{"report_id":"a2d20023-574a-43e8-a9fb-2ce7ed3ff645","version":6,"status":"done","tags":[],"date":"2026-04-30T14:28:32Z","url":{"schema":"https","addr":"accept-galxecom.pages.dev","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.10","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"title":"Airdrop - Rarible | Rarible","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T09:49:07.809217Z","times_seen":17797099,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"accept-galxecom.pages.dev","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.10","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-04T14:28:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-30T14:28:08Z","timestamp":1777559288,"ip_dst":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42368,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)","source":"{\"timestamp\":\"2026-04-30T14:28:08.295270+0000\",\"flow_id\":1861240837692990,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42368,\"dest_ip\":\"172.66.46.246\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2057746,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_11_20\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_11_20\"]}},\"tls\":{\"sni\":\"accept-galxecom.pages.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3488,\"start\":\"2026-04-30T14:28:08.253502+0000\"}}"}],"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-04-30","alert":"Hunting_JS_WebAssembly","trigger":"accept-galxecom.pages.dev/2ab5d871ffbcee3b5a5b9.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"accept-galxecom.pages.dev","ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-02","domain_rank":0,"first_seen":"2026-04-30T14:28:33.908755Z","last_seen":"2026-04-30T14:28:33.908755Z","alert_count":25,"request_count":8,"received_data":2635682,"sent_data":4056,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/2ab5d871ffbcee3b5a5b9.js","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"423269a1ab51755afe8d5d698651adb9","sha1":"e0f4f9f3fefe288631854e9f48352bf528e979df","sha256":"eb0ebbed6c0d988cf7e509331f4363d7dc14ebf5017eb0495ecf6edf65babd60","sha512":"bd274bc7c1457b6d4d6097e28c1a60f5ccf9514bb5a33d14aa411af40e933b0028731a5fad5579c6dc102232726f4d3fa0e994989234628ca360263dec1abd3e","ssdeep":"24576:NlXZ9jPJXpg1IzP2abvwuQVD0gnY7KQs+HPlthoF4evCJUyFNse9WDKy0a8pFmVh:XjBXpyI6yQo7ebCNtYb62ieWRAUtQZ","tlshash":"da753371bbe33eed4b28a67fe1cb0b0d3d940e528454d5ddce6424d381ade8688a7c19","size":1686774,"data":"","first_seen":"2024-02-05T02:30:35Z","last_seen":"2026-04-30T14:28:36.238376Z","times_seen":11,"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-04-30","alert":"Hunting_JS_WebAssembly","trigger":"accept-galxecom.pages.dev/2ab5d871ffbcee3b5a5b9.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"6937557610313bec26864fc704efeb7d","sha1":"35014978fea6102955402ce7b4b9652e6ba6418f","sha256":"a0d78da1251ae079025d3b0f21a8923c53b2db486b712ee47aa71198ccced9e5","sha512":"d040532bf3df6ee3cf990c958f3860d5987701675d949c2ad4f6711b90b40b010ccd972f5d480af6e8580a90ee9a16a0de3c866a5037df384bb0109ee7609649","ssdeep":"","tlshash":"e5f0245c2ae531b602bb356692430489be504033b1a2dc0e751c96e58fa6a6530e9adf","size":537,"data":"","first_seen":"2023-11-02T02:25:04Z","last_seen":"2026-06-01T19:20:53.566975Z","times_seen":179,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/favicon.png","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 1810\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"e24aa55696e72bd2ff9f7646a1fd61b3\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XEtNkb3GQ2oe7XP5Z9qMydRywoU1RUU9sRANeKg%2BMpyIqw5%2FMBMbUXbwXtM%2FM4QjSkT%2Bnqz5OR%2F7BoF8TFQbI80I5C500oUZYzgBb4Ocas4GY14CuEdkO7GRSZ5O9q9fikbTN59I84DwPxrM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b363b9e712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1810,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"e2c2609622aa9eb6e27e52c709203576","sha1":"0f367684b580e15d09c892c53f0189ccde99407c","sha256":"eb34cc85c4e948f82e8efb8d1e619f2a0a2b32ee753d967c2fa1e0f78afdf203","sha512":"4353e9deff3961b5b7413d6c38daefe958c0f2c5d436397b6d2b489bd93665056d98b195f089fd9b4c649d98cdabacd8134ed1e396350fd8d551eb76e1089845","ssdeep":"","tlshash":"9e313d82d650aba96e80c52758fcc26160440df96122c89c9fd1391a01be2a6ae7afc1","first_seen":"2023-07-03T13:26:12Z","last_seen":"2026-04-30T14:28:36.218872Z","times_seen":21,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/9053572c46aeb4b16caa.woff","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /9053572c46aeb4b16caa.woff HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: font/woff\r\ncontent-length: 142552\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"e47e59aa5bcb7db4f3a4f163b25a4850\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0cLp2Mkp13G7MrM2pwrcktIx0dt0Gv4zTGTAxJPqo4t6UkS6bGp2HAVZQQkU75a%2F08liZ9aDsHDaV447TWNk%2BV0jDMaiMIQBtw4ViQEttElriMXdbzToyk0WrSCFosbbaiGlTa%2FYemEG2VZW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b3449f4712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142552,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 142552, version 0.0","md5":"c0638bea87a05fdfa2bb3bba2efe54e4","sha1":"cad8cfc84ebf610138aef63e6949097ff48d72dd","sha256":"53deda460acaea14863a06c034744da8207fa696f3cc7958dc9d99e77ac452dc","sha512":"bc73e243d35b31dbeac11d3c21dbbc499196db23d621e1905d5431a2f012f927c8fff320b6dd6acbe35b07fbdb56ef76d37746aba88e4a56a0cbd239531a9fce","ssdeep":"3072:IWsJGahzoMswYy7t1OvI4qXZX6Z4BmMWrArezRH:sJcMpXE/qXZqqhOAreFH","tlshash":"49d3125a5bf303b7d13d7e4a0fd1370edf346a3a63ab2566c97a239500c3329a5c1a46","first_seen":"2023-04-08T00:09:07Z","last_seen":"2026-08-06T19:44:59.458292Z","times_seen":566,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/aHR0cHM6Ly9pcGZzLnJhcmlibGV1c2VyZGF0YS5jb20vaXBmcy9RbVVOYk1tTXRielA1WndwUTdYNzdjTkVxUjVEdkVtRFlxV3Z3MVFRa3g3bmJF.png","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /aHR0cHM6Ly9pcGZzLnJhcmlibGV1c2VyZGF0YS5jb20vaXBmcy9RbVVOYk1tTXRielA1WndwUTdYNzdjTkVxUjVEdkVtRFlxV3Z3MVFRa3g3bmJF.png HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 5141\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"7c73e005952661e4f0874a584770664f\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uofqzDEGG4BuQDq2OqyfOsAvEvVTI6CJ4fVjk6fJjxBe%2F414dH4ECu45vkiEWQz3GJYGfj8D8DZ7eS233y663Qg7cri%2Bab8D1AJBCq28MeE05gfroNloUvaAF16yl%2B%2BBcp0uA7XQp9yInodQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b351ac9712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5141,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 240 x 240, 8-bit colormap, non-interlaced","md5":"cf0802e555bce0f8855ebb639db25e96","sha1":"47f35fb5ebab74c25d4d3aff51ade687256f5ae8","sha256":"cbc307dc569cf8e9900705d56db8f045e75cb733bd708dde296e7506f9952e3d","sha512":"5b18f4d5aaa326a433e36b26ea2b5e4ee08f6529ce259f32096be25a1786748258b6f1157de72dd8babf4acb5fd7641d8dfe74f3d353a27b1a5906957e669ce0","ssdeep":"96:8Aw1US1Q+mkqJffS4EVKpTZmmlZgEjx/3jRtSJqcShfOzl/61Fv2k:36US++mBfBpZjvx/XSJqDUz4vv2k","tlshash":"94b1afcca65c58347af82074615c7e73772b185ec836a265dae331c7c5c801e32b928f","first_seen":"2026-04-30T14:28:36.223555Z","last_seen":"2026-04-30T14:28:36.223555Z","times_seen":1,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-30T14:28:08.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a17XwGYf6cabUzGeHXNHlEUQSRwnGCQGtzxOGaRCcphCRZyRLghLuwEhmTtPlS7sxztOcSaHv7e685NvwDwB8Ho7Qm6ULpG14qwF6NVetrzJk1mR%2BMSuk9lzxaJJEulGSg2skza9TUnqm5UV\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9f473b2ffaa35688-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":224064,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (36653)","md5":"21db881abbce7c89dfeb8aa350d6c80a","sha1":"c148de3a5a02b7212f2e7fb6860a06c0b348c926","sha256":"3fc1cb8ada6dbfbb9391c629f5c2421c6dd2d19ec88d773ca519d626b9f2670e","sha512":"1c16b051dfac40f669e1ceefaa1041be8684615bdd9e6bef2b70939a6c5bc0f89017e46febe53864e0c02dfe255170f6c697e225b09187938138e87687ec5587","ssdeep":"6144:o5L+gxqZro5znUMW59lZ1SFAPE/g/5Elp0iKz5GtPACaBbIj2Mg+x+QctgGGRh3n:o5L+4vmtgGGRh3HygN","tlshash":"0e243a5344402a85803fc65526b6d70b331f756ba52d95a8b09df888cffe4cc27eb6ca","first_seen":"2026-04-30T14:28:36.226186Z","last_seen":"2026-04-30T14:28:36.226186Z","times_seen":1,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":81,"dns":32,"connect":1,"send":0,"wait":137,"receive":0,"ssl":53},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/2ab5d871ffbcee3b5a5b9.js","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:08.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /2ab5d871ffbcee3b5a5b9.js HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:08 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=2,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XlhSVLcBvYxOgvm1FEDZKfceq2CU145kPcAoR3nK0RpvHSwShcgJlB3T04eoC6zNrYgnuUog722LFy7je0kNpw5fPmUyrjwTPCDTIJxmgI7p2pJN6pgnYeQYoSmBZTJfBj%2Fccglt1bG0wMl6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"e1bce17ab6beca67a6e65f7375edfac9\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9f473b31dff6712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1686774,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (63668)","md5":"d30c2fa2ddad2050398e6f658e2e75c6","sha1":"efd144776893631608e34e5e7072f39cee9b1ac3","sha256":"3a8216978871c816aca3625456516b5402e1f81d103b973ada61ba0f0e2fadb4","sha512":"239abac526b115ee311704fabc750f0595e371475b71799072ffd7003ee3e019c517d6ae1d9c46ed1ba3968d9c5d92736c75fb397f4c0d191d0e25befef551f5","ssdeep":"24576:NlXZ9jPJXpg1IzP2abvwuQVD0gnY7KQs+HPlthoF4evCJUyFNsQ:XjBXpyI6yQo7ebCNtYbQ","tlshash":"fc252338ef532ebecb68d67fd28b0b0d3da90e539884d8edc96820d781dad41859dc54","first_seen":"2026-04-30T14:28:36.228826Z","last_seen":"2026-04-30T14:28:36.228826Z","times_seen":1,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-04-30","alert":"Hunting_JS_WebAssembly","trigger":"accept-galxecom.pages.dev/2ab5d871ffbcee3b5a5b9.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/cca62d21c8c555c392e5.woff","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /cca62d21c8c555c392e5.woff HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: font/woff\r\ncontent-length: 142932\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"499b8225d8b9760713773c74c3749a51\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G6%2BK3TdHRZLUTd5HNOsvdsselVy4VSnQBs3jbB1D1kfnFk9lFbQfNAoKfV3T%2Fb50nAc30k643%2BDVHnJWW0JLS9Xs7Voih%2B2rKxi7iuEcxjoeJ2h3kdcK0PUqlVPX0fzsOonj6UnIY9dp7ShH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b3449ff712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142932,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 142932, version 0.0","md5":"66a68ffab2bf40553e847e8f025f75be","sha1":"7ae96ab990c7881f82947c1bdc47f41794b848d7","sha256":"653fed7a93046f1178f252570958104ad64a670d71e29518d0998dc0d7551fca","sha512":"12a84e9b164f3ddc454c66fcf7473172d9218e91f013b395ea55419e3b8a39d58da7c158532a325ce7fe2993f05be2c5ce6274eac53994d12abb46c699e83e98","ssdeep":"3072:fazmvyUKYWlklOZk6ySTCY7shA+Q/vkuUFZJB1zBq+RH:SSvyUKY8xyVNEvfUFb9q6H","tlshash":"28d312d26e63dd6fe500bde0dd32928b87315be3c9456c3668fd1b510ac2fa896d8063","first_seen":"2023-05-09T10:38:28Z","last_seen":"2026-08-06T19:44:59.488416Z","times_seen":387,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":84,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/8b373be6631d8e5f5e06.mp4","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /8b373be6631d8e5f5e06.mp4 HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://accept-galxecom.pages.dev/\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 417673\r\naccess-control-allow-origin: *\r\netag: \"a8df1ad0c8149132c2f59be6bf1ead9c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mX97wLtGAWEWR3tw1sjxVu9r7T9pHMmmignCeULMXA8VuFZOaLueh8c29sJNwYNxaMaoSKafI%2F%2BGCMcDNT66hgVEOo57Jv7Et9FimEjNpI5mH5ypZC%2BHz64fxo6CJ3E7nR3PjJmDgncwgHCs\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b351aba712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":417673,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"aadfc3219e2930959add412ea7a46496","sha1":"fc2a33e0ef99cf1e2a1127e347049aa9fa8d3d91","sha256":"53f3e6eb3238798466c97ec867ed552d185830062ad7595b0be0a8e993ad1227","sha512":"d252be67151a130e33fdbd38c7ca580141515f460b6dc86c86cdc64e49d14015ce148196d78a950b8b9ce63b9ce80cdf417f011744a16c451384447eb96d2329","ssdeep":"6144:WRAKms2Mose5tKLzk69G/8GLfI1+4uoeWNpRo1dIyINaWpR1ARY7aElCjTEBXDny:f9shLzk6E/BLg1R5Po1dRIF1AU2IBXm","tlshash":"df9423536ac98063ee34277b81c189f74512c4da95e08fc33ece5265cb652c81faaced","first_seen":"2023-11-18T09:12:28Z","last_seen":"2026-04-30T14:28:36.232331Z","times_seen":7,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accept-galxecom.pages.dev/aHR0cHM6Ly9pcGZzLnJhcmlibGV1c2VyZGF0YS5jb20vaXBmcy9RbVhQaTFHcW1WNUJ4Y1lSaGtQYlB3UnZNd2tuSDJ0WjJHS2VRTFI1emhmRUt3.jpeg","fqdn":"accept-galxecom.pages.dev","domain":"accept-galxecom.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://accept-galxecom.pages.dev/","date":"2026-04-30T14:28:09.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accept-galxecom.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Mar 2026 00:29:11 GMT","end":"Sat, 06 Jun 2026 01:26:44 GMT"},"fingerprint":{"sha1":"EA:6B:29:C8:DE:EA:09:FE:CE:94:14:BA:4D:08:70:E9:4F:F0:F7:50","sha256":"96:92:6E:3D:B0:24:96:B8:FE:C8:D7:E8:AE:59:B9:A4:03:C6:BA:43:C1:76:9B:3A:51:98:6F:05:26:7B:17:86"}}},"request":{"raw":"GET /aHR0cHM6Ly9pcGZzLnJhcmlibGV1c2VyZGF0YS5jb20vaXBmcy9RbVhQaTFHcW1WNUJ4Y1lSaGtQYlB3UnZNd2tuSDJ0WjJHS2VRTFI1emhmRUt3.jpeg HTTP/1.1\r\nHost: accept-galxecom.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://accept-galxecom.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 30 Apr 2026 14:28:09 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 8673\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"6f69bdd76d9ff8f84f22324efc8261b4\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8LuBvfS0kw%2Bvp5oqIxGBECQ98DhCK5XgpZBr2sUPJpuoYgrIdSPKBnSu6Z6IqKkXLeZySdGWJBfZDZ2mTN%2Fki0%2Fxm8%2BV2Qmt80t0%2F10GY60Ji9x7PsSli%2FeLt2Ysno2ikBykidD0Q%2BSoJtAO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f473b351abd712a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8673,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 240x240, components 3","md5":"0a06e273e01ea26ba05cf11d9815654f","sha1":"80a686e9b46b064a758492156247ad3f652d81ef","sha256":"7cad84635cd6bb7f34bba8e05166a3536f840b6bf8a49995ee405b47b3bacafe","sha512":"2db289163e7880b3b92f397a25041388a24f67983388a53ab4d1b7a355666c24f143581f97b902d3f440fd52694de221c322cd54ac2d6c520e1856125f90d211","ssdeep":"192:szsR/wbTJRoXvHPeIOi61vn7iHPQk7QbWImOS:szsR4/JR8lOH7iHIgLImL","tlshash":"ed02bf69db1bc38fe5234d75a1a3376b38b0281bb73e6236f18b07d1709a560d912e20","first_seen":"2026-04-30T14:28:36.236024Z","last_seen":"2026-04-30T14:28:36.236024Z","times_seen":1,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-30","alert":"Sinkholed","trigger":"accept-galxecom.pages.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}