{"report_id":"97a30bcc-9a48-4f31-8119-a104768dcf8a","version":6,"status":"done","tags":[],"date":"2026-03-06T10:09:29Z","url":{"schema":"http","addr":"renew-coinbase.com","fqdn":"renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.renew-coinbase.com/","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"title":"Sign in - Coinbase","dom":{"size":4896,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (353)","md5":"d2b2c264df3fba45e4fdb80984d217f0","sha1":"9c8290438cb392d876a81389c5083e445cc122ed","sha256":"be2c38c8792f013f76cb078ccd89a8fc6a20298a3f98c7becb934747485e5583","sha512":"789fe9de2dc01bf0344a7ec7ed3f78a3da74020e7a9bd20f936ea9ee7f9d94985c73b3c13c17b589b616b0bad08f872046adcf744da140dab6c5e609620717fe","ssdeep":"48:nCNSNBBLBstivKZ0BSAXTYJTNiXSIYJ2U3a3hpD0J5GNXUhiRF0ID1LdbZZZ/rZT:nJswvKZ01KrIUqRh0J5CkkRKIBrh","tlshash":"55a1a65161b3c4b95013c5245bfb6a283a8de02bd30aca683fdc4149df85be29d33b5c","dom_hash":"domhashf5e7db4e46565eec3e88ddd6004e7962","first_seen":"2026-03-06T09:50:20.019859Z","last_seen":"2026-03-06T11:07:34.326121Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"renew-coinbase.com","fqdn":"renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-10T10:09:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"renew-coinbase.com","ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-15","domain_rank":0,"first_seen":"2023-06-15T22:10:16Z","last_seen":"2023-07-01T14:22:24Z","alert_count":1,"request_count":1,"received_data":5536,"sent_data":487,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"www.renew-coinbase.com","ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-15","domain_rank":0,"first_seen":"2026-03-06T10:09:29.987536Z","last_seen":"2026-03-06T10:09:29.987536Z","alert_count":6,"request_count":6,"received_data":207147,"sent_data":2713,"comment":"","tags":null,"fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-01T22:18:12.522658Z","alert_count":0,"request_count":1,"received_data":10794,"sent_data":439,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.renew-coinbase.com/cb-panel/panel-client.js","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fea1bf148766a04c492b59dd77b51ee0","sha1":"f22b1d92147385b25daf046474ed25c285414177","sha256":"c299530cef1f1500a5e11a23c740879ce21d7766ce53c99adeebcebd67509a38","sha512":"28a9feb0a2db68b1205e8c0244397b3fa786b09c910b37d07827b15c691e3542afc8825bb123bb843c4605c7a9bf334ba8a9fcb3177e4429cf03e7646faca9a4","ssdeep":"384:ynrDkacp5aJD2lxj/nxEpmGd/TMAwE++Ls3:+rDkvrnxA7d/THwqI3","tlshash":"c2d24f3962b31065b233e16d6bdba10932237403b946ca543e9c72445fcda94a3f6ff9","size":29146,"data":"","first_seen":"2026-03-06T09:50:20.038858Z","last_seen":"2026-03-06T20:24:24.359732Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/socket.io/socket.io.js","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec127053f9c5cbfeeefd263b4b23bc0a","sha1":"11c08d7468ffe8980b0f862280c0c371776938a8","sha256":"bc425714aa8f2547d6939e3721ebafd3830a7562a1f6cb08acc1e794bd707954","sha512":"81ec905226bb2b6632f968b204f873331a4a75f24c0f27d50bb5ea930bec797a7c201eed1eaf1a9ef06cbbe923a722bb54fdcbf2be7147eea00d77a80565a39e","ssdeep":"3072:zLTygH4CO2KsFpWw0axS8RZIXyR7dSGg18FEEaLH32emV/Tfkmh0KbhEGtkSWq:zLTy7X1sFpWw0aTRrgaEEaLH32emV/D5","tlshash":"6ce35f49aaf72051917330398bafa045f239d01b620acd443d1cd7f49f65b3897aafe9","size":155836,"data":"","first_seen":"2026-01-01T23:52:44.961231Z","last_seen":"2026-08-05T21:42:30.855262Z","times_seen":366,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"22fb4550a1cf23dfeb7d27d4af6f4f6f","sha1":"e550270141009a0f180e58ab7a24267aa7779d98","sha256":"d922783094657d407415e3d04ad6b67f97e49a0880b5fcc075097c92615761e7","sha512":"0accc89fb038b25896b0258e26b591d016ec5a858fdb8cb808dc430fd31f5be889c94369598999496d3b6fa5a4c2f509f09024b813ba237a6519699e6bb4269c","ssdeep":"","tlshash":"00a002243583ed7d85d6055551a281d86451552313468140713d44584f552461f5b757","size":86,"data":"","first_seen":"2026-02-23T15:39:29.427915Z","last_seen":"2026-04-15T08:01:20.563562Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"renew-coinbase.com/","fqdn":"renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T10:09:08.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Fri, 06 Mar 2026 10:09:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nlocation: https://www.renew-coinbase.com/\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\nvary: Accept\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YJdDQDP28yTQdiwVmZd18cv2lD6oI3%2FyGXOI7vpGRrIgT90ZiYCMbCkKWzsAG%2FkIUlfeT8xQDxFJJRfWQH%2BFXObiFwLEX95XXuG74xA0X6bCLw%3D%3D\"}]}\r\ncf-ray: 9d809029efc13017-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":4916,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T01:00:56.500297Z","times_seen":17734268,"resource_available":true,"data":null}},"time_used":618,"timings":{"blocked":56,"dns":25,"connect":10,"send":0,"wait":505,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T10:09:08.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Mar 2026 10:09:09 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fBVq2S8%2Btz0vANTJ72P%2Fjc9tH4IoSzoiFkahxyuQxm6MZrKmKJLcYIYmEFhs713KHq3pviSrNQvoQ4CtGbalBxAPV7kNXoy19ag88IfTHFg8p8JdLPo%3D\"}]}\r\npriority: u=1,i=?0\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=0\r\nlast-modified: Thu, 05 Mar 2026 23:16:25 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 9d80902d78eb3e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]}],"data":{"size":4916,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (328)","md5":"fe2604e5ecc2077f41130f6b6cd68ebc","sha1":"730f61d084657f8f27f0910b9c1fa4e88ba3aaa2","sha256":"476ab1452d9e9fa2de0fad7b2a03899b02b930984936d258628a9f48ed87d9a1","sha512":"6730ba4bef0254f44b050014061edf5025620463fa0e27f128d92f8137cdbbaac044ba7aaf3c39ccebe6517e5ebfb3ecff2c4e5b09ce5847c841fe237cc91f71","ssdeep":"48:yNSNhBLBstivKZ0BSAXTYJTNiXSIYJ2U3a3hpD0JeGNXuiRF0ID/UdbZZZ/rZDgM:ZswvKZ01KrIUqRh0JeCZRKI+r2M","tlshash":"0ca1955661b3c4b9501385246bfb6a283a8de027d30aca683fdc5149df86be19d33b4c","first_seen":"2026-03-06T09:50:20.036161Z","last_seen":"2026-03-06T11:07:34.332402Z","times_seen":4,"resource_available":false,"data":null}},"time_used":541,"timings":{"blocked":33,"dns":0,"connect":0,"send":0,"wait":508,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/css/cb-common.css","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:09.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET /css/cb-common.css HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Mar 2026 10:09:09 GMT\r\ncontent-type: text/css; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kZrATklsKt1FZzTWAltzl7uDg1u%2FWhgkq4IgT%2FykveiiXG6F9gff2AfHGlIRXP1sy%2Fmr6TYjsozFO7VRBlbODSmUe72KSc7labtNy9Fn35L4RPxws6E%3D\"}]}\r\npriority: u=2,i=?0\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\nlast-modified: Sat, 21 Feb 2026 15:15:38 GMT\r\netag: W/\"2964-19c80c54590\"\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d809031c98e3e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10596,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"8f225b771370c0578a4dd5d40a7989cc","sha1":"e9d5be0d6b277d5fb7701cebb96e405a773208a8","sha256":"93792daa93373d6e2eaf57bba5ad8a4a0cca38e8a64737328c1aead401ed482f","sha512":"6542e932f4255b29a29a0ea03823f1c6a33a961daeea158f88bb039d39443943cb11d03cc0cc312a5d59ae11713672f8f7b96d051fd7d82c9485034cc31af4f7","ssdeep":"192:cbhU0qHsv7xBrnPPwah+I6W6PCPVykNHmw9OR9oM8kTm1KuoUqXgvx:8ST+","tlshash":"0a22117a662399507827d92c67ef8346321c7007b909dc2a7bc8b1484fcd2f9a191bfc","first_seen":"2026-03-06T09:50:20.03007Z","last_seen":"2026-03-06T20:24:24.35772Z","times_seen":6,"resource_available":false,"data":null}},"time_used":505,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":505,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/socket.io/socket.io.js","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:09.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET /socket.io/socket.io.js HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Mar 2026 10:09:09 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=14400\r\netag: \"4.8.3\"\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ofMfg9lXXC8oKUSJIefeQ4nG8pbGEPazwOZ25tTqre08EexMZuNvOIAJVWc%2BY3LDT33zoXZN70owHwGlnEAJgTRSkHAKEGMZRtL%2BnojlS95WbI%2B%2BI%2B4%3D\"}]}\r\ncf-ray: 9d809031c98f3e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155836,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"ec127053f9c5cbfeeefd263b4b23bc0a","sha1":"11c08d7468ffe8980b0f862280c0c371776938a8","sha256":"bc425714aa8f2547d6939e3721ebafd3830a7562a1f6cb08acc1e794bd707954","sha512":"81ec905226bb2b6632f968b204f873331a4a75f24c0f27d50bb5ea930bec797a7c201eed1eaf1a9ef06cbbe923a722bb54fdcbf2be7147eea00d77a80565a39e","ssdeep":"3072:zLTygH4CO2KsFpWw0axS8RZIXyR7dSGg18FEEaLH32emV/Tfkmh0KbhEGtkSWq:zLTy7X1sFpWw0aTRrgaEEaLH32emV/D5","tlshash":"6ce35f49aaf72051917330398bafa045f239d01b620acd443d1cd7f49f65b3897aafe9","first_seen":"2026-01-01T23:52:44.961231Z","last_seen":"2026-08-05T21:42:30.855262Z","times_seen":366,"resource_available":true,"data":null}},"time_used":496,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":488,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"www.renew-coinbase.com/socket.io/?EIO=4\u0026transport=websocket","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"104.21.60.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:10.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=websocket HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://www.renew-coinbase.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: Mut9fx9grcegTgq5Yaolmw==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Fri, 06 Mar 2026 10:09:10 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: /dUev8BsF5QBVNgIoYBYN5mekXQ=\r\nVary: Origin\r\nAccess-Control-Allow-Credentials: true\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=qX%2ByuRaNMpfzkmGYtFXTWrtwSOnCzFkI6BjcyvzMpPWdKitL9OJ0v5a%2Fc3LhRfL6Iitn2gnBiBqFmguVTQbIZNTDr%2FhZf8gP3zp1SrH1SgwUGuUeW3fgOzj1Q5yuQzf7SB7mwzuJpa%2Fc\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9d809036ba94527d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=7857\u0026min_rtt=7804\u0026rtt_var=2288\u0026sent=4\u0026recv=7\u0026lost=0\u0026retrans=0\u0026sent_bytes=2363\u0026recv_bytes=1208\u0026delivery_rate=360423\u0026cwnd=52\u0026unsent_bytes=0\u0026cid=4c972c2acb1d0b28\u0026ts=484\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T01:00:56.500297Z","times_seen":17734268,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":-1,"dns":39,"connect":46,"send":0,"wait":475,"receive":1,"ssl":57},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:09.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:01 GMT","end":"Mon, 27 Apr 2026 08:38:00 GMT"},"fingerprint":{"sha1":"AD:23:3E:9B:CF:2B:A1:EC:31:14:63:D1:58:73:BB:E7:C5:32:16:8C","sha256":"B1:5F:45:BF:00:8C:68:35:D3:42:B2:67:66:47:9D:BB:42:41:07:56:3A:C4:1C:D6:10:7B:B7:53:C2:71:81:33"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 06 Mar 2026 10:09:09 GMT\r\ndate: Fri, 06 Mar 2026 10:09:09 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-08-06T00:53:59.31813Z","times_seen":39421,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":85,"dns":1,"connect":21,"send":0,"wait":33,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/cb-panel/panel-client.js","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:09.408Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET /cb-panel/panel-client.js HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Mar 2026 10:09:10 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p5gSusXLQyoLYj%2B7k%2B%2F6RMePXEY1pJ6d3bg0EhvGPQZHQmccWyhRoeosComRIsexf3%2FpPUl1qoDH5UkwXaiAxKDOEtu%2BXfNTAbX2iWDsw6pEjh4oPK8%3D\"}]}\r\npriority: u=3,i=?0\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 05 Mar 2026 23:42:35 GMT\r\netag: W/\"71f6-19cc061b87a\"\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d809031c9903e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29174,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"fea1bf148766a04c492b59dd77b51ee0","sha1":"f22b1d92147385b25daf046474ed25c285414177","sha256":"c299530cef1f1500a5e11a23c740879ce21d7766ce53c99adeebcebd67509a38","sha512":"28a9feb0a2db68b1205e8c0244397b3fa786b09c910b37d07827b15c691e3542afc8825bb123bb843c4605c7a9bf334ba8a9fcb3177e4429cf03e7646faca9a4","ssdeep":"384:ynrDkacp5aJD2lxj/nxEpmGd/TMAwE++Ls3:+rDkvrnxA7d/THwqI3","tlshash":"c2d24f3962b31065b233e16d6bdba10932237403b946ca543e9c72445fcda94a3f6ff9","first_seen":"2026-03-06T09:50:20.038858Z","last_seen":"2026-03-06T20:24:24.359732Z","times_seen":6,"resource_available":true,"data":null}},"time_used":704,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":657,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.renew-coinbase.com/favicon.png","fqdn":"www.renew-coinbase.com","domain":"renew-coinbase.com","tld":"com"},"ip":{"addr":"172.67.201.206","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.renew-coinbase.com/","date":"2026-03-06T10:09:10.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renew-coinbase.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 18:59:17 GMT","end":"Tue, 02 Jun 2026 18:59:16 GMT"},"fingerprint":{"sha1":"56:AD:63:8C:4F:94:6E:B1:C3:BA:38:7F:58:7D:F8:BB:6F:7B:25:15","sha256":"51:2D:E6:CA:A3:19:A2:E4:CB:13:81:8C:B7:18:22:28:2D:FB:46:FC:36:1E:AE:59:D8:D5:D7:64:53:FE:2D:69"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: www.renew-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 06 Mar 2026 10:09:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 540\r\npriority: u=6,i=?0\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Sun, 22 Feb 2026 16:29:46 GMT\r\netag: W/\"21c-19c862f8090\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zJj%2BbExtV2cPFqIDj4QiK1viTJ4cM18b8V9c1FiMfsV20zn032jAR4uDFBOoKmabqmwQrDDJ0Z%2BRMgWexyRAwcfh2P23dsZ2qAF9VpatwD2ORvCoEzY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d8090364a703e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":540,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"6727bd8e51ddd89804d42af4827d5298","sha1":"a8e80ae5d89bc4b333471860ba867598537c0eed","sha256":"952272773be85a7a1f3c780894f87b7d3c88bce60adea26abd47f0bf2ca4bb92","sha512":"cbc0bf648fe179b28d089c2a7de3b420b48e413e44881bf3659cfd4a6f472d41845ab82193e6c67a28cc3d70b5eb062e3062a11b1c1df3096c41dd2473bd0e52","ssdeep":"","tlshash":"f5f07e87ba2b483b4aa904bdc32340f939aa2c1e4803880c8a633c4c19f03222a92303","first_seen":"2024-10-07T01:42:55Z","last_seen":"2026-05-23T22:44:01.018581Z","times_seen":19,"resource_available":false,"data":null}},"time_used":570,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":569,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"www.renew-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}