{"report_id":"9c3efa16-0c12-45c6-851f-2dd9f083d414","version":6,"status":"done","tags":[],"date":"2026-01-18T22:23:57Z","url":{"schema":"http","addr":"nadodex.com","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"nadodex.com/","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"title":"Nado DEX - Official Lending and Trading Platform for Crypto","dom":{"size":64970,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (560)","md5":"b6cd89823293244a811630980d4c8c25","sha1":"2597db62ecc16511ee47804a7c3c58b951d3a84f","sha256":"58e899d055f770e65d96c5426a1853e2dfef4aa4dab323cc2d5714e561b3435a","sha512":"e7779e14671d9639e96f7f8b5aa5fae3717e6f4b5f1fe648381d957f95b77808f6bf4123316998579d2c60110bf29e736d7e827f25569b16c08c3de07412ef5f","ssdeep":"384:Dg5ECS5rn0seJGoVylB8Ln9jFUwFcDsVzKC5yMnDtnSLZ8SDXEuJnz:Dg5E5nsLoen9jnuUK6vnRSLxjEuJz","tlshash":"a553552411f046b6098741e276605f6faa8caa8fe92bc5c4339ec7b51f8ec918c7365c","dom_hash":"domhashfe9f63f6531f80a64c1447e86f181b09","first_seen":"2026-01-18T22:24:01.486994Z","last_seen":"2026-01-18T22:24:01.486994Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"nadodex.com","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-22T22:23:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-18T22:14:28.232245Z","alert_count":0,"request_count":1,"received_data":37767,"sent_data":555,"comment":"","tags":null,"fingerprints":null},{"fqdn":"nadodex.com","ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-07","domain_rank":0,"first_seen":"2026-01-18T22:23:58.13013Z","last_seen":"2026-01-18T22:23:58.13013Z","alert_count":24,"request_count":12,"received_data":1156552,"sent_data":5525,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-18T22:17:29.309663Z","alert_count":0,"request_count":2,"received_data":6694,"sent_data":936,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nadodex.com/fonts/Aeonik-Bold.otf","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /fonts/Aeonik-Bold.otf HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/0315eb22872665d6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nc2NBR3iJu9EXFMTZuvC8Nl6g6sM0qqdvPqBV2pmfLXhwaiaaaQOwGvhhLeqEjo2mGb036s%2FPCO1P8WToHxC132xZFOd0AqLJQ%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f690dde56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":157,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/0315eb22872665d6.css","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /0315eb22872665d6.css HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\netag: W/\"6968ef3c-46cfd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F9XKVK5ENz2OS8rPA1GSbHe9KFKSbZZuOjQbNdKVuaC8uO1RKKV4DtHTW9mRfvWMod9IX4T03h8YYw%2FzreHL2RC9xsfIZi4z6Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c017f649d8b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":290045,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (46360)","md5":"60cecd27428305503628efd18f3e8a65","sha1":"c39b3ffa399b95271c1890130727baf26ab30b5d","sha256":"b254c292fcf909a4de026c8057d9c5d20bbb5af645b4a98850b55fd556ac0a95","sha512":"3c35cc259788e9b3d4772d623ec025eb03ab4158ace409f76dc0a418a9006578beb4b7e5e89dfbe7db4e018a2ab6114adec2cb7a5201d40d0152ef9da3a1b523","ssdeep":"6144:SBHHC/Tg0kHQZwgTghB4lEuq1W1fu2734wgCCCZMyVk7W1IhsFOQivSDAXphEY9R:SJC/TgKAN","tlshash":"5c54969dab52103f7c2740f6d169ad9cd12fa1c0ef2666fafd5216208ba17e72e53310","first_seen":"2026-01-18T22:24:01.496457Z","last_seen":"2026-01-18T22:24:01.496457Z","times_seen":1,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/fonts/Aeonik-Light.otf","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /fonts/Aeonik-Light.otf HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/0315eb22872665d6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5WBYdDnYgZYHuyzTQdndsVvPlIhQ24Skv%2BJU8mRgC0Od3bfku%2Fb3UmONU5noW5%2FlN62j%2Faf6mi6Y%2BG5I5JkszGVwqzbJXzEAKw%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f68fddb56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/qwerty.svg","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /qwerty.svg HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"6968ef3c-7ab\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X24OyPcWvGBAVnfPecFUmYWLVrLLYKZc9%2F%2FTa5u2fnJKU9dGgR5cmibOnhJdQrC%2ByOOh6l1tjg%2B1J0EeRgnxy1Xbg4rFiM45gA%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f649d8856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1963,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"20a6ea6007d9bd1bcebc4f00e625b752","sha1":"41fb1ecbfa6293849173217f83ecfd2632338e0e","sha256":"0dad66b9d646728721af7c05c32eb080512afc2a1705e65d394d4f5cd1f7206a","sha512":"457d708fdf866b58708dab0fa8a4c9b17cb99d4629a651e11b07bc1738df84b243c20e28d70ef9aff56599c629050bedf50e8c6ee1ba42732616a4e3b253adf2","ssdeep":"","tlshash":"004100feff68223d6046455ec3a3145c322df0261bc208b5c79f5d0a69159ae9fb7889","first_seen":"2026-01-18T22:24:01.499498Z","last_seen":"2026-06-18T12:25:44.518803Z","times_seen":10,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/homepage/flag_icons/coins_brighter.svg","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /homepage/flag_icons/coins_brighter.svg HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cL98VxRsgMLojnn1GidSJFjXQQ%2Fz2yYuWrlf4bhVHp3RYKDgDRW4XS23WRsEg8W%2Bu1w2dSoMvCncFqTllhyOdMZ3fH%2FS9%2By%2B7g%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f649d8956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=DM+Sans:wght@400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 18 Jan 2026 22:23:35 GMT\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2661,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"133c49d93c90ee2a37f0bc1925994575","sha1":"dc39271b772db50e087d2df87b05d76d633de31f","sha256":"bef84bf20a597f5dee644e4e04158b2602810fe705906cd0703c02b0338ee821","sha512":"6ab01451653fc35f661f3f25dd0aa026ca9d65e64da13127fb9809c12c0b0519375e424e64e2c0cc29882a73294fc3ac342fa9c3445d9431962da9ddbe54fff8","ssdeep":"","tlshash":"30519981046ba550eb971cc422cdbe62ef1fa15424549c74abfe188cacaac3d5362b8d","first_seen":"2025-09-11T17:08:25.90182Z","last_seen":"2026-08-05T17:50:02.430346Z","times_seen":2986,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":116,"dns":0,"connect":20,"send":0,"wait":38,"receive":0,"ssl":95},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/apple-touch-icon.png","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 1890\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\netag: \"6968ef3c-762\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vKTHHqN6%2FLzFb9NZrd2UqNxto%2FkmW9i0ppVGn9swBGbxdY0jom7wkmzfiKUlpQkI1lsH1ZmxfV21MK9G5B0ltb9tW6di0bbNLQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c017f68edd856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1890,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"b9b4f64d0e801f0035027e8001ce95f0","sha1":"7cee55acdcd8178538c36ac7d03c153ed477a354","sha256":"65ad1c00bf61b7c13318a8145df3040fef00926709d1846a8fffd3465433e3c6","sha512":"7482e3cbc3d49b2d0e712cf1e8e2c5eb47612f6fc34b7f58d5a595b3fa64b003fad9f4c5434897f03551488c2daefc9aef4d8257faf2accb002aee86c826f351","ssdeep":"","tlshash":"024119f31ef0396af8f73531751190e346972244009589d6cb93f3b465827032408e55","first_seen":"2026-01-14T17:34:37.689027Z","last_seen":"2026-03-04T13:22:08.438244Z","times_seen":9,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-18T22:23:34.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 18 Jan 2026 22:23:34 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uBLo1KwftTJMpZpgMZTTAsfQkX2BIWsviSbyy2A8%2BLIAk1ZGSrLxxuuYwJAzwx7YZAOi%2FAtCoQY7IHt8IHxxK5zO8K6sN73bU3V9\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c017f61b942c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":34,"dns":10,"connect":1,"send":0,"wait":272,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/0315eb22872665d6.css","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /0315eb22872665d6.css HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\netag: W/\"6968ef3c-46cfd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4VVyT%2F2fW1ymNJiaCgwooyEbgeMZLLEnu5nFFT3RzGQQaH0GfnXcLB7Kq1JVZVjmGpyY%2BxBC00Deipt9q5UCYqj49lDC%2FtXCCg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c017f649d8756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":290045,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (46360)","md5":"60cecd27428305503628efd18f3e8a65","sha1":"c39b3ffa399b95271c1890130727baf26ab30b5d","sha256":"b254c292fcf909a4de026c8057d9c5d20bbb5af645b4a98850b55fd556ac0a95","sha512":"3c35cc259788e9b3d4772d623ec025eb03ab4158ace409f76dc0a418a9006578beb4b7e5e89dfbe7db4e018a2ab6114adec2cb7a5201d40d0152ef9da3a1b523","ssdeep":"6144:SBHHC/Tg0kHQZwgTghB4lEuq1W1fu2734wgCCCZMyVk7W1IhsFOQivSDAXphEY9R:SJC/TgKAN","tlshash":"5c54969dab52103f7c2740f6d169ad9cd12fa1c0ef2666fafd5216208ba17e72e53310","first_seen":"2026-01-18T22:24:01.496457Z","last_seen":"2026-01-18T22:24:01.496457Z","times_seen":1,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":340,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/imgs/retrading%20on.webp","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /imgs/retrading%20on.webp HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W3fUX1uuk%2BiYmFLM0ygAGQy3%2B%2FcNRrzX1DptFUc8FsEj4jnv7S4Jppu738JwtxohVsQM5fLIc5TEKCMWu2f5%2FaPswxdtuQ217Q%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f649d8a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.585Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=DM+Sans:wght@400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 18 Jan 2026 22:23:35 GMT\r\ndate: Sun, 18 Jan 2026 22:23:35 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2661,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"133c49d93c90ee2a37f0bc1925994575","sha1":"dc39271b772db50e087d2df87b05d76d633de31f","sha256":"bef84bf20a597f5dee644e4e04158b2602810fe705906cd0703c02b0338ee821","sha512":"6ab01451653fc35f661f3f25dd0aa026ca9d65e64da13127fb9809c12c0b0519375e424e64e2c0cc29882a73294fc3ac342fa9c3445d9431962da9ddbe54fff8","ssdeep":"","tlshash":"30519981046ba550eb971cc422cdbe62ef1fa15424549c74abfe188cacaac3d5362b8d","first_seen":"2025-09-11T17:08:25.90182Z","last_seen":"2026-08-05T17:50:02.430346Z","times_seen":2986,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":98,"dns":0,"connect":20,"send":0,"wait":34,"receive":0,"ssl":78},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/fonts/Aeonik-Medium.otf","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /fonts/Aeonik-Medium.otf HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/0315eb22872665d6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FbQf6Yh0A0X86%2FrO1zTl%2Fn6aj0jBMoMUUU3Ke521TngLiUJADL9aqAaMmyl5akwCQmfKOo5u4idN44ZQOxLtU4JRublu3StJbA%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f68fddc56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/fonts/Aeonik-Regular.otf","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /fonts/Aeonik-Regular.otf HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/0315eb22872665d6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wyaV19qZqQykgIKAvZ6fWge7DEsiCo%2BOn8aUpiQe0YhpGcN%2FbbpCgpA0VWICEfcm%2FZIgw03yC8uLrvaNe7iosPqcYbrc4S6IxA%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c017f68fddd56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74266,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (321)","md5":"8744fb7d67cd9f2acef8942c6b8b8334","sha1":"c303676b0f75a4f09232a0081bee7ee01e5d7cd9","sha256":"7ac7bb259523bbfe846644f151b4c8d18ccba44eb74f2f85b8a79106574c8b18","sha512":"888f3b171d3d337fd66e6ef02a27b743a8618c7fb82b3ad6563ef663f4a7dade813560aaece20b413eb6e04c6330e888222022732d8b9474158a7e48b4f05602","ssdeep":"384:DeSdoULrB0qgfGwVuZBWLd9v9UgPcNc3JKW5k2nVp7SLRUgxfhu16VKZ8M:DeSdfB8v8Ud9vtkiKWPnnmLnJUOKN","tlshash":"ec73545011f046f6098b41b276615b1fab8cab8fe52bd5c833aec6b11f8ec918c7365c","first_seen":"2026-01-18T22:24:01.492926Z","last_seen":"2026-01-18T22:24:01.492926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nadodex.com/favicon.svg","fqdn":"nadodex.com","domain":"nadodex.com","tld":"com"},"ip":{"addr":"172.67.223.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nadodex.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 17:35:08 GMT","end":"Wed, 08 Apr 2026 18:35:06 GMT"},"fingerprint":{"sha1":"2D:51:5A:0C:D6:0F:3B:0D:DB:A5:43:D9:23:C8:AD:82:D1:F9:2C:C9","sha256":"78:5F:72:9C:E8:5F:80:AF:25:3C:4D:D6:4D:FB:FC:40:9B:54:DB:1C:1E:93:DA:21:11:FF:D2:B7:8C:DC:81:EE"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: nadodex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nadodex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 22:23:36 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Thu, 15 Jan 2026 13:44:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"6968ef3c-a4b1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q5AH7gfi%2BfpiMxPPOGLxD8BtyKP%2FyQ2goUkMlpsXEWqYj42lxqz0t7omc6n%2FByBG6FakodkEBeldd7h4exKyfOiqVqlvfQwcbA%3D%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-ray: 9c017f68edd956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42161,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e70481e21eb43c6955d77ab3606172bb","sha1":"c484b3faa7be2dacbe02746b41e66715fce82f74","sha256":"35149cd1838059affd823ac58fb8a5c19a85dc4d072aa272cefa61b906461616","sha512":"b917fb9df473d62950d53ee1173931f31b5847d2794aa13a33e79882ba85088967698ddc5e1abce76c06d614badcdb0d18a02ae612aa8aba0486d88d0881c275","ssdeep":"768:lJOV9sTjMJ0DnYdBhOq89NbzpcO5N08GEIc5WfVVqQF/Hfrh3kA:3ESjMJGu89Jt5NxWfVVDF/pZ","tlshash":"3613e0e41f29009b3641623b3e268df935ac2164f23d8685f71ed066beec4b41b6d1d7","first_seen":"2026-01-14T17:34:37.681423Z","last_seen":"2026-03-04T13:22:08.446137Z","times_seen":9,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"nadodex.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nadodex.com/","date":"2026-01-18T22:23:35.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://nadodex.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:25 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:25 GMT\r\ncache-control: public, max-age=31536000\r\nage: 100990\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-05T22:01:57.297709Z","times_seen":32703,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":54,"dns":1,"connect":8,"send":0,"wait":9,"receive":9,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}