{"report_id":"a3a01a43-49b0-4949-bae6-bc32a4e6b574","version":6,"status":"done","tags":[],"date":"2025-11-04T03:43:20Z","url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"title":"Common | Airdrop","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":""}},"submit":{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98","country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-09T03:43:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":10,"urlquery":0,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":58062,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-04T03:42:59.861244+0000\",\"flow_id\":153345201475797,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":58062,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3511,\"start\":\"2025-11-04T03:42:59.856277+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":58076,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-04T03:42:59.865001+0000\",\"flow_id\":837700995457039,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":58076,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3513,\"start\":\"2025-11-04T03:42:59.860175+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":42732,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.877024+0000\",\"flow_id\":285368201201448,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42732,\"dest_ip\":\"104.18.11.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3431,\"start\":\"2025-11-04T03:42:59.870184+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":42744,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.887798+0000\",\"flow_id\":1054049235592954,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42744,\"dest_ip\":\"104.18.11.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":3507,\"start\":\"2025-11-04T03:42:59.878330+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":48552,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.940802+0000\",\"flow_id\":98754019673584,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":48552,\"dest_ip\":\"34.249.98.61\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058797,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed3.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-11-04T03:42:59.869872+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":48554,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.949059+0000\",\"flow_id\":652731786421851,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":48554,\"dest_ip\":\"34.249.98.61\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058797,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed3.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-11-04T03:42:59.878171+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":40856,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-11-04T03:43:00.170351+0000\",\"flow_id\":827060214070767,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":40856,\"dest_ip\":\"54.77.127.201\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-11-04T03:43:00.097775+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":40872,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-11-04T03:43:00.171271+0000\",\"flow_id\":2244485321098518,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":40872,\"dest_ip\":\"54.77.127.201\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":921,\"bytes_toclient\":1654,\"start\":\"2025-11-04T03:43:00.099606+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"ip_src":{"addr":"172.18.0.8","port":59078,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-11-04T03:43:00.183783+0000\",\"flow_id\":94510592093207,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":59078,\"dest_ip\":\"173.244.207.30\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":4434,\"start\":\"2025-11-04T03:43:00.125975+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"ip_src":{"addr":"172.18.0.8","port":59080,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-11-04T03:43:00.186257+0000\",\"flow_id\":709253556138023,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":59080,\"dest_ip\":\"173.244.207.30\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":4434,\"start\":\"2025-11-04T03:43:00.127015+0000\"}}"}],"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"commoncheck.live","ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-11-04T03:43:23.838692Z","last_seen":"2025-11-04T03:43:23.838693Z","alert_count":22,"request_count":22,"received_data":8247920,"sent_data":10993,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"bsc.drpc.org","ip":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":2964008,"first_seen":"2023-11-21T22:39:48Z","last_seen":"2025-11-04T03:43:02.211302Z","alert_count":0,"request_count":2,"received_data":7328,"sent_data":1005,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-11-02T22:15:46.374949Z","alert_count":0,"request_count":2,"received_data":798855,"sent_data":902,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"binance.nodereal.io","ip":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2021-07-19","domain_rank":1804985,"first_seen":"2022-10-20T10:44:48Z","last_seen":"2025-10-29T12:34:19.990266Z","alert_count":0,"request_count":4,"received_data":2220,"sent_data":2036,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.prod.website-files.com","ip":{"addr":"104.18.161.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-01-23","domain_rank":20159,"first_seen":"2023-11-01T22:05:38Z","last_seen":"2025-11-02T23:46:52.277337Z","alert_count":0,"request_count":1,"received_data":6032,"sent_data":506,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2025-10-12","domain_rank":0,"first_seen":"2025-11-03T13:57:07.007765Z","last_seen":"2025-11-03T13:57:07.007765Z","alert_count":3,"request_count":1,"received_data":996,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"corsproxy.io","ip":{"addr":"104.26.6.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-30","domain_rank":175528,"first_seen":"2016-05-19T01:27:08Z","last_seen":"2025-10-28T23:06:30.717432Z","alert_count":0,"request_count":2,"received_data":4010,"sent_data":1077,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2025-11-03T00:12:47.594918Z","alert_count":0,"request_count":2,"received_data":512,"sent_data":866,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"bsc-dataseed3.bnbchain.org","ip":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2020-01-13","domain_rank":5059613,"first_seen":"2023-12-07T18:13:02Z","last_seen":"2025-10-28T10:23:17.725851Z","alert_count":0,"request_count":2,"received_data":5971,"sent_data":1033,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-11-02T22:17:55.857863Z","alert_count":0,"request_count":1,"received_data":239257,"sent_data":443,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rpc.ankr.com","ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"domain_registered":"2007-04-23","domain_rank":541361,"first_seen":"2021-10-24T12:41:06Z","last_seen":"2025-11-03T19:37:00.116278Z","alert_count":0,"request_count":2,"received_data":1405,"sent_data":1011,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"relay.walletconnect.com","ip":{"addr":"18.156.180.228","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2009-12-19","domain_rank":336134,"first_seen":"2022-06-21T21:28:32Z","last_seen":"2025-10-31T18:43:22.22251Z","alert_count":0,"request_count":1,"received_data":166,"sent_data":1116,"comment":"","tags":null,"fingerprints":null},{"fqdn":"explorer-api.walletconnect.com","ip":{"addr":"104.18.26.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-12-19","domain_rank":466611,"first_seen":"2022-10-10T18:16:28Z","last_seen":"2025-11-03T11:36:20.168606Z","alert_count":0,"request_count":2,"received_data":412642,"sent_data":1128,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":58062,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-04T03:42:59.861244+0000\",\"flow_id\":153345201475797,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":58062,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3511,\"start\":\"2025-11-04T03:42:59.856277+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":58076,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-04T03:42:59.865001+0000\",\"flow_id\":837700995457039,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":58076,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3513,\"start\":\"2025-11-04T03:42:59.860175+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":42732,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.877024+0000\",\"flow_id\":285368201201448,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42732,\"dest_ip\":\"104.18.11.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3431,\"start\":\"2025-11-04T03:42:59.870184+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.8","port":42744,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.887798+0000\",\"flow_id\":1054049235592954,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42744,\"dest_ip\":\"104.18.11.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":3507,\"start\":\"2025-11-04T03:42:59.878330+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":48552,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.940802+0000\",\"flow_id\":98754019673584,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":48552,\"dest_ip\":\"34.249.98.61\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058797,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed3.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-11-04T03:42:59.869872+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:42:59Z","timestamp":1762227779,"ip_dst":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":48554,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)","source":"{\"timestamp\":\"2025-11-04T03:42:59.949059+0000\",\"flow_id\":652731786421851,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":48554,\"dest_ip\":\"34.249.98.61\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058797,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed3 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed3.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-11-04T03:42:59.878171+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":40856,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-11-04T03:43:00.170351+0000\",\"flow_id\":827060214070767,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":40856,\"dest_ip\":\"54.77.127.201\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-11-04T03:43:00.097775+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.8","port":40872,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-11-04T03:43:00.171271+0000\",\"flow_id\":2244485321098518,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":40872,\"dest_ip\":\"54.77.127.201\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":921,\"bytes_toclient\":1654,\"start\":\"2025-11-04T03:43:00.099606+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"ip_src":{"addr":"172.18.0.8","port":59078,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-11-04T03:43:00.183783+0000\",\"flow_id\":94510592093207,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":59078,\"dest_ip\":\"173.244.207.30\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":4434,\"start\":\"2025-11-04T03:43:00.125975+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-04T03:43:00Z","timestamp":1762227780,"ip_dst":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"ip_src":{"addr":"172.18.0.8","port":59080,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-11-04T03:43:00.186257+0000\",\"flow_id\":709253556138023,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":59080,\"dest_ip\":\"173.244.207.30\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":4434,\"start\":\"2025-11-04T03:43:00.127015+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-01T18:21:59.459264Z","times_seen":736501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/e5b218a5-fd92-4e1e-9856-db580d761644","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f2bcaf99e66911e260d5d0ad4157e39a","sha1":"d29b98e80d69c16411593e54ac903a49f0e1e5eb","sha256":"44dd7ca2985cb9f1bb45637257ccf1c4c6c5f3cc4a2c701c2522b36c63b7cab0","sha512":"7aecc3df972c87436b26e06adf33e4eae5e802ee6ea6b2b84b6cb31e00e4d117e59385907ce4413c789074f4621db61e4a0fba5c161128d7ba9305da465d6f94","ssdeep":"24576:bQmKnba27ievVV+yuFX2KLDesFIhkPBgRY1o+l0m2a82a3NatqKvXWod:bQmKievbKAKgKWac/z4","tlshash":"a7367114dcc35c715be5038e42a2e8d4c9047b5a958ff245f56fecfbb349a1a8acac21","size":4867503,"data":"","first_seen":"2025-11-04T03:43:31.37087Z","last_seen":"2025-11-04T03:43:31.37087Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/7093f23a-b72f-465a-adc0-8a09cb795ef4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec26a722169cb2cef03353fcf8dd144a","sha1":"6eec6673abcde3d29547796a38361256d9efde1c","sha256":"01861fcd47bc63bb7be76c480bad4c6cc987c8996ab0e023a4e692b68c94b05c","sha512":"c885e5d94bd96fa4a573524356e0ca7398b1489f5a39fc1120cf7f4e469950630ad3e9f48dd0392acd36da390c27a4be1e81da943d1d9ecd48890d1691e416cf","ssdeep":"6144:Ufg7z90bnvLZqnWTI9esVTMuyEvtzXNglxQP92L:VzBe6kEdOxQoL","tlshash":"bf740980b261b07247da24e10477540af339e96c744a40acf6a8d8fb7dbd589957ff38","size":357754,"data":"","first_seen":"2025-07-12T22:38:09.13306Z","last_seen":"2026-06-28T16:47:47.454007Z","times_seen":5087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-01T18:19:46.108732Z","times_seen":236750,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/5fa5ccbf-30df-4c99-9541-547e94b39dd3","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"24da54c1325c9ddd1a95836e083d953f","sha1":"60b180ef14b6a96a0826a740d151130a43248319","sha256":"158864d1f2f656410bc1952848bbec58956c5cd9242a4b990f7d37a1c7a51658","sha512":"3cc25d0c8273f7637088e3d10b1e4e6307dc706f60b2a3d74bf03407b7ee48571320f08ce6f6bcaa9d4a1f52eba65299f7288253d9076fe72d8d431462acbc2f","ssdeep":"12288:bTmmIf1b3kwhFdWhOB5whFYhalXZBjn/h2gYa:bTmb3iOBGJBjD","tlshash":"cd056ce47371f07a539742ad942f0105f2386868640d802cf3ece9ea64d99d9d6bbf39","size":866067,"data":"","first_seen":"2025-06-21T10:15:42.42617Z","last_seen":"2026-06-09T10:31:45.942702Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":735973,"data":"","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-30T12:11:14.543438Z","times_seen":8482,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"0e9e3ad57abeefde87342864450cc232","sha1":"4dc8676bf3417d597053d5f253fce034007f63da","sha256":"9a37601d1f5a5f2fba3b000694d4bf5e035c606d5485dd94e2997cbe2efe5c26","sha512":"b2d8e0e883fc8af91de120565298502b6e5b0f6e20275ecd2974de3e768a19a443f7facc2127201df66725c20451b924a69eaab78224073e385f14a5431c3a6c","ssdeep":"","tlshash":"34c0123621525559045b3d04a66ba14a758791b2a9025401dc7ee5a0311bc9aad0255e","size":181,"data":"","first_seen":"2023-03-07T01:17:43Z","last_seen":"2026-08-01T18:19:19.216048Z","times_seen":59136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/nprogress.js","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ff35f4a5084ad72aa27dfc7eae92993d","sha1":"21f541bbbcb2c35e6f4ac5e70c96c8faa0f976bb","sha256":"b746402c79b56c47539e1267b519618da5ae732d18761f2f094fe02918faad34","sha512":"423fa6e42a66e27cda15e40e7eb72266ca6f896b1c45aef382037d60f49e5a2485ff8dc402df6798ab9e20f4828286c52378e50bb8371b62e12b52f9288716e4","ssdeep":"1536:1/SQairSzuhYpu62HAhhP7SXjnPYS8PNuLMBnMhLBHc8bSc0m+4O7SHUkNl9shw/:YQairSz8TfHqB2TPBaM6nWVH7Gf20kTN","tlshash":"bb332fb6b712a2d4c1960d502336429effd6cd3377517b81b0e20986ad629f276f2738","size":54938,"data":"","first_seen":"2025-11-04T03:43:31.347432Z","last_seen":"2025-11-04T03:43:31.347432Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","size":60819,"data":"","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-08-01T15:55:45.692224Z","times_seen":31808,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"commoncheck.live/airdrop/ui_02.mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/ui_02.mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 380138\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"5ccea-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-380137/380138\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":380138,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"c858a05175a373e9a529cb74d7c8aa75","sha1":"3f7ca68b4f9ba37eb4c1ad3bb9c7c31532b7d103","sha256":"16afab93310df5e1fa272b0700a2397230bfb2a2324f520f30400d71f95a99a6","sha512":"8fda562855d98664033bab6e3d36212ffeb905372127f8e7a790c82c6aca0ca3603674b3658054ea63c47bf1b15554f2a2230b0bcd88cc8edaaa9860c6e4e395","ssdeep":"6144:ahmEAKmh6y2NhEpVfY2319YxrapUCCDItHhT9dxvsaA0zNiAdBfB1sW2eEXFhCZi:6/khuELN0JapI0hdxvVA0z0wn+meFgZi","tlshash":"968423681bd57f26d87cbb379a8e978d3712b947401e1bcb69a2782a081139d4f21cd3","first_seen":"2025-10-19T02:10:52.576514Z","last_seen":"2025-11-04T03:43:31.334911Z","times_seen":4,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/cross-platform_community%20(1080p).mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/cross-platform_community%20(1080p).mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 295089\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"480b1-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-295088/295089\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":295089,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"832428d94b8bd96962461ddacc48ffe2","sha1":"d1a91e7beaac1b6021ad625980651b72393b4bca","sha256":"ef93e77cf18f7a9225452de5ca4e10c83a9753acf958c2aa48e908bf36db7103","sha512":"2edbaa44c7b5cd7d63ab956647877dbf731ab02817a96712b17fe50a0e5acee0f49d5ab5315564c7a207cc81c8b30a6abb9dd80c0c7e6e46e3669fe80f5ff46e","ssdeep":"6144:7u/pmAHooLaUBpHymq13Bqf9phfsr2PQMLD0dMG0v/QP9h:7u/JHoodBVymq13BqfuMHnI","tlshash":"39541244efea5f67cd304533c5e91b167321fc388e29abd3076912ab5ea2ef40a155e0","first_seen":"2025-10-19T02:11:00.597627Z","last_seen":"2025-11-04T03:43:31.33582Z","times_seen":3,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":129,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed3.bnbchain.org/","fqdn":"bsc-dataseed3.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-dataseed3.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":130,"dns":4,"connect":34,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.873Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 21 Oct 2025 11:29:23 GMT","end":"Mon, 19 Jan 2026 12:29:18 GMT"},"fingerprint":{"sha1":"DA:4E:9A:DE:F3:0B:C7:C8:C4:06:4E:EE:32:42:78:91:20:34:BC:EE","sha256":"9D:A6:B5:D4:0B:84:DE:F2:F0:3A:9C:99:3B:99:3A:4A:26:A9:4E:48:31:52:22:CD:AA:47:20:8D:CD:1F:4C:53"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncf-ray: 99911ac85d1b1a30-OSL\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: https://commoncheck.live\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":25,"dns":4,"connect":1,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.11.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 21 Oct 2025 11:29:23 GMT","end":"Mon, 19 Jan 2026 12:29:18 GMT"},"fingerprint":{"sha1":"DA:4E:9A:DE:F3:0B:C7:C8:C4:06:4E:EE:32:42:78:91:20:34:BC:EE","sha256":"9D:A6:B5:D4:0B:84:DE:F2:F0:3A:9C:99:3B:99:3A:4A:26:A9:4E:48:31:52:22:CD:AA:47:20:8D:CD:1F:4C:53"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding\r\nx-drpc-owner-id: cb501251-31a8-4028-8b0a-54679f15c385\r\nx-drpc-owner-tier: free\r\nx-drpc-provider-id: drpc-core-free\r\nx-drpc-trace-id: 4d168ea524fd06055d2111715f549f7f\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 99911ac8cd5e1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6374,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8cddab4c6b3bdd125741fea6f6871ad7","sha1":"89bdb44fce716f9de64eab2676f97773a15a56c5","sha256":"09895382537cb3db8470f3c9089fffa5259749eecec52412221d38154adcb281","sha512":"d2a4c8dfbb298b36acd708e5a0bc3477b728459e1c33ecf421b286adf4d709d2db8db123eb0b37d5ef63d3e982e8f0631e67acb1c0f97a5741d127fc9daadc15","ssdeep":"24:Y2tXa257vaoWH3eGZsthXvUzZ5+hdex1qx1xxNU6xvQaNBtXX60jv:Y8am3QytxvU15+doY1jNNTt9jv","tlshash":"b5d10bf098c98e50f19b5a81b798bc9400113caf7fdf8f40415cf8b6a0f549176a448f","first_seen":"2025-04-17T10:18:27.874943Z","last_seen":"2026-06-28T16:47:47.420106Z","times_seen":907,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/ui_01.mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/ui_01.mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 195487\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"2fb9f-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-195486/195487\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":195487,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"276f41785c1d4d082f131f17942ae30f","sha1":"4725140ff8216a1ad95d138d0a8cfa78c40dcbac","sha256":"2b0884d4a5abb7bf1da01b325129e2eb96852eed94669ea0e37b1e6487fc601a","sha512":"2a4a4ad4a19814488e5423dcdc6ecbdc3ee8c1c0e83c64be35679adec046abd28f73f5bd6512f562bb657cd595930aa1a4016bc0b1d991a4362284c15d89fd0d","ssdeep":"3072:4yq+X2kxeS8fJxodBZNBU4gQDWE6l6bmNgQXcMZlv9Ix47NsB9BMEZRufz:fmbS8BxmBZTdJDQ6IgijZs4Bs9nZR6z","tlshash":"7f1412199fe67f03ceb9427f8ad80bd9a7cce646058b13c3632ca1975e863d53644ac4","first_seen":"2025-10-27T21:51:43.02409Z","last_seen":"2025-11-04T03:43:31.337806Z","times_seen":2,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/empower_the_squad%20(1080p).mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/empower_the_squad%20(1080p).mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 471795\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"732f3-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-471794/471795\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":471795,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"8fbb389f8a5c934b9fc00e62a0b7e994","sha1":"0bc736519ab7ade79b06d478507157f6927940a4","sha256":"f472e42b59cdc13e502b94621341a2fc57b92137be32dd3769a2f27a4fd4e022","sha512":"f2332489e0dccf0f6c2555c46391dfe3f6f464a4c3352787000a5cd8fb432eda674a9b1d4b0bc9557a12e361c56ba5352ed9e7b91b62d5efab2aaf30104ff397","ssdeep":"6144:zv0lOjWJq06BZW4/SeBu4PLWi+A3BwObgxK4Fo8f35PdEc6BrerskES:UqzBd/nBhPqi+fy0FhfEBrIskES","tlshash":"d8a42321bff33b46dc34023aa04d13655399fe40921fbbdb98c675523ea3aa64d51af0","first_seen":"2025-10-07T02:47:44.606494Z","last_seen":"2025-11-04T03:43:31.33893Z","times_seen":4,"resource_available":false,"data":null}},"time_used":397,"timings":{"blocked":30,"dns":1,"connect":52,"send":0,"wait":83,"receive":168,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/crypto-js/4.2.0/crypto-js.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 19621\r\ncf-ray: 99911ac62f24120a-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65384d58-4ca5\"\r\nlast-modified: Tue, 24 Oct 2023 23:03:52 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1045550\r\nexpires: Sun, 25 Oct 2026 03:42:59 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=mYqrWU5vs9DbVdL8oOaKVqqMFa3FJuUAmezvmHfgf8jhVgPNOhts0RmFsxffzzvb7c7eQ%2Bqeoysx1HN7K7NaFNg31lhESn4ZWH9kmqVin6sNintihsgy5fBprHBEv3DkBfKwIMKG\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60819,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (60819), with no line terminators","md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-08-01T15:55:45.692224Z","times_seen":31808,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":97,"dns":1,"connect":1,"send":0,"wait":10,"receive":2,"ssl":94},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/ethers/5.6.9/ethers.umd.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 125841\r\ncf-ray: 99911ac6bcc70b55-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"62ad87d5-1eb91\"\r\nlast-modified: Sat, 18 Jun 2022 08:07:49 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 3586963\r\nexpires: Sun, 25 Oct 2026 03:42:59 GMT\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=BcMMHfAD5nomOqQG6f4%2BPqfAWi8wp0B8352LklAsAiHVK%2F5tXe5Aj67amIrBo2BUlqwu8NGawdpe51HUxtg1jb9v5q8oJCNYpyT%2FB6e8owd%2FlwJWB6cSBdPp3Je%2FDzW29PiJ7FVQ\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":735973,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-30T12:11:14.543438Z","times_seen":8482,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/secureproxy.php?e=ping_proxy","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /secureproxy.php?e=ping_proxy HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/airdrop/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:59 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"d3a2c5195d3791612cb36c8bb4967cde","sha1":"2603794476923e923a4e36a37340aaaf188e6ea0","sha256":"ad61ccc714c883d65041d05a8cf1b67b775c52c338870cb185b87487597c2c78","sha512":"3274b155d5b09fe864219e6f33988fee171f66a045fedf1859f9e8e7f40cb7741bfbfb127e3972201c6c151b2c22a15413f4db8f931fed06b8c9aaa450e3b759","ssdeep":"","tlshash":"a0d02bef904363864811145039c625d2668d13faa43a86a86dc6e487529c53ecd9b9c9","first_seen":"2025-11-04T03:43:31.342041Z","last_seen":"2025-11-04T03:43:31.342041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":116,"dns":1,"connect":35,"send":0,"wait":41,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/config.php?s=%2F%40v1%2Fcdn%2Fjs%2Fangular-common.esm.js\u0026t=29370462","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /config.php?s=%2F%40v1%2Fcdn%2Fjs%2Fangular-common.esm.js\u0026t=29370462 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"d3a2c5195d3791612cb36c8bb4967cde","sha1":"2603794476923e923a4e36a37340aaaf188e6ea0","sha256":"ad61ccc714c883d65041d05a8cf1b67b775c52c338870cb185b87487597c2c78","sha512":"3274b155d5b09fe864219e6f33988fee171f66a045fedf1859f9e8e7f40cb7741bfbfb127e3972201c6c151b2c22a15413f4db8f931fed06b8c9aaa450e3b759","ssdeep":"","tlshash":"a0d02bef904363864811145039c625d2668d13faa43a86a86dc6e487529c53ecd9b9c9","first_seen":"2025-11-04T03:43:31.342041Z","last_seen":"2025-11-04T03:43:31.342041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/ui_03.mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/ui_03.mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 358047\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"5769f-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-358046/358047\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":358047,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"a598503850c8d7c6acea427c5ef3731c","sha1":"f1bec84b640d34ee91517cf420fba61e031a4cc5","sha256":"da27e239f41e1f88802e0e6d3a50d03d6648585308177e10502a52982abdbdce","sha512":"f32febb946d375781004ed818bdeb373d55bcf2e5e0ae19eabfd8a617f34b10915fc9ff92d95f1c47cb78e38de4b64b3bf104efc5e41459539ad140fee2e3e3a","ssdeep":"6144:CCB2d2XyRb72e99thlnD9rrXSrFDrFrvmb68+e4QKj/nkQsCPklN847sD0EDnWqL:L2dH9txrirVtvmbE3f1slW4QUq2zjI0Q","tlshash":"8f7412822fc8e916ed78533a71de07b87ae4cb06488f13c3d6c8b831ae676e55d149d4","first_seen":"2025-10-19T02:10:52.557964Z","last_seen":"2025-11-04T03:43:31.343394Z","times_seen":4,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":93,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.prod.website-files.com/65a8107b678696f46163aee6/65a8182e9aaee38e4bdd9e49_webclip_256x256.svg","fqdn":"cdn.prod.website-files.com","domain":"website-files.com","tld":"com"},"ip":{"addr":"104.18.161.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prod.website-files.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Oct 2025 20:20:26 GMT","end":"Thu, 08 Jan 2026 21:20:23 GMT"},"fingerprint":{"sha1":"36:73:72:40:FB:41:28:BD:49:77:FB:90:5B:2E:02:FA:18:98:46:F3","sha256":"9A:F2:2E:A6:DB:A5:41:83:DC:C8:50:D9:A2:A6:B3:44:A8:AC:3F:1E:23:9C:EA:65:A2:FF:1F:93:59:1D:E2:FC"}}},"request":{"raw":"GET /65a8107b678696f46163aee6/65a8182e9aaee38e4bdd9e49_webclip_256x256.svg HTTP/1.1\r\nHost: cdn.prod.website-files.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\nx-amz-id-2: b20BuirYM6ADiI3y4BltKRLwUQKY78L8PS/zeGPS+KVMJlvlJtQjjdM9zIbZ5Qm4OqNs76Hc3a4=\r\nx-amz-request-id: 2AYMXVMZTMZTZBYE\r\nlast-modified: Wed, 17 Jan 2024 18:10:55 GMT\r\netag: W/\"0e217c87e6818abfe262fe89aca88717\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000, must-revalidate\r\nx-amz-version-id: 3rWdK0UOEtBhyogoW2KCSU3g5.RnIMHe\r\ncf-cache-status: HIT\r\nage: 369621\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\ncf-ray: 99911ac40cbd56c3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":5381,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0e217c87e6818abfe262fe89aca88717","sha1":"e98462e972aeefaf160d14253605250abceaee13","sha256":"9fd01f0c8387afb0022ee3e245056dd04478099ba58e726dfa5a0ae39f959f4e","sha512":"a1402b7a1453655eaa8bb3d65fa9e756dfa747e3a7374e6cf2d71176b6a5596b7ee9d326a8227c59ed3633afd134ee700b43169ca4da995b7ff3829c78692a4c","ssdeep":"96:qSMWlYVsr5luBR2RaX86aAdCEa2hwuld7RAZsK5MB1oHmIOr8EhD:dMjKPeucvld9AR5MB1oHmJ","tlshash":"1ab1a5bc23b69af7e68982d49df270cd68ae10bb92e11318f75d11531f042e519633d3","first_seen":"2025-10-07T02:47:44.582435Z","last_seen":"2025-11-04T03:43:31.344268Z","times_seen":7,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":13,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com/@v1/cdn/js/angular-common.esm.js?t=29370462","fqdn":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","domain":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Oct 2025 14:08:01 GMT","end":"Sat, 10 Jan 2026 14:08:00 GMT"},"fingerprint":{"sha1":"9A:60:CE:4C:93:45:8B:FA:45:41:89:7B:73:9E:66:D8:B0:74:AB:C5","sha256":"DE:0C:AE:79:77:CD:E5:0E:54:C0:FC:CE:8D:77:6A:A2:EF:0A:E3:3E:AB:27:A2:05:C1:D7:80:E9:A9:DB:1E:AB"}}},"request":{"raw":"GET /@v1/cdn/js/angular-common.esm.js?t=29370462 HTTP/1.1\r\nHost: afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 523 No Reason Phrase\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 3\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 4623692\r\ncdn-uid: 0f8c994c-6486-40f7-a986-92e996f7e2d2\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\ncache-control: no-cache\r\netag: W/\"3-jeI6quxhssuoG9FV6mYyJzfep9g\"\r\ncdn-proxyver: 1.39\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 523\r\ncdn-cachedat: 11/04/2025 03:42:59\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 662d829dd84c6b520313dd5f6b42c6db\r\ncdn-cache: MISS\r\ncdn-status: 523\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"523","status_text":"No Reason Phrase","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":226,"timings":{"blocked":45,"dns":34,"connect":1,"send":0,"wait":135,"receive":0,"ssl":7},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/65bba1b6c069b75a483860ec_common-favicon.png","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:56.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/65bba1b6c069b75a483860ec_common-favicon.png HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:56 GMT\r\nContent-Type: image/png\r\nContent-Length: 2590\r\nLast-Modified: Sat, 27 Sep 2025 15:46:34 GMT\r\nConnection: keep-alive\r\nETag: \"68d806da-a1e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2590,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"1d3ec9a19fb0d62db2d11ee45af831ce","sha1":"064407882cc86f7d2ddc3c812a9ccd926c13a6ca","sha256":"706baba12f6b32fdb7f1da73a6e2a0f12736b0cd1bdf0565a792db0e27964bb1","sha512":"69e7ed9703ae6b23d435a771b9cd922bde87eaeea589e64059855a48c6668f75953cb04c092e3c10f4296354a566ea029bbf6b51aad92c977ad98fa36642b020","ssdeep":"","tlshash":"2451d609fe467409a205d258fad65a87a927c4a0ecc0ebc37efdc8870520079453eae7","first_seen":"2025-10-07T02:47:44.584432Z","last_seen":"2025-11-04T03:43:31.345307Z","times_seen":3,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/flower_illo_loop_final_@2x%20(1080p).mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/flower_illo_loop_final_@2x%20(1080p).mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 1862487\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"1c6b57-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-1862486/1862487\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1851089,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"68217c876c4337dcc4c8a1357a69ac13","sha1":"63e1cad4ef120f465b48f083c0b3d50b2ad66707","sha256":"23bfcb52c569b163eedc9715f8dc0353260441863b7bc42ea1bdc87b17a7a45b","sha512":"8ed97eca8a228a5d491d82f95a0ebc769196db1a0700e4f2be9624918993ff777265fb75e5bd172404b1216e0117df57474edaefe0a3facdc763100aeedbeadd","ssdeep":"12288:fQsKmvr4RVnMXt6TVeFVtCit6f2j0OXuQ/kdvv2Q+fcRYM59IpxvaiJR15IeZRaB:fLKc6TVeFCl2+glfce6ifiiJRnIeDaGg","tlshash":"e62523887f55e429f818867f00c051f5eb99d2a70701693b9173bbd22f849d9e72e0ee","first_seen":"2025-10-07T02:47:44.599514Z","last_seen":"2025-11-04T03:43:31.346378Z","times_seen":4,"resource_available":false,"data":null}},"time_used":716,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":665,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/nprogress.js","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:55.280Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/nprogress.js HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 29 Oct 2025 18:29:23 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69025d03-d69a\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54938,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (54688)","md5":"ff35f4a5084ad72aa27dfc7eae92993d","sha1":"21f541bbbcb2c35e6f4ac5e70c96c8faa0f976bb","sha256":"b746402c79b56c47539e1267b519618da5ae732d18761f2f094fe02918faad34","sha512":"423fa6e42a66e27cda15e40e7eb72266ca6f896b1c45aef382037d60f49e5a2485ff8dc402df6798ab9e20f4828286c52378e50bb8371b62e12b52f9288716e4","ssdeep":"1536:1/SQairSzuhYpu62HAhhP7SXjnPYS8PNuLMBnMhLBHc8bSc0m+4O7SHUkNl9shw/:YQairSz8TfHqB2TPBaM6nWVH7Gf20kTN","tlshash":"bb332fb6b712a2d4c1960d502336429effd6cd3377517b81b0e20986ad629f276f2738","first_seen":"2025-11-04T03:43:31.347432Z","last_seen":"2025-11-04T03:43:31.347432Z","times_seen":1,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/coin.png","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:55.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/coin.png HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: image/png\r\nContent-Length: 638816\r\nLast-Modified: Sat, 27 Sep 2025 16:42:00 GMT\r\nConnection: keep-alive\r\nETag: \"68d813d8-9bf60\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":638816,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"1314bff7ccd4e0b842d5665a91a4d29e","sha1":"0c1b7c66763ff20aa57931dd4f0aaf60dc7dfa29","sha256":"9fe57e927c389aab082a61eb2fff95995f8c7c733718f77081019be728707a97","sha512":"c0878b10f1aa0670ebe3814fce26ad098f42486caf652414d5f3247e7820a8eb6fdc31177c1c84917155c59822dbc2af526b6c91ef5f0d712c17d75a9a17c157","ssdeep":"12288:CuKflqhTYCOur5p34g7dv6IYxWSdIjXbCduekrfUXns2hwfUK:CuElqhMDQ5ayydIK8d8Xs2hwf5","tlshash":"83d4230cd9bb6880ddd95ffa0f854a5973b00ee70dd11e4e0693717c0a946bebb688c9","first_seen":"2025-10-07T02:47:44.597641Z","last_seen":"2025-11-04T03:43:31.348568Z","times_seen":2,"resource_available":false,"data":null}},"time_used":647,"timings":{"blocked":173,"dns":1,"connect":45,"send":0,"wait":83,"receive":212,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/65c1b428d4328e6d63d0f60a_dot.png","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/65c1b428d4328e6d63d0f60a_dot.png HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/common-website.webflow.shared.fce88bee2.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: image/png\r\nContent-Length: 561\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nConnection: keep-alive\r\nETag: \"68d806dc-231\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":561,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"b671f018595882719829b0663cfcb160","sha1":"a83c23dfec8a4907a2a6a3e3fb8dab43c926c41c","sha256":"61ab1dfdf1cdc088955d7213508fbce6aee6c1c4615b8aeb787b9fb00df3d80d","sha512":"4a5252704644913c1b1b2026ca5d4f6ed4834ba883df74995c96b9b35e5fd86650175b52de53ec8723eba6c9c6566d6ac705b6f6255bb952ba6fce07af67f704","ssdeep":"","tlshash":"c2f096c7e9c4c28c0a0d1652a2e1a6c37c31531cb6f1480fbc02360484780f02b3031a","first_seen":"2025-10-07T02:47:44.586672Z","last_seen":"2025-11-04T03:43:31.349651Z","times_seen":7,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/65a81949a962d7df13cc953f_MDNichrome-Regular.otf","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/65a81949a962d7df13cc953f_MDNichrome-Regular.otf HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/common-website.webflow.shared.fce88bee2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 71828\r\nLast-Modified: Sat, 27 Sep 2025 15:46:34 GMT\r\nConnection: keep-alive\r\nETag: \"68d806da-11894\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71828,"size_decoded":0,"mime_type":"application/octet-stream","magic":"OpenType font data","md5":"fc9f8478e4e1fa06e84ed5d6dc74ae6c","sha1":"73b78e94154b15c55158b996da77ca5db3001df2","sha256":"24d8e7833085bb5ed8cf8fef7b2d22378b9e669003f9260b4ec9ff2071010133","sha512":"c2a92e5713f672217bf2384b5bc1d81f278d3e1e5d6f02fca178c280d7c78c27ceb75530a98fb43bfeed268f075284305aeec95deaf1ea29e0bc9d8b999c5b34","ssdeep":"1536:Jzjf5FVgpg8mCphY0JVtmvfDm30BLEiAV:Jfjx8mCprWdBLQV","tlshash":"5b637d05bb522702d21759370ea3c7314b2bf044ef2fc75bb54601f89d8d39a8e766aa","first_seen":"2025-10-07T02:47:44.589057Z","last_seen":"2025-11-04T03:43:31.350849Z","times_seen":7,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/65a81af1c0267b4625b151e9_GT-America-Mono-Regular.otf","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/65a81af1c0267b4625b151e9_GT-America-Mono-Regular.otf HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/common-website.webflow.shared.fce88bee2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 74868\r\nLast-Modified: Sat, 27 Sep 2025 15:46:34 GMT\r\nConnection: keep-alive\r\nETag: \"68d806da-12474\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74868,"size_decoded":0,"mime_type":"application/octet-stream","magic":"OpenType font data","md5":"de6fa190ed9a266ff3e8cb5c17fba126","sha1":"a4642361aba33dfc05a6fad7e5368d9df45653b4","sha256":"c8b7827f6a0a137d14ab3b0c250f79805e4f4f46e83f04420cffece0257ec4ad","sha512":"55ce6852153ee5d511d24790c54cf89d8fc5f5d67d99b2cf98853edd33d53aef71b71c866f45e851aa8dcf6b22e63cbf0f8687308542ff10028ba35f24e93267","ssdeep":"1536:hE+heO5Eu5xD4sY1WrDdveunANRB8Ty/a+YaYaWh1CcrE13F:hJhvv5OsG0Ddv/nANr8Ty3Wh1DrE13F","tlshash":"d973bebabb2bcb89dac10ef712b617e07757f42c962fd61b9e4ed4585cc10580b960c8","first_seen":"2025-09-18T14:00:19.520521Z","last_seen":"2026-07-08T10:42:00.748175Z","times_seen":22,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live//airdrop/secureproxy.php?e=ping_proxy","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET //airdrop/secureproxy.php?e=ping_proxy HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/airdrop/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:43:00 GMT\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 4\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Max-Age: 3600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-08-01T09:09:08.987257Z","times_seen":8977,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/merkletreejs@latest/merkletree.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/merkletreejs@latest/merkletree.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 0.6.0\r\nx-jsd-version-type: version\r\netag: W/\"3a393-ow5VcB3yNddBHZ9Yv78eUVMKtdU\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\nage: 30367\r\nx-served-by: cache-fra-etou8220102-FRA, cache-hel1410033-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 54223\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":238483,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"67ce418e4d67b79b2e9d44050119f0d6","sha1":"a30e55701df235d7411d9f58bfbf1e51530ab5d5","sha256":"726fc8775a8aa08138293a5955dd14f9c2cb8b566f1c577f5d39c986bceab3a9","sha512":"827ddbae75068bcb5c45b95a5a33e8ef5f1f09cc8d5e580e17eb5370959970e8c0280d7edf8ed5e180390397c44ae8ff5861db566fa855bff17a52558a178956","ssdeep":"3072:6cBV39NAtLr/rq8orpLppLQ8CsPYx7F59U:6m9NAtvLYQVsQx7FLU","tlshash":"b7343bc63685a0a583da71a8043f990ff176e827404cd484e924f8f59cfce9956abf7c","first_seen":"2025-09-15T18:44:44.033997Z","last_seen":"2026-07-11T04:16:11.452106Z","times_seen":2066,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":85,"dns":1,"connect":26,"send":0,"wait":27,"receive":31,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/secureproxy?e=ping_proxy","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/airdrop/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:59 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"d3a2c5195d3791612cb36c8bb4967cde","sha1":"2603794476923e923a4e36a37340aaaf188e6ea0","sha256":"ad61ccc714c883d65041d05a8cf1b67b775c52c338870cb185b87487597c2c78","sha512":"3274b155d5b09fe864219e6f33988fee171f66a045fedf1859f9e8e7f40cb7741bfbfb127e3972201c6c151b2c22a15413f4db8f931fed06b8c9aaa450e3b759","ssdeep":"","tlshash":"a0d02bef904363864811145039c625d2668d13faa43a86a86dc6e487529c53ecd9b9c9","first_seen":"2025-11-04T03:43:31.342041Z","last_seen":"2025-11-04T03:43:31.342041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed3.bnbchain.org/","fqdn":"bsc-dataseed3.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"34.249.98.61","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-dataseed3.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: f921a4b6955351c2e8e49c61df9cbbf6\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4902,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2188b7f1b90a143020f7faf12d10e91f","sha1":"e6a95e4d574d05948b7c8517861a71e6f69b38b8","sha256":"4a8dd94310fc027a042dc9ca0311f20e9341084839e00b8d7a830ab52cdc8096","sha512":"08e8f648099fac2b075f96396f2f9056ac526f12e5843bc16d07fd725fcd74abeed4021a9ed64f53ef3e1dbb57a707ebee71bc51b230f5b5ee4200c2da1d7b1c","ssdeep":"96:oigW53TB2SzrZYpTbDaOTkSO6mdSInccYGS9FzelVLY:r5TB2SzAT/7kSRRrze3k","tlshash":"e6a179f0ee02c891f1be4768f2ddbe0461383726eedc5a4604b45a991ee5a51bd0dccd","first_seen":"2025-01-17T17:24:07.906471Z","last_seen":"2026-07-11T04:16:11.451036Z","times_seen":4821,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Sep 2025 10:42:29 GMT","end":"Fri, 26 Dec 2025 10:42:28 GMT"},"fingerprint":{"sha1":"D8:35:6F:B6:0A:B9:34:D0:88:DF:E4:87:91:52:C1:3E:D2:DC:FF:54","sha256":"E6:1E:18:2E:04:37:28:0F:BB:EA:78:45:AB:02:B5:04:43:9A:03:31:D2:0A:B6:3B:1E:8A:C8:DE:02:A8:C6:F8"}}},"request":{"raw":"OPTIONS /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version\r\naccess-control-max-age: 1728000\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":160,"dns":1,"connect":27,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Sep 2025 10:42:29 GMT","end":"Fri, 26 Dec 2025 10:42:28 GMT"},"fingerprint":{"sha1":"D8:35:6F:B6:0A:B9:34:D0:88:DF:E4:87:91:52:C1:3E:D2:DC:FF:54","sha256":"E6:1E:18:2E:04:37:28:0F:BB:EA:78:45:AB:02:B5:04:43:9A:03:31:D2:0A:B6:3B:1E:8A:C8:DE:02:A8:C6:F8"}}},"request":{"raw":"POST /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: application/json\r\ncontent-length: 229\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version\r\naccess-control-max-age: 1728000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":229,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"42e136a22281d105bd21fa496816706c","sha1":"bc02950079004b0d4f4bea3888dfd4517cddeeff","sha256":"ede226c79ae326ce9e4b099e9f4dbb4e3d7807da2b793bdfadfafeeb84d7175a","sha512":"a41403da8b9e698eb2823bbe0925160b68682c55d4c64e5c8b27193f8fd8bf4fd118179d26eadb446ed41c2c9c12d46523b6f5094caadaae8a03ba3c1d6bade5","ssdeep":"","tlshash":"33d02313c6470537e34f4633371567c4f559705071105f1b4e1c0315024f97b0255351","first_seen":"2025-04-07T11:34:31.00119Z","last_seen":"2026-08-01T11:57:55.230769Z","times_seen":3009,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\ncontent-type: application/json\r\nContent-Length: 60\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: 04ab70ef320ec1c922b05cc550220c8a\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9fcc35a6af1d66d44cd2080df92dfbe8","sha1":"60031095e2797c659d43017a0e4b86c34a61bcaf","sha256":"353e3d3edc78ebd2e7ce43717cbf8756584bc56703bf9f2324981e69cb1a4923","sha512":"6ee67e3ce69173815b0cfa5352ee9af4f48404ab0f094dc6eb8657eb97a56f622b9e7f2446126f51d7bda2143e66973a5c333d207bd04f07c001c687717b10f2","ssdeep":"","tlshash":"9a9004c15f070731401c4c01d004004031d33f4c05041f04444d4d44715c147534c335","first_seen":"2023-04-05T20:32:46Z","last_seen":"2026-06-28T16:47:47.431145Z","times_seen":852,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"relay.walletconnect.com/?auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtzUGk3MUZlOUhyc3RxWG5RdlBUd1hlaURaY1NWbUF3enRzM05LS1V6dnRUciIsInN1YiI6Ijk1MTYwNTZmMTQ2MDE0YWNlYWVkNTFjN2RkNGI4Mjk0NjZhMzVjZjE5MDk0ZDJkODk4MjJjMWFjYmQxZjBhNDkiLCJhdWQiOiJ3c3M6Ly9yZWxheS53YWxsZXRjb25uZWN0LmNvbSIsImlhdCI6MTc2MjIyNzc4NCwiZXhwIjoxNzYyMzE0MTg0fQ.yXpDwEPpfXrY47cnIoBU7S8AoEpMBqz777IqESt4dCi65pUMYfcOOfUJmAVD3Bsc2_JMtngsjhIzmO7VsfdXDQ\u0026projectId=426969826faddfc2e6b9c42064be7706\u0026ua=wc-2%2Fjs-2.10.0%2Fwindows10-firefox-134.0.0%2Fbrowser%3Acommoncheck.live\u0026useOnCloseEvent=true","fqdn":"relay.walletconnect.com","domain":"walletconnect.com","tld":"com"},"ip":{"addr":"18.156.180.228","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:04.415Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"relay.reown.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Mon, 24 Feb 2025 00:00:00 GMT","end":"Wed, 25 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"77:1F:F6:43:58:BA:99:EF:17:DA:36:56:64:00:93:DC:DC:CA:22:33","sha256":"43:92:41:1C:5A:82:88:58:5A:B5:F5:7A:76:0B:14:77:B8:73:93:94:A1:1A:96:DA:77:17:C0:05:E0:AB:79:8B"}}},"request":{"raw":"GET /?auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtzUGk3MUZlOUhyc3RxWG5RdlBUd1hlaURaY1NWbUF3enRzM05LS1V6dnRUciIsInN1YiI6Ijk1MTYwNTZmMTQ2MDE0YWNlYWVkNTFjN2RkNGI4Mjk0NjZhMzVjZjE5MDk0ZDJkODk4MjJjMWFjYmQxZjBhNDkiLCJhdWQiOiJ3c3M6Ly9yZWxheS53YWxsZXRjb25uZWN0LmNvbSIsImlhdCI6MTc2MjIyNzc4NCwiZXhwIjoxNzYyMzE0MTg0fQ.yXpDwEPpfXrY47cnIoBU7S8AoEpMBqz777IqESt4dCi65pUMYfcOOfUJmAVD3Bsc2_JMtngsjhIzmO7VsfdXDQ\u0026projectId=426969826faddfc2e6b9c42064be7706\u0026ua=wc-2%2Fjs-2.10.0%2Fwindows10-firefox-134.0.0%2Fbrowser%3Acommoncheck.live\u0026useOnCloseEvent=true HTTP/1.1\r\nHost: relay.walletconnect.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://commoncheck.live\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: KgklJ/qysOMbXq9Hxmr0zA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nconnection: upgrade\r\nupgrade: websocket\r\nsec-websocket-accept: v6dqx5wfqWicedvrWtqW51Bxd2s=\r\ndate: Tue, 04 Nov 2025 03:43:04 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":83,"receive":1,"ssl":293},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/scroll-3.16.5.js","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:55.281Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/scroll-3.16.5.js HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 29 Oct 2025 18:29:15 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69025cfb-28fb64\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2685796,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d23f60659e364e0f974fa895faa40efc","sha1":"e7dcac31f09f4943eee0b5a69788e6910b1b9e0e","sha256":"67f33b8e0e3d889a2801212dd43c4880699dcee4caa8c2b0728942f57f1e3020","sha512":"f1f47406a136bda2106b433d02f4d048651621ed49e55a4dfb5d5727b8059c11c1da4c37d22694741e28c5c9c2f01b1ce8d4a6c481d1ec9c78bb804e75cad99f","ssdeep":"24576:/LAHso0F4OEsnX1LNgthNcdmIgTJzaoOcbD1b9WhBj:zAMo0F4O15gEjotDu3j","tlshash":"802501911c8798d5cf8616afc0b79d8ac18459d6ce8cb5dbe93cec8270acfd081d716a","first_seen":"2025-11-04T03:43:31.356463Z","last_seen":"2025-11-04T03:43:31.356463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":37,"dns":0,"connect":0,"send":0,"wait":43,"receive":311,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.6.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.426Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 23:42:06 GMT","end":"Thu, 25 Dec 2025 00:42:04 GMT"},"fingerprint":{"sha1":"0C:CD:24:B7:B0:CE:FE:13:D4:74:92:88:E5:8A:19:06:1B:6E:63:58","sha256":"0A:01:7A:C2:3C:74:E6:03:26:29:BB:69:4E:28:E2:F1:01:93:57:7A:C8:02:E9:3E:47:23:C2:D6:66:65:DA:08"}}},"request":{"raw":"POST /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nContent-Type: application/json\r\nContent-Length: 130\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\ncf-ray: 99911ac53ed94c11-OSL\r\ncf-cache-status: DYNAMIC\r\nallow: OPTIONS, POST, GET\r\ncache-control: no-store, no-cache, must-revalidate, private, max-age=0, s-maxage=0, proxy-revalidate, no-transform\r\ncontent-encoding: gzip\r\nexpires: 0\r\nvary: *, Accept-Encoding\r\npragma: no-cache\r\naccess-control-allow-credentials: false\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nsurrogate-control: no-store\r\nx-cache-buster: 1762227779518_li06o86\r\nx-cache-status: DYNAMIC\r\nx-client-country: NO\r\nx-client-ip: 91.90.42.154\r\nx-original-url: https://api.mainnet-beta.solana.com/\r\nx-proxy-contact: support@corsproxy.io\r\nx-proxy-mode: cloudflare-snippets\r\nx-proxy-region: unknown\r\nx-proxy-response: true\r\nx-proxy-service: CORS Proxy\r\nx-proxy-time: 103ms\r\nx-proxy-version: 2.1.1\r\nx-proxy-website: https://corsproxy.io\r\nx-ratelimit-conn-limit: 40\r\nx-ratelimit-conn-remaining: 39\r\nx-ratelimit-connrate-limit: 40\r\nx-ratelimit-connrate-remaining: 39\r\nx-ratelimit-endpoint-limit: unlimited\r\nx-ratelimit-endpoint-remaining: -813\r\nx-ratelimit-limit: 1000\r\nx-ratelimit-method-limit: 30\r\nx-ratelimit-method-remaining: 29\r\nx-ratelimit-pubsub-limit: 5\r\nx-ratelimit-pubsub-remaining: 5\r\nx-ratelimit-remaining: 999\r\nx-ratelimit-reset: 2025-11-04T04:42:59.518Z\r\nx-ratelimit-rps-limit: 100\r\nx-ratelimit-rps-remaining: 99\r\nx-ratelimit-tier: free\r\nx-report-abuse: abuse@corsproxy.io\r\nx-request-id: f772f32c-98d5-46e7-94e8-241e12486228\r\nx-rpc-node: fra113\r\nx-timestamp: 1762227779518\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=Yv0cNYLIfgaieNBVxK9izYFg%2FoNYTXzldr4tjuR79NTF2MXR6TOZ9owbd40H7L%2FACIMtu9%2FgljDFXkQbSlTxDHD6JeXhJBISlVH5C%2FfFYigikU%2FhxyVgJfZfAxc%2B2w%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1235\u0026min_rtt=460\u0026rtt_var=1569\u0026sent=9\u0026recv=13\u0026lost=0\u0026retrans=0\u0026sent_bytes=4102\u0026recv_bytes=1571\u0026delivery_rate=7554782\u0026cwnd=255\u0026unsent_bytes=0\u0026cid=6be43ba57847f258\u0026ts=148\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":326,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a19bb8f6fdf17a5b9daf68198499c4b9","sha1":"72a79974942364cf2b732575cf65e46f341795d1","sha256":"15dab44c97093970bc415ea7f83ee7def057ff27aad28d703e2e315ce640f6f7","sha512":"79df386d0e5d437c09e0e6f64d39a90778714bee5b1f756ff955fe49b8e5bba23dde59fa9eb35364335dccb3207812d408ecdfae55150463f917afb312094977","ssdeep":"","tlshash":"7de07d843d0a0b7faae58f43ea1c63cef2c0159d1740494a5bd4159572c14cdb49fab7","first_seen":"2025-11-04T03:43:31.35774Z","last_seen":"2025-11-04T03:43:31.35774Z","times_seen":1,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Nov 2025 07:43:05 GMT","end":"Sun, 01 Feb 2026 08:42:55 GMT"},"fingerprint":{"sha1":"BE:9D:76:9E:9E:2C:F2:8E:38:C4:E9:42:11:6A:45:24:E9:59:0A:5F","sha256":"D1:C5:0F:C4:11:DF:FE:54:9C:EF:8C:40:56:6C:79:4E:F3:E6:0B:24:15:B8:E1:60:2B:49:C2:41:96:C9:79:83"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 99911ac85caab51b-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":26,"dns":3,"connect":1,"send":0,"wait":119,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"explorer-api.walletconnect.com/w3m/v1/getInjectedListings?projectId=426969826faddfc2e6b9c42064be7706\u0026sdkType=w3m\u0026sdkVersion=js-2.7.1","fqdn":"explorer-api.walletconnect.com","domain":"walletconnect.com","tld":"com"},"ip":{"addr":"104.18.26.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:04.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletconnect.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Oct 2025 05:12:37 GMT","end":"Thu, 08 Jan 2026 06:12:35 GMT"},"fingerprint":{"sha1":"6F:67:8C:9D:A8:56:6C:B0:F5:05:DB:8D:8E:85:DF:6E:07:0E:6F:76","sha256":"06:AB:5B:0E:48:19:03:CE:1F:04:BC:45:93:8E:C6:21:72:FD:C2:CD:A0:20:86:5D:76:21:91:30:B9:CB:9D:49"}}},"request":{"raw":"GET /w3m/v1/getInjectedListings?projectId=426969826faddfc2e6b9c42064be7706\u0026sdkType=w3m\u0026sdkVersion=js-2.7.1 HTTP/1.1\r\nHost: explorer-api.walletconnect.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, s-maxage=86400\r\nx-robots-tag: noindex\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 99911ae30bd256cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":404282,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e918e51742ad6771c53120acd445c392","sha1":"74d0d899f124a7cb8c3daa26202140a3c8d07fc3","sha256":"0f333b4e3bd98e563de59137487ebe0000c65435b9e4980670995e466a3f49dd","sha512":"2235172d56c6a602163f59ad0d0dc6ae44973baf285ca7c7fba3f2309a72ec0d04af79642875dfe15ed5ca9eb9a2df4820fa5687816225231eb2db9dcb3080b7","ssdeep":"3072:l2Efa6BUVm7TZNZm5BewjtRlAkwuBCWMZ/OZDmDaf5AylQuP:VzBUVm7Du0W155FXP","tlshash":"0a8443bb8f848f6b1b280bc9212d3d6c999e295bcbc55df6f080cf1844f4af92315566","first_seen":"2025-11-03T18:03:38.861518Z","last_seen":"2025-11-05T10:21:08.21784Z","times_seen":26,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":42,"dns":20,"connect":3,"send":0,"wait":283,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/common-website.webflow.shared.fce88bee2.css","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:55.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/common-website.webflow.shared.fce88bee2.css HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 27 Sep 2025 15:46:34 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68d806da-1faba\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":129722,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"362a447910498f25a622fcdfc8c87d47","sha1":"be74f0f14ff5a3a3222ff80e14ed64606fd4bc42","sha256":"71a0a1a96290fd513f70dd6d7c7c25dfb92e691bf1af76bfd5d6533920c0a2cf","sha512":"98c8dc725fcbb9fedb814eaace864b6c038a9600a97298a33fa76fec2129314487fb9508b60ece607cd4e2a1d29c400869a4d063ff70b8ed3a8c22dc94dc0167","ssdeep":"1536:Ay7EeqyP0XcPyjowejwA6e8cQhc3mrlI/Gjt3VIi64LghklvJQXv28LbU7UB:4yP0XcPyfA6rcWr1P64UhOmHYQ","tlshash":"ccc342857bf12408b41f94a5d8eba654b32a8483c74fcea6b9e0305ddfc82d51873f98","first_seen":"2025-10-07T02:47:44.612235Z","last_seen":"2025-11-04T03:43:31.360826Z","times_seen":6,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":91,"dns":0,"connect":40,"send":0,"wait":82,"receive":1,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/secureproxy?e=ping_proxy","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:55.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/airdrop/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"d3a2c5195d3791612cb36c8bb4967cde","sha1":"2603794476923e923a4e36a37340aaaf188e6ea0","sha256":"ad61ccc714c883d65041d05a8cf1b67b775c52c338870cb185b87487597c2c78","sha512":"3274b155d5b09fe864219e6f33988fee171f66a045fedf1859f9e8e7f40cb7741bfbfb127e3972201c6c151b2c22a15413f4db8f931fed06b8c9aaa450e3b759","ssdeep":"","tlshash":"a0d02bef904363864811145039c625d2668d13faa43a86a86dc6e487529c53ecd9b9c9","first_seen":"2025-11-04T03:43:31.342041Z","last_seen":"2025-11-04T03:43:31.342041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":110,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/flex_the_access_in-situ%20(1080p).mp4","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/flex_the_access_in-situ%20(1080p).mp4 HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 863937\r\nConnection: keep-alive\r\nLast-Modified: Sat, 27 Sep 2025 15:46:36 GMT\r\nETag: \"d2ec1-63fca4eaa6f00\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-863936/863937\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":863937,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"f91962b106af867ea0be8005d834a665","sha1":"e958dc117b4936ed7c40b8da8738d6ecd32d3c90","sha256":"416d3aa8201d1a892ecff595a852da37add453c66bff035ca5ebd4785d69f48a","sha512":"ce469c2e3bb58149f7f3511bb882e89a5ca7f31d8f3e5a727f47b8de6af785f3ecb9b2d0b057e1d6d29b0c64f3f3ff2bc7f327f1b2f0405ee08185211ee7e890","ssdeep":"12288:14z5wN/wktZ6RtlnEMnJP5cfQvjhBB6YCsnzOpX9Tswy3w38lfYRkkMEMATB0Se4:1oXnF/4QvjhRCrhYfQOkMVcB0LmmP5sR","tlshash":"1b05230b2be67e27c50053fed80e936ab72eed204e47530bd5d835581f9e085ce569d8","first_seen":"2025-10-19T02:11:00.619461Z","last_seen":"2025-11-04T03:43:31.362229Z","times_seen":3,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.6.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Sep 2025 23:42:06 GMT","end":"Thu, 25 Dec 2025 00:42:04 GMT"},"fingerprint":{"sha1":"0C:CD:24:B7:B0:CE:FE:13:D4:74:92:88:E5:8A:19:06:1B:6E:63:58","sha256":"0A:01:7A:C2:3C:74:E6:03:26:29:BB:69:4E:28:E2:F1:01:93:57:7A:C8:02:E9:3E:47:23:C2:D6:66:65:DA:08"}}},"request":{"raw":"OPTIONS /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Tue, 04 Nov 2025 03:42:59 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\ncache-control: no-store, no-cache, must-revalidate, private, max-age=0, s-maxage=0, proxy-revalidate, no-transform\r\nexpires: 0\r\nvary: *, accept-encoding\r\npragma: no-cache\r\naccess-control-allow-credentials: false\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nsurrogate-control: no-store\r\nx-cache-buster: 1762227779392_ctqg1lj\r\nx-request-id: 67651527-0613-4870-8443-600aabad9dd1\r\nx-timestamp: 1762227779392\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fzWaRVblYYmxz0gAi3wbBQJ4uSWMPywgpXHn%2BBktKhaHWBQn36Yu61hyJmtGQOHUgrtXqEN%2FRU9bP2cisl8lMxHhEnwGWEUTtuJ8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\ncf-ray: 99911ac52ec44c11-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T18:31:37.666088Z","times_seen":17658324,"resource_available":true,"data":null}},"time_used":125,"timings":{"blocked":59,"dns":40,"connect":1,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:59.859Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Nov 2025 07:43:05 GMT","end":"Sun, 01 Feb 2026 08:42:55 GMT"},"fingerprint":{"sha1":"BE:9D:76:9E:9E:2C:F2:8E:38:C4:E9:42:11:6A:45:24:E9:59:0A:5F","sha256":"D1:C5:0F:C4:11:DF:FE:54:9C:EF:8C:40:56:6C:79:4E:F3:E6:0B:24:15:B8:E1:60:2B:49:C2:41:96:C9:79:83"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 99911ac84ca3b51b-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":29,"dns":1,"connect":1,"send":0,"wait":118,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.77.127.201","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:00.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\ncontent-type: application/json\r\nContent-Length: 60\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: b5b5b6674dc9b68f1fbe1ecd19a61c96\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7855aabe1be2e1d4d9683a6508186546","sha1":"afe530f59475b81e9189721d7f2cc0cc38fc37f0","sha256":"64fa9bad3274e0dc928755d2d8d827dbe0470406cc1a29ee19f6cd8f35ccbe75","sha512":"1426d53d0ace9b019e31f73fd9a565c2ea6c3def699cde763073d7fc1f0b61a7ae7cad746adff9ad1539a1331bad225d558825f5434a56f38ab73b676a34c609","ssdeep":"","tlshash":"979004c115070731401c0c01d004004031c33f5c05040f04444dcd457154147730c335","first_seen":"2023-04-05T17:45:40Z","last_seen":"2026-07-01T02:45:34.001982Z","times_seen":2186,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"explorer-api.walletconnect.com/w3m/v1/getDesktopListings?projectId=426969826faddfc2e6b9c42064be7706\u0026sdkType=w3m\u0026sdkVersion=js-2.7.1\u0026page=1\u0026entries=9\u0026version=2","fqdn":"explorer-api.walletconnect.com","domain":"walletconnect.com","tld":"com"},"ip":{"addr":"104.18.26.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:43:04.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletconnect.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Oct 2025 05:12:37 GMT","end":"Thu, 08 Jan 2026 06:12:35 GMT"},"fingerprint":{"sha1":"6F:67:8C:9D:A8:56:6C:B0:F5:05:DB:8D:8E:85:DF:6E:07:0E:6F:76","sha256":"06:AB:5B:0E:48:19:03:CE:1F:04:BC:45:93:8E:C6:21:72:FD:C2:CD:A0:20:86:5D:76:21:91:30:B9:CB:9D:49"}}},"request":{"raw":"GET /w3m/v1/getDesktopListings?projectId=426969826faddfc2e6b9c42064be7706\u0026sdkType=w3m\u0026sdkVersion=js-2.7.1\u0026page=1\u0026entries=9\u0026version=2 HTTP/1.1\r\nHost: explorer-api.walletconnect.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://commoncheck.live/\r\nOrigin: https://commoncheck.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 03:43:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, s-maxage=86400\r\nx-robots-tag: noindex\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 99911ae2fbd156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7646,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"41ce6c505e2336edbec2c19ebee86df5","sha1":"8d1657773c17d0f3a84e7b7945bc34a7a22a4033","sha256":"7ddb72d7c4e186c0a607e5b04ac3cc7b5b6ddd464cdc04865ccc50d3fb30ab9b","sha512":"a29b27b4844df542c2973ea9c2058a6ca5d2c87d8880c64d66806768716e9aa9a80bdd8fd00ea1984eb30cdbee0164aca252288e013d920f70cfc2d71a73daf7","ssdeep":"96:nNSNbhWYiOlsDdSWWvjhfW3jls7UdVbqb+Oh+959Jwt2te72WDOZurozbqpqZhjV:vOu4/cfv9n6t4TV","tlshash":"daf133bb8f844e6b1b2447c8301d3d5c56af244bcac56de6f090cf2884f89fa27525a6","first_seen":"2025-10-16T02:46:09.401577Z","last_seen":"2025-11-04T09:43:31.432088Z","times_seen":68,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":43,"dns":21,"connect":1,"send":0,"wait":279,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-04T03:42:54.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/ HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:55 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 11922\r\nConnection: keep-alive\r\nLast-Modified: Wed, 29 Oct 2025 18:29:55 GMT\r\nETag: \"ed7c-6425051aff561-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60796,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28738)","md5":"5fb89b25dfb286c15f487c7d6e31d182","sha1":"0d06a94db77353bc9a63ae73e4260192920a59a0","sha256":"5a1013bb52965632c81a22d60014219554968b407ec1b30b83fefeb7dccf6576","sha512":"3efea81d2ba2290d7ad80f621d614f2103a228352e9a56d0bf26beec6f8cff78e4b315d86a588c65e26a2213f04d928bf3b29f9cc30b15e1ae12fc60d2677688","ssdeep":"768:kboQv9Cq8DXgP2boJrg9gvEIhU9zBU9zryQvDX6jgjgVqUK7mO2VvgZHifo7o:kLAkjsK7mO2Vvgdex","tlshash":"aa53fb70d5e4107ba5070acae5bb6b4e36ca768bce830488f6a59352cff6dc5ec10e15","first_seen":"2025-11-04T03:43:31.36533Z","last_seen":"2025-11-04T03:43:31.36533Z","times_seen":1,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":129,"dns":46,"connect":40,"send":0,"wait":80,"receive":1,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"commoncheck.live/airdrop/65a81abcfcd2ced445754c23_GT-America-Standard-Regular.otf","fqdn":"commoncheck.live","domain":"commoncheck.live","tld":"live"},"ip":{"addr":"185.107.74.113","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://commoncheck.live/airdrop/","date":"2025-11-04T03:42:58.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"commoncheck.live","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Oct 2025 18:54:05 GMT","end":"Mon, 26 Jan 2026 18:54:04 GMT"},"fingerprint":{"sha1":"14:3C:4B:A8:8C:17:E4:F8:F5:0C:12:E8:1A:8A:91:B2:65:46:7E:20","sha256":"F3:10:A2:03:E4:9D:87:75:EB:F4:3C:43:E6:6A:AE:18:FF:3F:03:6E:68:C3:54:F4:9F:1B:99:A5:13:52:1B:DD"}}},"request":{"raw":"GET /airdrop/65a81abcfcd2ced445754c23_GT-America-Standard-Regular.otf HTTP/1.1\r\nHost: commoncheck.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://commoncheck.live/airdrop/common-website.webflow.shared.fce88bee2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Tue, 04 Nov 2025 03:42:58 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 105480\r\nLast-Modified: Sat, 27 Sep 2025 15:46:34 GMT\r\nConnection: keep-alive\r\nETag: \"68d806da-19c08\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105480,"size_decoded":0,"mime_type":"application/octet-stream","magic":"OpenType font data","md5":"e8cb4c90d580a9077a3d6dc1fabd689b","sha1":"33be05819ae5c0f769f35506699a61e5526d2f5c","sha256":"063c39b4d7d2f9e4dba6eaccf2256443799ee51716fa0d2890e0f7aad509e942","sha512":"315828ff1afb4e760e1a297a0592a5e9ef0fee4e96500e21c161770e29829ecbe9f0f2555f1841fefb2789bd7518ebe261ed47e043c11ae3abd93bb1e7f67d08","ssdeep":"1536:8qCDjIt1kwEDyssejVjJ2jQql00OfeZjTiCGA63fnalTR1sCPy3i3gPwv:8pjFwls9J2UqlAedTzG54TxOiRv","tlshash":"99a3bf5e3f036b01ebc29d361ae7c7f4236174145e6b9e1bb296c5e05de13e80e496c8","first_seen":"2025-06-02T11:01:25.092994Z","last_seen":"2026-02-16T15:07:11.417342Z","times_seen":12,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"commoncheck.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}