383ae1","sha1":"4a162522c119ff3359ccdd5339e6a4eac9b30d28","sha256":"19bf1984956517c35c2bd35b6cdedac12a21d6fcd3596c614ecdfb88b648909d","sha512":"b2c0d33bcf3442eeb971d73ae23e6e49722a6723ae131e82781df5d64a98c5c42b8963ee1db4932b44599796245574c47540df4f36dde4e4d2448c11f4d5d4a5","ssdeep":"384:jjGOfsqrCZXYdZJ5K40kfXxdjNkyI1OO6sz:jjGObOZodj5prm1J6sz","tlshash":"dd52d1001602bb0e597abdbcb462851703a56aa83c12d749d04a3d22f85fbff228e757","first_seen":"2025-09-17T11:17:44.867625Z","last_seen":"2026-08-15T05:03:59.74014Z","times_seen":969,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":12,"dns":1,"connect":1,"send":0,"wait":10,"receive":1,"ssl":6},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}