{"report_id":"a010b9d0-b452-4276-bffa-fd0862ce081a","version":6,"status":"done","tags":[],"date":"2025-09-28T12:38:56Z","url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"title":"Troll Token - Market Cap Comparison"},"submit":{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-02T12:38:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2025-09-21T22:11:31.798564Z","alert_count":0,"request_count":1,"received_data":9481,"sent_data":558,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"airdrop-trololol.io","ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-26","domain_rank":0,"first_seen":"2025-09-28T12:38:57.609434Z","last_seen":"2025-09-28T12:38:57.609434Z","alert_count":12,"request_count":6,"received_data":42736287,"sent_data":3087,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"corsproxy.io","ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-30","domain_rank":175528,"first_seen":"2016-05-19T01:27:08Z","last_seen":"2025-09-22T23:25:59.03212Z","alert_count":0,"request_count":2,"received_data":4254,"sent_data":1089,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-25","domain_rank":0,"first_seen":"2025-09-28T09:07:21.542093Z","last_seen":"2025-09-28T09:07:21.542094Z","alert_count":14,"request_count":7,"received_data":346400,"sent_data":5029,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"airdrop-trololol.io/config.php?s=%2F%40v1%2Fcdn%2Fjs%2Ftar.cjs.cjs.js\u0026t=29317718","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"976137eeace4acbde2245db9e00039c6","sha1":"ef98bf559dd0507833e84eb5981abae0fedf3ce9","sha256":"ed16cc3cba9ae0625dd5322db16d3796c606401dd40ffefad3bdf70ccb6ab106","sha512":"afb7caa6fe93ad65d033f282a77eb9588507a8dc567921fcbf60b0ef0184c2090e44b5d9c5608474e478e7bbbd95a1c9d1944d28e4bde9f1552828be5a698f3f","ssdeep":"6144:Us6RWbpP47Mhk6p1ZsJzO3fXeIZHnwufOICuL:R68tPseWCvXeIZeIRL","tlshash":"83748c917280617916634f9a41bf094ab238f5207409492cf79cc8d32bb99dad5bff7c","size":340017,"data":"","first_seen":"2025-09-27T18:38:15.252444Z","last_seen":"2025-09-29T22:10:20.160704Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/cdn/js/tar.cjs.cjs.js?t=29317718","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"976137eeace4acbde2245db9e00039c6","sha1":"ef98bf559dd0507833e84eb5981abae0fedf3ce9","sha256":"ed16cc3cba9ae0625dd5322db16d3796c606401dd40ffefad3bdf70ccb6ab106","sha512":"afb7caa6fe93ad65d033f282a77eb9588507a8dc567921fcbf60b0ef0184c2090e44b5d9c5608474e478e7bbbd95a1c9d1944d28e4bde9f1552828be5a698f3f","ssdeep":"6144:Us6RWbpP47Mhk6p1ZsJzO3fXeIZHnwufOICuL:R68tPseWCvXeIZeIRL","tlshash":"83748c917280617916634f9a41bf094ab238f5207409492cf79cc8d32bb99dad5bff7c","size":340017,"data":"","first_seen":"2025-09-27T18:38:15.252444Z","last_seen":"2025-09-29T22:10:20.160704Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/websocket.theme.cjs.js","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b8c20b5db8b9f90369dc0fc0984346d","sha1":"5063469c4979e7c03f33401844de3b5b7ec50483","sha256":"51e3355e656760a0f6a4da53bc68d44d862f66eaacef407601030ddf03b9543c","sha512":"be4d446524ba165a9036eac802351fde180842764a7f9319b20a274f1ddf4c9636169291253d046d21ba65494b41a4f71663550fb595f7e8622322745579b736","ssdeep":"3072:tpcYbDaEGNPW/2vz1eC3fOx9YVy+CChvIVn+00ycXHCFREip:tptD3Gc/2BrOx9YVyshvIs2","tlshash":"2e740ccf2c927435c37187f3aa199146a4b05be90ac50afbf91297b0e1d854ea1ff2d1","size":340920,"data":"","first_seen":"2025-09-28T12:37:41.927721Z","last_seen":"2025-09-28T12:39:00.963611Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"d1947800d3f6067e3c08ddfd739a553c","sha1":"f03e59f155902fe3d553276c0b73722912ed841c","sha256":"fe93dcaf61e2735b6db561757c4c4cebd26ee9f0db5f4ba460a189808617a126","sha512":"7ff0807877087b211db3e0d3c9a19c8d5baeaeda5c23720bb61631a924d069255ebceb9be5ec1cbadf093669f29edffdb27a3e2a78b4bf1692de999cb658365d","ssdeep":"3072:23UO5Rgmg3VSt9gVy+SYPhWppE0e4+/xkTL2gz:23ZEZSt9gVyqPhWWe","tlshash":"c8640acf2d923831c37187f3aa199146e4b05be846c51afbf9229770a1d854ea2ff1d1","size":334504,"data":"","first_seen":"2025-09-28T12:37:41.969093Z","last_seen":"2025-09-28T12:39:00.966449Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"airdrop-trololol.io/config.php?s=%2F%40v1%2Fcdn%2Fjs%2Ftar.cjs.cjs.js\u0026t=29317718","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:33.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"GET /config.php?s=%2F%40v1%2Fcdn%2Fjs%2Ftar.cjs.cjs.js\u0026t=29317718 HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WwXyo2VfUMysntUSfke95bMTbcRcYx2gMpLl3Epb8gqE0RnL1CMYf7GdKz%2BnMVDdORVntqZCbgKgDboIvF5%2FOe1RYII2CbzZlcTySD6ZM2Jg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 3600\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 98634c6cccb50afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340017,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65428)","md5":"976137eeace4acbde2245db9e00039c6","sha1":"ef98bf559dd0507833e84eb5981abae0fedf3ce9","sha256":"ed16cc3cba9ae0625dd5322db16d3796c606401dd40ffefad3bdf70ccb6ab106","sha512":"afb7caa6fe93ad65d033f282a77eb9588507a8dc567921fcbf60b0ef0184c2090e44b5d9c5608474e478e7bbbd95a1c9d1944d28e4bde9f1552828be5a698f3f","ssdeep":"6144:Us6RWbpP47Mhk6p1ZsJzO3fXeIZHnwufOICuL:R68tPseWCvXeIZeIRL","tlshash":"83748c917280617916634f9a41bf094ab238f5207409492cf79cc8d32bb99dad5bff7c","first_seen":"2025-09-27T18:38:15.252444Z","last_seen":"2025-09-29T22:10:20.160704Z","times_seen":26,"resource_available":true,"data":null}},"time_used":617,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":614,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:34.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 23:42:06 GMT","end":"Thu, 25 Dec 2025 00:42:04 GMT"},"fingerprint":{"sha1":"0C:CD:24:B7:B0:CE:FE:13:D4:74:92:88:E5:8A:19:06:1B:6E:63:58","sha256":"0A:01:7A:C2:3C:74:E6:03:26:29:BB:69:4E:28:E2:F1:01:93:57:7A:C8:02:E9:3E:47:23:C2:D6:66:65:DA:08"}}},"request":{"raw":"OPTIONS /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://airdrop-trololol.io/\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncf-ray: 98634c70ee32a0f0-OSL\r\ncache-control: no-store, no-cache, must-revalidate, private, max-age=0, s-maxage=0, proxy-revalidate, no-transform\r\nexpires: 0\r\nvary: *, Accept-Encoding\r\npragma: no-cache\r\naccess-control-allow-credentials: false\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nsurrogate-control: no-store\r\nx-cache-buster: 1759063114409_oumkgt1\r\nx-request-id: 0a9c38e1-1313-4d47-9e36-101c88646006\r\nx-timestamp: 1759063114409\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=375jfM%2B03j7sc6wQzX8%2F7i4%2BOV0QzBnveG8G%2BVpoSEyELkQZjs47aS2rgBdSRgG7GqMoRToMxtYHYcZEC%2BT%2B7m3SrH0l4FPj1cRL78UG6i%2FL78UCFS7gou3YU1BNZQ%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1847\u0026min_rtt=1281\u0026rtt_var=1296\u0026sent=7\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3182\u0026recv_bytes=1178\u0026delivery_rate=2162269\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=af4d2f095b7f0fab\u0026ts=39\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":11,"dns":1,"connect":1,"send":0,"wait":70,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/services/connector?referrer=airdrop-trololol.io","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"OPTIONS /@v1/services/connector?referrer=airdrop-trololol.io HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: authorization,x-auth-key,x-direction-safe,x-scale-referrer\r\nReferer: https://airdrop-trololol.io/\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:35 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OVnfLxDdDH%2Bqw3Xhhjnl%2FEpBLyS%2Bq8ctEFgOSWmvdWITHqQv0wy1a%2FyN64da47R8bpcWiZtmcNLC%2BOusCGb6AKF6fC%2Bi4h%2FOZ07hTLroL23h8EmbncR%2B82F%2FG6jMale432U%3D\"}]}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 98634c75ecc75685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":580,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/services/temp-link/create?referrer=airdrop-trololol.io","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"OPTIONS /@v1/services/temp-link/create?referrer=airdrop-trololol.io HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-auth-key,x-auth-key-v2,x-direction-safe,x-scale-referrer\r\nReferer: https://airdrop-trololol.io/\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:35 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BW84BARd9316fFadIC1sEkBay%2ByGJH9lIYnVQb808mB3QVuYMdsEfY8YMpUcszI4yYRzg3wlgfWwyhUZfj9Pgs2tjZ3oqFrdFR0EywZgBDUVk7BLROZv%2Fv9lj9p0HG0OdaU%3D\"}]}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 98634c75dcc65685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":359,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-28T12:38:32.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 28 Sep 2025 12:38:32 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 26 Sep 2025 23:19:23 GMT\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b1FEnY6I6iwWEd3X3bFJc2VtlwgsyUcjicGnWRWDk0QyNTJFzystQyWHr5xjXs6ILarA8Wf7J2WIsjsCO43GI%2FpZVA7Yzu8cHzVcnmdHNuXt\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 98634c62aec056af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14017184,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65498)","md5":"8adb5112f85e9337868aeb05a4248f4b","sha1":"3a06e0fa4763d614723050400a69c093aa1f6de0","sha256":"cb290fd5dba645feb3f97a8bf77b976e358dd2162b21dc2a26029b36cc8beb39","sha512":"054e44937e3103ba41bc0d4adbefae0a0040b1feaec68476aa006667eac9449e567b381845434266281a2edd04bca004348aa68b3c31e1dfd271f671a070b059","ssdeep":"24576:4/XQOzRufMUjO/XQOzRu4/XQOzRuK/XQOzRw:4/vMjO/vL/vB/v6","tlshash":"2225127a69292c3f2c6348f3a0855dde4639f2c0da339ce5a743212246ea7f63477a54","first_seen":"2025-09-28T12:39:00.94359Z","last_seen":"2025-09-28T12:39:00.94359Z","times_seen":1,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":12,"dns":1,"connect":1,"send":0,"wait":153,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:32.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:32 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nlast-modified: Fri, 26 Sep 2025 23:19:23 GMT\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2qG0D30pD4z9MbT%2FhTIErG5Q0MgDXu4IZsouEE4qZivwrdBJKM%2FPY39xXaeL9LWZJySxkj55maWjSjqy5aWWwoUOOAaDMWq2VKQ2XY5uQUat\"}]}\r\nvary: Accept-Encoding\r\ncf-ray: 98634c650c240afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14017184,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65498)","md5":"8adb5112f85e9337868aeb05a4248f4b","sha1":"3a06e0fa4763d614723050400a69c093aa1f6de0","sha256":"cb290fd5dba645feb3f97a8bf77b976e358dd2162b21dc2a26029b36cc8beb39","sha512":"054e44937e3103ba41bc0d4adbefae0a0040b1feaec68476aa006667eac9449e567b381845434266281a2edd04bca004348aa68b3c31e1dfd271f671a070b059","ssdeep":"24576:4/XQOzRufMUjO/XQOzRu4/XQOzRuK/XQOzRw:4/vMjO/vL/vB/v6","tlshash":"2225127a69292c3f2c6348f3a0855dde4639f2c0da339ce5a743212246ea7f63477a54","first_seen":"2025-09-28T12:39:00.94359Z","last_seen":"2025-09-28T12:39:00.94359Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1903,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":162,"receive":1741,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=Montserrat:ital,wght@0,100..900;1,100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:34.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Sep 2025 08:36:49 GMT","end":"Mon, 01 Dec 2025 08:36:48 GMT"},"fingerprint":{"sha1":"9E:38:51:02:B6:22:9C:08:6B:24:B8:A0:EB:DB:60:D9:27:B2:68:90","sha256":"67:AF:7E:56:AB:8D:96:FB:D0:75:CA:28:6D:16:B6:67:FD:7F:58:6F:CC:AA:78:B5:01:13:76:2C:AB:BE:80:4E"}}},"request":{"raw":"GET /css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=Montserrat:ital,wght@0,100..900;1,100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 28 Sep 2025 12:38:34 GMT\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8795,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"51955a067b2f96efe49c2412a4c8c713","sha1":"44103446803299fdae2aa9fdf4c21af4e90fe450","sha256":"2598c04bc6015e0fdad9381928b8238d997efd88a0e450042a60e9d59435f915","sha512":"ca70f49f25ca02d0491518a04e3fdd3c9cb9d35a573ecae94d1bf8fe184ee1ceb53b623b4ba9bf2faf7ee4e321d30fb57954326ac064cdd7605b031355ef680b","ssdeep":"192:vywfydyGy63gy/yFVyR73xpmj3U8fHiyYwyNFyuy3uySRk73vO6u8:vtfcHjg8ciIShwCFnbL8B","tlshash":"2002ff91056be504ea431cc627cf7e369e8e62667081d1797ffe2cd9aceac22132475c","first_seen":"2025-09-11T02:59:26.857486Z","last_seen":"2026-08-17T03:00:31.193382Z","times_seen":928,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":152,"dns":0,"connect":77,"send":0,"wait":32,"receive":0,"ssl":76},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/log/join","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"OPTIONS /@v1/log/join HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-device,x-scale-referrer\r\nReferer: https://airdrop-trololol.io/\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:35 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bo86glOscHwO2biTVVdCOjwth2NB8y3Iw%2BPAnUWFKwzuF6aU1gQhn%2BnbwFKVwTY9M861tj%2Bwlc812sXS9FY8TyzB6vIgLLil0ueS7Jt8MoGSyPSdmk%2BztG9MFgE8Cxjwf9I%3D\"}]}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 98634c751cb95685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":138,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/log/join","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"POST /@v1/log/join HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nx-scale-referrer: airdrop-trololol.io\r\nauthorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcklkIjoiQncwU1FEWld3bSIsImdyb3VwX2lkIjo1NTMsImlhdCI6MTc1ODkwNjM3OH0.nwSGLn4vamJEDyPP604xjhzpBMbsbjAARXJfHv7B4do\r\nx-device: 0:Windows:Firefox\r\nContent-Length: 2\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:36 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nfQ7YIIDipM0vWCzy9%2BkQKH2fHcSIf88%2BueHb14nzpkwOQz5cMYzkj4EAYdFCgHNJyIeHEQ6VgryQsGm%2FJ5qQ98NTPTNfYhkBqvly5yUQaONm%2BFkhSzqxgpuBW5VeX8byEg%3D\"}]}\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 98634c765ccf5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":787,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":787,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/services/connector?referrer=airdrop-trololol.io","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"GET /@v1/services/connector?referrer=airdrop-trololol.io HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcklkIjoiQncwU1FEWld3bSIsImdyb3VwX2lkIjo1NTMsImlhdCI6MTc1ODkwNjM3OH0.nwSGLn4vamJEDyPP604xjhzpBMbsbjAARXJfHv7B4do\r\nX-Direction-Safe: 1759063115179\r\nX-Scale-Referrer: airdrop-trololol.io\r\nX-Auth-Key: Owuqlb2PXEd4%2FTnyGZmt0bFQpwtFhPYewF3OatZI9VA%3D\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gIsbKpLL7UDneDqL4qp%2Blq1bk4%2BmQIXnGuoYOsPrDiYjdYESGzIaGYd8iUaA%2F2SW6bnohvtPAMC%2BFO6ai%2FrYg%2FqNfDxdI8yfMUaUFF7fZyEAmINWeHOmHfzSFtDYb3t0Jy8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Origin, Accept-Encoding\r\netag: W/\"193-8rrvsWOtf7xjlHOkm3arRhv9h+U\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 98634c798d095685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":403,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9314d3e16d94ef19b915dc2f6b24d9b2","sha1":"f2baefb163ad7fbc639473a49b76ab461bfd87e5","sha256":"0a99aef28ec4c428535fd0006f52702a5207d170b763e05466435cba0cfbb513","sha512":"c27ebd8b02a3ba67dd1db65236ff84d8142a6457d3cf094c802e0d01e5005bace9a8ba569efaf9c382bd479937748ed35ecc8f8b6df7bdd00f7d049f996c5ae1","ssdeep":"","tlshash":"93e0f14bc4d8c2163edc3aa6eb72bb66007664aa38afca0429d183e4cd72d525242f00","first_seen":"2025-09-28T12:39:00.95157Z","last_seen":"2025-09-28T12:39:00.95157Z","times_seen":1,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":972,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:32.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://airdrop-trololol.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:32 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nlast-modified: Fri, 26 Sep 2025 23:19:23 GMT\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vwzt4s2OR3etbmcRcOShusEOHN9Z78DIz6PiYWb2NKahvetAAXLjQ8FEqtK%2FKJ7Q999pZNbk9Y5csZPOZdP7wPYS0KUXLDWxXDExoUuBQ1aq\"}]}\r\nvary: Accept-Encoding\r\ncf-ray: 98634c64dc230afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14017184,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65498)","md5":"8adb5112f85e9337868aeb05a4248f4b","sha1":"3a06e0fa4763d614723050400a69c093aa1f6de0","sha256":"cb290fd5dba645feb3f97a8bf77b976e358dd2162b21dc2a26029b36cc8beb39","sha512":"054e44937e3103ba41bc0d4adbefae0a0040b1feaec68476aa006667eac9449e567b381845434266281a2edd04bca004348aa68b3c31e1dfd271f671a070b059","ssdeep":"24576:4/XQOzRufMUjO/XQOzRu4/XQOzRuK/XQOzRw:4/vMjO/vL/vB/v6","tlshash":"2225127a69292c3f2c6348f3a0855dde4639f2c0da339ce5a743212246ea7f63477a54","first_seen":"2025-09-28T12:39:00.94359Z","last_seen":"2025-09-28T12:39:00.94359Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1925,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":178,"receive":1747,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:34.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 23:42:06 GMT","end":"Thu, 25 Dec 2025 00:42:04 GMT"},"fingerprint":{"sha1":"0C:CD:24:B7:B0:CE:FE:13:D4:74:92:88:E5:8A:19:06:1B:6E:63:58","sha256":"0A:01:7A:C2:3C:74:E6:03:26:29:BB:69:4E:28:E2:F1:01:93:57:7A:C8:02:E9:3E:47:23:C2:D6:66:65:DA:08"}}},"request":{"raw":"POST /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://airdrop-trololol.io/\r\nContent-Type: application/json\r\nContent-Length: 130\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\ncf-ray: 98634c716f10a0f0-OSL\r\ncf-cache-status: DYNAMIC\r\nallow: OPTIONS, POST, GET\r\ncache-control: no-store, no-cache, must-revalidate, private, max-age=0, s-maxage=0, proxy-revalidate, no-transform\r\ncontent-encoding: gzip\r\nexpires: 0\r\nvary: *, Accept-Encoding\r\npragma: no-cache\r\naccess-control-allow-credentials: false\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nsurrogate-control: no-store\r\nx-cache-buster: 1759063114658_9q2ev3n\r\nx-cache-status: DYNAMIC\r\nx-client-country: NO\r\nx-client-ip: 81.95.81.194\r\nx-original-url: https://api.mainnet-beta.solana.com/\r\nx-proxy-contact: support@corsproxy.io\r\nx-proxy-mode: cloudflare-snippets\r\nx-proxy-region: unknown\r\nx-proxy-response: true\r\nx-proxy-service: CORS Proxy\r\nx-proxy-time: 182ms\r\nx-proxy-version: 2.1.1\r\nx-proxy-website: https://corsproxy.io\r\nx-ratelimit-conn-limit: 40\r\nx-ratelimit-conn-remaining: 39\r\nx-ratelimit-connrate-limit: 40\r\nx-ratelimit-connrate-remaining: 39\r\nx-ratelimit-endpoint-limit: unlimited\r\nx-ratelimit-endpoint-remaining: -1521\r\nx-ratelimit-limit: 1000\r\nx-ratelimit-method-limit: 30\r\nx-ratelimit-method-remaining: 29\r\nx-ratelimit-pubsub-limit: 5\r\nx-ratelimit-pubsub-remaining: 5\r\nx-ratelimit-remaining: 999\r\nx-ratelimit-reset: 2025-09-28T13:38:34.658Z\r\nx-ratelimit-rps-limit: 100\r\nx-ratelimit-rps-remaining: 99\r\nx-ratelimit-tier: free\r\nx-report-abuse: abuse@corsproxy.io\r\nx-request-id: e5de07e5-9393-45c8-8134-0d4afb4bc5e5\r\nx-rpc-node: fra59\r\nx-timestamp: 1759063114658\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=owLB3bSgnuX1yTrrxif3j1Q7JX9O1aNKJi4t6IclZ8bqY0QEZDriOHfDM5NWYceLhDGgBRFV92btqrvrTf%2FsHrEn1B%2B7xQwXUIWA5CWQr7wrLy5phD8kPVUvifZmFQ%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=6903\u0026min_rtt=1281\u0026rtt_var=11085\u0026sent=9\u0026recv=11\u0026lost=0\u0026retrans=0\u0026sent_bytes=4227\u0026recv_bytes=1450\u0026delivery_rate=2162269\u0026cwnd=255\u0026unsent_bytes=0\u0026cid=af4d2f095b7f0fab\u0026ts=321\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":318,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e1577b364e8070f202dc24c1253832b8","sha1":"6c63b351959c72373b52dbed974e6b30cfe6a5e7","sha256":"ecc1b8223d8ac9796fd98901c5d7df3fc27b84075dc1a4eb66c37b8a212b8a99","sha512":"c66ae030d2942cc995e860b44f8b5b8c1f7da1003394b77612858d2ec55b30f48857b9b2b0eb7fb02009709eb04df56b5c10d5d455a27eb7018adae44f4e9764","ssdeep":"","tlshash":"b0e07d407e090bbd51a2ce278216419baa86346e43008a4b17e8066431d59de944b977","first_seen":"2025-09-28T12:39:00.955241Z","last_seen":"2025-09-28T12:39:00.955241Z","times_seen":1,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/cdn/js/tar.cjs.cjs.js?t=29317718","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:34.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"GET /@v1/cdn/js/tar.cjs.cjs.js?t=29317718 HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncontent-type: text/javascript\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, Origin, Accept-Encoding\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncontent-disposition: attachment; filename=tar.cjs.cjs.js\r\netag: W/\"53031-75i/VZ3QUHgz6E61mBq64P7fPOk\"\r\nx-cache-status: MISS\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qwYYHBWpVOUyaKWR5rJt%2BGPlaTa7QFL45y9ffUOp1MJIbKkSac91os8yCdZfW24MH8rf7LmKeB%2BAwu%2BufNjf2Kgf4DUXjfBKzXDxek3hC7PWW0X3f950TZSYO5BzgMMLQTs%3D\"}]}\r\ncf-ray: 98634c72fd9756ba-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340017,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65428)","md5":"976137eeace4acbde2245db9e00039c6","sha1":"ef98bf559dd0507833e84eb5981abae0fedf3ce9","sha256":"ed16cc3cba9ae0625dd5322db16d3796c606401dd40ffefad3bdf70ccb6ab106","sha512":"afb7caa6fe93ad65d033f282a77eb9588507a8dc567921fcbf60b0ef0184c2090e44b5d9c5608474e478e7bbbd95a1c9d1944d28e4bde9f1552828be5a698f3f","ssdeep":"6144:Us6RWbpP47Mhk6p1ZsJzO3fXeIZHnwufOICuL:R68tPseWCvXeIZeIRL","tlshash":"83748c917280617916634f9a41bf094ab238f5207409492cf79cc8d32bb99dad5bff7c","first_seen":"2025-09-27T18:38:15.252444Z","last_seen":"2025-09-29T22:10:20.160704Z","times_seen":26,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":11,"dns":0,"connect":2,"send":0,"wait":190,"receive":0,"ssl":8},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com/@v1/services/temp-link/create?referrer=airdrop-trololol.io","fqdn":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","domain":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","tld":"com"},"ip":{"addr":"104.21.6.76","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:35.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 14:56:00 GMT","end":"Wed, 24 Dec 2025 15:51:13 GMT"},"fingerprint":{"sha1":"E4:30:27:2E:1E:2D:BD:51:78:FC:D0:9C:88:0C:64:7F:62:80:D3:EC","sha256":"09:C6:57:79:77:CB:77:8C:ED:52:12:16:47:2F:42:DA:58:9D:6D:F9:1B:68:9D:FF:1C:46:7A:40:B8:3E:39:84"}}},"request":{"raw":"POST /@v1/services/temp-link/create?referrer=airdrop-trololol.io HTTP/1.1\r\nHost: asp90ksyuqlqsuilshzxoqwopg1ksayw.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nAuthorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcklkIjoiQncwU1FEWld3bSIsImdyb3VwX2lkIjo1NTMsImlhdCI6MTc1ODkwNjM3OH0.nwSGLn4vamJEDyPP604xjhzpBMbsbjAARXJfHv7B4do\r\nX-Direction-Safe: 1759063115170\r\nX-Scale-Referrer: airdrop-trololol.io\r\nX-Auth-Key: NV%2FmcEBAro5t%2Bgicx465FknFBC115xGZU04cRJnuaBY%3D\r\nX-Auth-Key-V2: 028062TXRsITou9LrEvG8jsMhQVUM%2BOhVDURfVzgMic%3D\r\nContent-Length: 1714\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vh5JwBUGcErcmgd3wyztYYmHaecbCYOIfcwmXNVKdPPs1S%2FhNKABx0BNTxBrDE4q0u7JP3kTLH4ZJcAcs%2F4zgrBMaEoWy2HDG8osnOT%2Fh4qVGPAjGZUFfHhbtEWscS%2BkfEU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Origin, Accept-Encoding\r\netag: W/\"254-UsH0CBpK/i7iqUYA9rKuqxlCoA4\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-expose-headers: *\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 98634c781cef5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":596,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b4b09abab1c238f3149a9797164463a5","sha1":"52c1f4081a4afe2ee2a94600f6b2aeab1942a00e","sha256":"6414f7c1c7aca8b80de289e1e4c85c86db5ffbd5febffb3293bd46adc41d1ce5","sha512":"cd8754426b4865e78a6009aedb23a5d514ceecded688ad1af145c28b7f6d83d175ecbed2319ccf88d7d97ea2516f503ef06e6d3484901dcc1fc8b5358886a633","ssdeep":"","tlshash":"d6f041701600826efcf7649dddcae6f02217480d8296dad88fc220e4e4deacc74cae30","first_seen":"2025-09-28T12:39:00.95863Z","last_seen":"2025-09-28T12:39:00.95863Z","times_seen":1,"resource_available":false,"data":null}},"time_used":862,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":862,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"asp90ksyuqlqsuilshzxoqwopg1ksayw.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/config.php?s=%2F%40v1%2Flog%2Fjoin","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:34.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"POST /config.php?s=%2F%40v1%2Flog%2Fjoin HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nx-scale-referrer: airdrop-trololol.io\r\nauthorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcklkIjoiQncwU1FEWld3bSIsImdyb3VwX2lkIjo1NTMsImlhdCI6MTc1ODkwNjM3OH0.nwSGLn4vamJEDyPP604xjhzpBMbsbjAARXJfHv7B4do\r\nx-device: 0:Windows:Firefox\r\nContent-Length: 2\r\nOrigin: https://airdrop-trololol.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:34 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JYuG6uKzs3tEc1bxKqmkbR2Jc0GE5MPd1jodxFtj0aY8r72n5DVZaD65ZZnARY9cqkmYffSQ2TGrJ2mfpa9ezV2AG890S9TqljZ1DKeBHaOg\"}]}\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 3600\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 98634c70bcd70afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T09:43:02.208337Z","times_seen":17933663,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop-trololol.io/websocket.theme.cjs.js","fqdn":"airdrop-trololol.io","domain":"airdrop-trololol.io","tld":"io"},"ip":{"addr":"104.21.94.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop-trololol.io/","date":"2025-09-28T12:38:32.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"airdrop-trololol.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 22:27:15 GMT","end":"Thu, 25 Dec 2025 23:25:48 GMT"},"fingerprint":{"sha1":"AB:DC:81:81:8B:58:BA:1F:C0:FC:F6:08:00:CD:4A:F2:DC:9C:43:27","sha256":"78:03:1A:F0:AE:D1:DC:3E:7F:96:BF:2F:CD:7D:EC:0B:4D:D9:7D:B7:D1:FF:2B:F2:83:44:39:E0:54:87:52:31"}}},"request":{"raw":"GET /websocket.theme.cjs.js HTTP/1.1\r\nHost: airdrop-trololol.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop-trololol.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 28 Sep 2025 12:38:32 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 26 Sep 2025 23:15:21 GMT\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"68d71e89-533b8\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HDJIJ1Zy%2BpysxFS1DLxMrZqfIP15l9YIZc%2FsJGvWKcylvNdRK%2Bmp3VpzTUSjbDoSTU7SeQC3iQm9NoO5WjUT%2BQZt%2BbtVoeUEAVeQVwPxeQ%2BN\"}]}\r\ncf-ray: 98634c656c260afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340920,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65286)","md5":"1b8c20b5db8b9f90369dc0fc0984346d","sha1":"5063469c4979e7c03f33401844de3b5b7ec50483","sha256":"51e3355e656760a0f6a4da53bc68d44d862f66eaacef407601030ddf03b9543c","sha512":"be4d446524ba165a9036eac802351fde180842764a7f9319b20a274f1ddf4c9636169291253d046d21ba65494b41a4f71663550fb595f7e8622322745579b736","ssdeep":"3072:tpcYbDaEGNPW/2vz1eC3fOx9YVy+CChvIVn+00ycXHCFREip:tptD3Gc/2BrOx9YVyshvIs2","tlshash":"2e740ccf2c927435c37187f3aa199146a4b05be90ac50afbf91297b0e1d854ea1ff2d1","first_seen":"2025-09-28T12:37:41.927721Z","last_seen":"2025-09-28T12:39:00.963611Z","times_seen":2,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":129,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-28","alert":"Sinkholed","trigger":"airdrop-trololol.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}