{"report_id":"a43b93dd-42b1-4148-86dc-ab115af4cd3c","version":6,"status":"done","tags":[],"date":"2026-01-24T13:46:42Z","url":{"schema":"https","addr":"eigcnlayer.xyz","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"172.67.142.6","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"eigcnlayer.xyz/","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"title":"Eigenlayer App","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T13:46:20.042109Z","times_seen":17903490,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"eigcnlayer.xyz","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"172.67.142.6","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-28T13:46:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"eigcnlayer.xyz","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-06","domain_rank":0,"first_seen":"2026-01-14T14:10:31.566526Z","last_seen":"2026-01-14T14:10:31.566526Z","alert_count":87,"request_count":29,"received_data":4563986,"sent_data":12204,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"eigcnlayer.xyz/request-4.4.19.min.js","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"64f165d17d129265b478cc1a38ed687f","sha1":"7fe4d59794800eb09842b979491b1bd2c35c37d1","sha256":"1d4f7c314c79a0580e4c042fba605ea534fb76ea4a6db320d1ee99c56c105566","sha512":"4753e1529fd98d9b385869ca58d2d08a0ac6d3a681da4c02070272cc16431f042cef3783e616a2581960a8307116c98a03e8de55ededf5ad426b3e7f7a36afc4","ssdeep":"768:8+mVfcSVyWs6osMHnKzzFRKtj23RnY96yeysD311Ta781MeW6c0cP9cVcYSgahcu:8yWeuniGzWFBIPA+G","tlshash":"8273b4ca5d4bd0d08e6215dde873e865e4280923ceadf1aba52cdec1742df66c48713b","size":76994,"data":"","first_seen":"2026-01-14T14:10:35.587615Z","last_seen":"2026-02-14T05:33:46.674857Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/14.png","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/14.png HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 65853\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: \"695c6833-1013d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FYEgC1id2EIF5ytnnVCN6OyaOqRZPtK6GmO8pVuEt7faeCp713x73p5uJk46Caeum5fFpy2HmyC8mbsgKeAlB4%2BewoMd%2B4xtpVY%2B7JlL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae6a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65853,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 456, 8-bit/color RGBA, non-interlaced","md5":"d9ceea357f105bac2fe2f24a93334f5d","sha1":"69fa5adc620638b94a2f089a82d235529eeca2d8","sha256":"3be467e9039007918d33edc64094a905767fa634b015b01851ac6baaa33a2e0e","sha512":"70b4f0ad6cd01b2983684275945a269694471fce0071b47b0898f2a61a8831f8e4fdd3f5be4397cafd2eb4a732e9548d8b9b5f37e0c6d4c224f9ca2344c7a4aa","ssdeep":"1536:Hnr2vCQLZm8uspKc4sKVPry0uzFPLvEZy4b4StZDw:HUCWZm8usphfKVzEZEM4bvZM","tlshash":"3753f1a38e575d46dcb94d36b8750efa3afb018ea270512dfa236e1e4601a7cf940c25","first_seen":"2025-10-09T03:33:13.700746Z","last_seen":"2026-03-28T17:28:38.079288Z","times_seen":7,"resource_available":false,"data":null}},"time_used":374,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":279,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_3.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_3.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-3978\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YQAJ33lMDuQgqRHeJYcY50CAGY7a2kTwUFHWAlss5Hxl1Go58rcVgqofktKTmfuJgrIpLOoFZSUgzTVbFUu5SEQ56IZiCLafB2XbAVXk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9ef9e2e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14712,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14712), with no line terminators","md5":"d8501529dc14c6c6842a2d9dfe9db11b","sha1":"e56684dd6bed421e7f261899ae2d6c138f54dbb7","sha256":"9e496c6ebd54008716496e9541965e774eab0ffbee96e8b32e7aa4505c5e307c","sha512":"6c6ce85fcf724280a05e14531aa44c3d286bc663606bc587f7f3d1c83d2cbb8fa2da5cdcbb1a7459dfe641b8748366cd5ef8e2a3ec57ff9bd12045e44b6b7df8","ssdeep":"384:qClfKRd8MtQA77VPZXwGE6WsSoZALoReQk+K3:qefKR6kZXwGE6WsSoZALoQ","tlshash":"c9623276fa537079792f2b3ba9c4eb0c4295d980dd430fb4fd00a1ac17cadd51da6a88","first_seen":"2026-01-14T14:10:35.513015Z","last_seen":"2026-01-24T13:46:45.000887Z","times_seen":3,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/fonts/0.woff2","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /fonts/0.woff2 HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/stylesheet_5.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 64184\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: \"695c6833-fab8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cXPuW5kSlacnCr3cR2pq3zO20He410o83BG2l0jM2dojRbTZv1G5%2FY0xy8TElrVeRyUtpJ2EkwxRUB9zmM%2F6XWUbDH3TO8QlgUkzfwZL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f47bd25ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64184,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 64184, version 1.26280","md5":"20491e7e56de50d32dd643a13ea558a7","sha1":"66ea15a6b79fe55b867f377fa5faeac8ef270daf","sha256":"3b380bd2170a39c9031691eb322b452b3e60e1307463dda0f434110360222c7e","sha512":"92e1ff6c28cdd15e96051a2b57548248414551898b3ac8e07da8ca08563b95a2853f4228cc7006b648d4bc7c9eb082c2d22b623a21b141e96f97dbd35af8fd8e","ssdeep":"1536:n5p0zTisxMZgCg32NWKydqsBlYifmb3AEWJ/pGYdxtks:n5p0zhf13mxswItks","tlshash":"175302f32e53c3fedde3843fb8223a9e684ad49451854fa4cb5a127b0ce24a15da051e","first_seen":"2025-01-27T08:39:26.252594Z","last_seen":"2026-08-14T10:56:11.316253Z","times_seen":333,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/12.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/12.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-506\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kjHAt1A5lY%2FYmlwNBsJeIt7zJxC3FiMZmtp92PEWU1y8E79Vwq6DGnpVPjIWXwsciVPL3PsT7OHIpeu2lrBGHSEnat%2B4k99n%2BFmuDpSc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e5f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1286,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d6cdcdc22ef994bd65f1ce991300ce8a","sha1":"635dcea7b3d7f891542526187e1a808ab92090e7","sha256":"54634be555724fa8c5569778345ef8a159b09fc6c739033265a4fb71e195f599","sha512":"c792dd0f6a4af61c09dee56d3df9233d5b4877ca535b92568b70c7fd48b93d6b4f64165d049acd32216932a484f950b32a9af20c13b8f7d05b3e7c015803abd6","ssdeep":"","tlshash":"272198038891294bb704eaf0b344eb428019cc1a94fd6d210a7d5cb4bbd1a9911bba82","first_seen":"2026-01-14T14:10:35.580684Z","last_seen":"2026-01-24T13:46:44.997652Z","times_seen":3,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/20.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/20.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-620\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NyYZXkZoF5BRveJn%2FaOIALBa23OuGSLBDvJ%2Fg1zlFW4WJst480BHZsdSEtIC2EKs4O1fZZ0o5K333YndCz61iUBDFU2848TvJ%2B3%2BKSc0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f56e905ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1568,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3cb0f36d9e569852cac274dd53534f83","sha1":"576c140823770312c3798b3d191d2cffa8164936","sha256":"464d8ac016dee377bbe65db22542b138091cb77eb03b0c25ab231ab9d899a47f","sha512":"b5ba67810d6e520c9c92d4df4f3f2a41619345c4ea3302156822ce4b3840c82f236c5d2e27d25ee00e84a6d7c48b1454773da39d9c22328346646f829c6cd1ed","ssdeep":"","tlshash":"0e310ae755e8e9c5e947217c207c3f40515f6a045a200177d14a5b730d97ac865ed2ad","first_seen":"2026-01-14T14:10:35.573788Z","last_seen":"2026-01-24T13:46:45.00343Z","times_seen":3,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/17.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/17.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-352\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AVJ1R9lgKg2uQje%2BfW7oI3T80bBcgb8Ryw2RfwJg%2B4I%2F2XyutTP0cwoAlRtYPxHDBVOX5N4zEEk%2Fn56MNZZyxlOj7JhbNQLAfLa5b2xX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f56e735ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":850,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7c6426c60fd61a57fe40408b2811e65b","sha1":"614ac73a90d7a66f57bb47c3a212c749b4238a74","sha256":"1464d7bbbcacc3201690b18e99a1adc3ded142347c4f5ce954ef476187b8da94","sha512":"4b77c09ad78b9c60ccfb2a382f1f2c37371949d35e2dec05a42ea642ba5f979d2834bf97d2638c8c165a1bcc69cca6f6ba4a8053e0f851c2c76cf1fec3eaf4b5","ssdeep":"","tlshash":"620186c876ca85d9cbd09a3cc0a0651245ff8c28dabce5d74376d4af80c826457e28be","first_seen":"2026-01-14T14:10:35.540804Z","last_seen":"2026-01-24T13:46:45.01282Z","times_seen":3,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/19.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/19.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-564\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KcXu2esjQ%2B%2B6SjmTw7H5miJclCTf8UxHh8oJ4lp05rw7mCmXH2jAUXHe2T7DkRKhjXx6K8gIIdyDcMKXW1G0lDPKWcADg3oWZhtpcN2W\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f56e8b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1380,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7f9e8a1015f4ce745aabd54d39c06734","sha1":"bddf9ea94c1d14e72ff237a3b0a9cb1565080b76","sha256":"9a5623f6378995f40477ed5a8544a9707b18df52ab48bd03cc3298f50cab6ecd","sha512":"e65232f9a24bfbc7b3595f4391509f4a7730856d5ac09922c37fdf7e6ddca7a8ad67850fc2df202fd8dd6dc78dd90e29c5efa0edb110455e8c99caa28bf24582","ssdeep":"","tlshash":"de2108cc3dd81781829642e476fe30417acf80d089ac7665c340cd962c2d20cc469d0a","first_seen":"2026-01-14T14:10:35.542749Z","last_seen":"2026-01-24T13:46:45.009178Z","times_seen":3,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_5.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_5.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-43d1\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N6lcejaNRVUzspF3Xo9NB1eACRJ800ahMvmdycxXzDKrgIlDCKgJHrooT3hCKxJmw%2FK1xOfZpShX41CnQNlZNFFjkvZdKgFCGYjcmfBU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9ef9e1f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17361,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17361), with no line terminators","md5":"3366b7984f2d78dcdd478da137d11d36","sha1":"3842c273485f737f8fbed5c515791e32a81a8969","sha256":"19fe987e999699f6a68cfc2596172992a77223020fdd0d598ab1abde5fab0108","sha512":"2bbd23c9eb061c591b6bf0daa02a544989a7b9ae27884f83a052aa3069ced6d3f1e994e058958f383143ad626bd5b98e049de9868e32175594e4ef058fc500ea","ssdeep":"192:Y7JX2S7JX246wkFJbcsfdsffflT0ZbK0xnxvaqjRS/ypCYjNzTm98dKiiyk1Dbx:GJaww4flAcMxi6xzG","tlshash":"d072666dba19142e6c23c0bfe3e4a5cd7209f1c1df1b4badbb1269151fc62e709d2218","first_seen":"2026-01-14T14:10:35.544586Z","last_seen":"2026-01-24T13:46:45.000331Z","times_seen":3,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_2.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_2.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-36c6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EL7tJq8sH%2BfgQJQCkfUCewGyBkhkYvOiCSEl2%2BM%2Fc5bDRbx8L%2B0W77dJIIsdVrzP2NBXkl9ZWtohRFs1D05vND4%2B2hCCFsx7bRcqIY0k\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae615ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14022,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14022), with no line terminators","md5":"bcad7be1cf002a6f413ddbe5153e4f3f","sha1":"1305863f5a3679743203341317e4709a5de29662","sha256":"8c1ebe87298510eab7c3a85a5e9b4f451e77d7e876d9e65fdc9ceb370dfe4481","sha512":"0df785523e6c77da6f44c9928b1fc6841ee6da940c2c7515a67aa73e18ca56ee4f5cf86a0a00c55bb55301877f94c0be2008b329abb8011cea1acb5e389ee798","ssdeep":"192:F5ku1Z1Y/uSYIaL1UyjrV6/h8WqXNeOeYMJQF/35Dqczoz7vQAd75F9D:F5ku1XJO0M3q9hTMJQJ5DqJ7vQAd75jD","tlshash":"aa520b75f912b57b3d1b3dbc51c8c714432258429d839fb8f62a90742bcadd63ce28a2","first_seen":"2026-01-14T14:10:35.575996Z","last_seen":"2026-01-24T13:46:45.009778Z","times_seen":3,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":198,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_1.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_1.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-51b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ILqvOka%2Bvqo8yJadbbXxHhSOUkwiy8npAt3bmh8k%2BAwaaew9qHumUDVPp7AzKgR7QCh2SOYwBjEEcgKtUXKNxIgFLpIHtGzlyrTr1E7P\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae625ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1307,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1307), with no line terminators","md5":"7bc279ff950a6b4d426f2bf798fd8772","sha1":"b528fc3dd391fa6c1aad7a4f850b25120c2cb88e","sha256":"fb2e643caccefc31806ec026bd916d856ac5280edc986f5cc462fafb86732fcb","sha512":"a47aadce160ba4c7d092d31d50b9e51a62f04513f209929f922bb8c7a74f592d4ee5cd7855c00687fd64a27443bb3f81dfb8b0e14a96d8207428e8b8b07fc4dd","ssdeep":"","tlshash":"81213a69f753209a2563556f3510fa6d42eeb180cf024f78fd15bb7a1bd82c748826ac","first_seen":"2026-01-14T14:10:35.555169Z","last_seen":"2026-01-24T13:46:45.00401Z","times_seen":3,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/5.svg","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/5.svg HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jOm5czPeneDmfvuFTxEobZGSd3PatU5TyPiTQUYQ2bwsEzz2DDbmloO4dGl086muELVc2b9s40BPfh9seZOykMY6n%2BCW4ENRfYCLsrOh\"}]}\r\netag: W/\"695c6833-17b\"\r\ncontent-encoding: br\r\ncf-ray: 9c2ff9f54e225ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":379,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f6f042ec25a704519f7ff63f590fae43","sha1":"30d31cf4e097bb68661701400f1cb85dbc168282","sha256":"13edb716d9352ec2613ee4d68a672685906160b3e26e1dad2e10389a1162eb34","sha512":"6583610e07147456f852d103e2c183998c953c7cb4ea318d47fb0e3feb3da5dfd65e2070df6cea2c280042f22b2c8fcb4d7f2483f28e738155fdd727bbc64b8e","ssdeep":"","tlshash":"d7e0d8acc168ddd5442c42b4ee38ffb160d698d3244105ece6d436ce1528bbe180426d","first_seen":"2025-04-08T11:36:32.424793Z","last_seen":"2026-03-28T17:28:38.091414Z","times_seen":17,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-24T13:46:18.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CBAY69X6cORz8WBAZRAsF5tXT8f2w5T%2FkmXiNHMXaEWgQtUyfLhgIJ8v7li5m9EWndZPlbaGKUTgE2pH%2Behr%2BUzedjJTQ%2FSdfG%2F11g%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c2ff9ebdb3d5693-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":82694,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (38342)","md5":"c538d7302291f46e72964fa1b311b545","sha1":"b690a16689294bfdcafb56e7ef763255a38d070f","sha256":"7149f223441cf770fde2d0aa5b69765787bc457d4f5776c7c259f4136be14d3d","sha512":"4a23091563d3a9edc56beff82213fdb11ee961b2f406abc8a9498f83a99347aef8cca85d0a9ce3254e86e3999af163dc3266b341cc8d86ec4f514c3f614af871","ssdeep":"1536:GszTpdEbHpsPCMW+GCJek+xefDIqeyjFeqMe7bwek0OeT3eLSCeuqtetPsPo3iem:GszT6HTCp","tlshash":"3f83b965a110043f352786f971e4dbad60dbb309ee07a848b3bcc09557ce8b36d7969c","first_seen":"2026-01-14T14:10:35.553456Z","last_seen":"2026-01-24T13:46:44.994095Z","times_seen":3,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":75,"dns":55,"connect":1,"send":0,"wait":259,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/6.png","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/6.png HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 131291\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: \"695c6833-200db\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kTFnrJZ6jXVjitKkkJhhy3uUx2hkIxG7Q09hVCecbxzxQdbmVb8oTY9skFjlv041xb2H2D1fVb7f6DgCdh7HpAaFX58BKyAafL6Witpp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae655ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":131291,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 456, 8-bit/color RGBA, non-interlaced","md5":"715dcb3518b5b370b92c0744ddff54ac","sha1":"66ec61d06ed95bce38cc5d0cb00d56882997d581","sha256":"335f935f76a0e957577fa188586103973fc0cec2383c448821235fb34b3b190e","sha512":"afcf016ff6779983f92af95665d41c96b99c44e3534d1844603236edf87fb3ee6fbd138353c3eb711f5a4e3c649477e04a9528ec0def696de484979742881007","ssdeep":"3072:IO0hc2VlXUEYAn57NxQrSnslQ2Y0zxWBte:H0hKMn5jGSnZNWok","tlshash":"f4d302837353ac8cdedb95025d843bc81af905f6fd5484bb3bb880b94a11f9906e4f68","first_seen":"2025-10-07T12:30:28.698143Z","last_seen":"2026-03-28T17:28:38.08971Z","times_seen":8,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":132,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/8.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/8.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-4cc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m%2FPAJXJoy8Jh4417TBNlqJO2G%2Fxz8X1Scpq23BhLVUFWKtSHNLpvn3ztM9%2Bdw851jnMNx%2B5vfc144Fhf%2FMwh0lyDXxTltIvIwWDnIw%2Fb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e465ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1228,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c3e23392b02483ec509a86b287c620a","sha1":"6dfda7b8d44fa3f6ca3ed84108380969f669f328","sha256":"17d05d1f87d2fe5fd3ecdca2e18076c8e0229b094b0f238e705e66d3e3e323be","sha512":"788d000de3112de7687922e861e2be22e2346ab435b1abb96d880dac36eab590b29b651df83db40108c0afb15c0f60e16cb7c844effc152ff9f5a81efde027ae","ssdeep":"","tlshash":"0821e7ddf9481888cb4a7aac2d5b9eb776460521093b6264182cfcf2c0e4b5f0bdc2f5","first_seen":"2026-01-14T14:10:35.535265Z","last_seen":"2026-01-24T13:46:45.010423Z","times_seen":3,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_4.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_4.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-c9f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0l9vQwVtDw6qER17PK8r0028n71blWPBWM6oFxcVl9H%2BKEu%2Bq5A8DJInVUV0PXuA69QlbDEeD%2BaOZzwfMxOwnTmQR5Xffe2Z3kgdFUfv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9ef9e285ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3231,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3231), with no line terminators","md5":"402dc896b11fa2e9f85bf49784e459bb","sha1":"d77b6b669207c73c92e4a1521f587ee9590f3a1f","sha256":"077a98b94b081b529d5c3b5cd9d8d5ae7aabbbb0520d6f76b87d2f8dab95a64c","sha512":"d34436f2f2f8bd90ee0fbc73cd681d70cac5f6585a803b77b712b14792b6cdbeb8a40b2e91815954f7da12ff1933e994d6d20c9cdb0ab5aaf5d9a38c202d5938","ssdeep":"","tlshash":"f26176b4f4b11357056bce3f83e4ec8e345f8b00961a07a9ffd1e549b908b5b56c91a1","first_seen":"2026-01-14T14:10:35.529247Z","last_seen":"2026-01-24T13:46:44.998952Z","times_seen":3,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/7.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/7.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-3a0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iHKOVgK0TXoVl96%2BT0%2FvogTrpn%2FamrPmEdGDwlmt%2BVzhomPeLYvN62dw4G2oj%2BdEi07eubejRztCy25AyJT7ZNMLW5YR165iefFH5q0k\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e3d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":928,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"943c5396ae752fb283d38c99dadb8e8c","sha1":"92b6f830d8a73fee84c59933d042510aab413498","sha256":"dc18bae6bb0a7568b9a9d0f414f2c65f76f0f0da615d30d4c632701979528a52","sha512":"1efd853f9a0e2f52551bf73d37111de0cf257099ffe76ca324b767e174bbb79e6057bcec1581cc2fb929904e131bf6f727303a6b7cc7c9f040dd0565b87e110c","ssdeep":"","tlshash":"2011bb0c5d967413a74da03f461312bfe47249c0f9588cd1d1160fe78d66017537d04e","first_seen":"2026-01-14T14:10:35.523079Z","last_seen":"2026-01-24T13:46:45.007414Z","times_seen":3,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/13.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/13.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-410\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IzBym8SNvhcMktLWOC3t%2BeOSe7cLeV0dHL4y98If1PGOhzQABoL%2BsQX3TBAEMnWhDcVCNIuTMSClCQpJh909sdiapIxOhxjB%2FI0jMJ0W\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e665ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1040,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b76e3933f0aa47059ca2acb9571299d1","sha1":"c75d8dc142ed1210e6fda9832b4fc2f92e8c5402","sha256":"23c1cff945f1dd5042383d9c532fc2428dc7d2cc52bc78be8232b885a5af66ed","sha512":"32689ad3c1f939b3ec2afc7d29e7600fb6783efa38b9f6ef37527d6b9e579e6e6d74e2fc24ba7ecfa96e5319fcd84a1be5de0af428cec463987a26bd47ccfa52","ssdeep":"","tlshash":"a611a590ea102a3ae7ba622778bc49c69a6f14898efdc0a022ea1c4414e52d02790c93","first_seen":"2026-01-14T14:10:35.548623Z","last_seen":"2026-01-24T13:46:45.008616Z","times_seen":3,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/16.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.408Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/16.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-660\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kmJbz9PSC%2BTo7Z3K%2B8%2FlNU9lvWCyME9%2B2ejvQSUgcHKXFbR8nJNSuoODNY0JUJ79lY8Y%2BnjfhE9hrYz7TbuVSxXs9YCJz6apyc3WBQsy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f56e6c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1632,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8e01d7a03b679ffc28d816250ff97256","sha1":"69c1beb8e32ead45fd1c1565fffd71c46b8c9a81","sha256":"639e8eb1a1bdb356979dac056358318ef3272b0dc6f5c7ec0258bcf60389a752","sha512":"738f8c92c9a7261c4f3158ce1230f1f6dd008e46be29ea7b712b2a17684e1868005fc4cd6961b3bdb8518df58bd5f4bbdad156f04f8d557c9e535de549352eb7","ssdeep":"","tlshash":"5e31c8e5a4e34e236e8a939dbd971ad1e88080e724e00917695bc9e5a2385c7640272e","first_seen":"2026-01-14T14:10:35.550337Z","last_seen":"2026-01-24T13:46:45.011015Z","times_seen":3,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/21.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/21.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-562\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SZlzkRTx0snFsG%2F%2BnmmzG%2BIqlJnANW3VJspnX5JGBx%2BnNCpvgMH0nWYR6cb1QGPegwsdg0AJalEpP0nXo6eKBYERb5MRDreSZ5Dsl491\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f57ebf5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1378,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c4a4cefeb58269e3bb4f18ece88209dd","sha1":"87db4b6bb3c28a871fc7ea80ea98d0f0fbc697d0","sha256":"85d190cbd2e2dad8dbe9a3a15807c950791a0b6e054cb1f16e5f907438dabeee","sha512":"55a06007446017df1bce3b596671f79f85958e6bf5abdea60eac2af9428d1bea59e7833a5858a708c8ce771a6a593315d6056f93de1c6836670230ebda6d5711","ssdeep":"","tlshash":"7b210b496b363a34fe8c1e3542df27764f12654224e82588bf7411a54405d4735867e0","first_seen":"2026-01-14T14:10:35.583112Z","last_seen":"2026-01-24T13:46:45.006851Z","times_seen":3,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/18.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/18.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-680\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BqagI4%2Bx%2BRPf%2BHjfsTgZ%2FZE92g1aHSzbPGBKbji2kQHrO3HICm464HBZnQA3oVLo4L3jrXQFG9qSYXJNNYjcgB8%2FgUy5DoRT6NoTF42D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f56e815ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1664,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"089c764b58834da20b98521a5c70e671","sha1":"3944b4355a22f6625edf127d63cde1944f573799","sha256":"fa39a1cb28958984d4f60c11fb86528c8d0b456c82ea889b12810e5fd292f532","sha512":"e911383cceee60014c75ca597216def3c3f4bdcccbe9add7a145d56906f85e3755fc551fbcd142b520a8550a7c9c111aa5788265a40dc1ab490d849b4599ed21","ssdeep":"","tlshash":"4a315c03b49f2bd76dd87318182453e6fcf638803391553eb427f0ee98409805776986","first_seen":"2026-01-14T14:10:35.55183Z","last_seen":"2026-01-24T13:46:45.005682Z","times_seen":3,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/request-4.4.19.min.js","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /request-4.4.19.min.js HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-12cc2\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HTS29cKml5WVpVfWLRqySsnutJurRMKMSI1EwQB9yjpC5kGJYvgJgyBAjj6swnLJRjl1MacG8vVfhFd2c7tCYm%2Bt4CA4xbrDPIVSIQko\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9ef8e065ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76994,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"64f165d17d129265b478cc1a38ed687f","sha1":"7fe4d59794800eb09842b979491b1bd2c35c37d1","sha256":"1d4f7c314c79a0580e4c042fba605ea534fb76ea4a6db320d1ee99c56c105566","sha512":"4753e1529fd98d9b385869ca58d2d08a0ac6d3a681da4c02070272cc16431f042cef3783e616a2581960a8307116c98a03e8de55ededf5ad426b3e7f7a36afc4","ssdeep":"768:8+mVfcSVyWs6osMHnKzzFRKtj23RnY96yeysD311Ta781MeW6c0cP9cVcYSgahcu:8yWeuniGzWFBIPA+G","tlshash":"8273b4ca5d4bd0d08e6215dde873e865e4280923ceadf1aba52cdec1742df66c48713b","first_seen":"2026-01-14T14:10:35.587615Z","last_seen":"2026-02-14T05:33:46.674857Z","times_seen":5,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/15.svg","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/15.svg HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DPfpZBIStU0Ci9%2FJPlr3jgCK0Y1iJgQbvHb4Sapu1MZWeJyodO6ZpVPjjGJ%2BSn8zklJ82kzF9nfA7n%2FwCQICK40AesN4p2xj9EuTvJ2g\"}]}\r\netag: W/\"695c6833-389\"\r\ncontent-encoding: br\r\ncf-ray: 9c2ff9f54e285ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":905,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a3a9c965996fa1081de9d136960dd49","sha1":"efb2e1092cec21e4921a07c9400736d0236dd325","sha256":"f14a4d2dc531b6be0d3370c403f81db8c5f6eb7d474372075e8fc91d560ea7b2","sha512":"a082566823ba42d2aa16aab65f703ed5a64ed8c601250d0224ff65a6389a89d0eda4bca69c3331c0b42180499a0b31b0396293cebb8c36f0061659c7925b87bd","ssdeep":"","tlshash":"61116fd4c65c909a9a58275c262c7037b52bf5e05f3884836a482f5a39ed46f8debac0","first_seen":"2025-10-09T03:33:13.701934Z","last_seen":"2026-01-24T13:46:45.002887Z","times_seen":5,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/secureproxy?e=jscdn/getFile","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://eigcnlayer.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"uus171m98hjz3gmpy43q\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CD7t3cpHaWaxWUY%2FblxxARUsL5Voy45mRMBdcHKoccPVNzKIznmEU%2BxR4bdKoTIDsnFbrC%2FQM%2FCVH7aIZcm2j69Rkl%2FizViAm3ebr8mJ7V1dkw%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9c2ff9f57ee65ebd-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3864822,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d1a609585ef57b8331de1ebb4613e929","sha1":"81a4679ee311295e5e69f9f72dda9dfc8687d7f8","sha256":"fe587dbba453b7f1fde68b7efe85ab9ba97cc38a848b3281cbf306de251c330a","sha512":"f9b16485a2145cc9f2b8bae988c634862a393f20e83ec84aa0c8af65dd803bacc5f450aba534058acb2631bbf62fa2e12558c8e598ca5e80d1fe323b8b647f4e","ssdeep":"24576:0aIQ60NXAFfJBqnejWS7+Vg+Ccocg2shsO+unV8/8C:0agJB42vQCoFshsO+una","tlshash":"b425bfcb1847608db7b947ebb4e20c475adfaa594ed41079bb0afdc068a5a3241dcd0f","first_seen":"2026-01-24T13:46:44.745173Z","last_seen":"2026-01-24T13:46:44.999463Z","times_seen":2,"resource_available":false,"data":null}},"time_used":658,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":492,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/10.png","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/10.png HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 121024\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: \"695c6833-1d8c0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=faxV0OJF2ZGkwvaIqMudMyOWi8X96%2FdDrfD1itRF6RsA8%2BMqmUoV%2FtmXTv%2FMdbe9tRpFqC91SrX934WOFVuwsHpXenD8Vok3KxskIQ75\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae685ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":121024,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 456, 8-bit/color RGBA, non-interlaced","md5":"449ba9ab688b21e40ab01dc77cff2261","sha1":"25f5cb4d5c8970a133cfeaad080232722d9b4dc9","sha256":"ba3d3cde4302b5afd9a1b82b261247a20cfacc6bd7e5c8e423a0e59b54f992fc","sha512":"582d8fcba75eb14b87bf1fd86b4711af475197de652e007b237e5f4761eeefe418d7af4716773fcc581663af5d6a02adf9f393f6178ccb538cf32e12128a5a02","ssdeep":"3072:RsbMKr8jYt3NFemYU36XyflU7IqTz39H3vgGwXb:3KrrNt366lU7Z34R","tlshash":"50c3029e30c5072ddcdfaaa5dde76b99076a0574cf9f512d3c200c42e48cf9a89a07d6","first_seen":"2025-10-07T12:30:28.720684Z","last_seen":"2026-03-28T17:28:38.090502Z","times_seen":8,"resource_available":false,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":127,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/fonts/1.woff2","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /fonts/1.woff2 HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/stylesheet_5.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 62140\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: \"695c6833-f2bc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E88MQuYvz3tulhELBx1TY1aqj2UYBqTRyARYm4pr%2BUi9HM0bkFsLwLuGWWe%2F28kASqx3ABHjHFtlw3Pearpqy5reRzIb29tQ3tPrODLH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f48be25ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62140,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 62140, version 1.26280","md5":"3c2fb6afe7a8183443ecf7504b22bb17","sha1":"d93d557ec9ceb017ff18ec5d574b20ca44d0ffe0","sha256":"2361fdef96e5e4df0605e25b5e31292fb765ea61a68cce24af7aff79f1a7411b","sha512":"259431fc9020c9d6090d62f588a85a32911538297c3f56516d8d3ad240e789ace366a2a2a1585205e5f37ff1ad1f7300ed748e31f2b3473cefd6b937486af5b1","ssdeep":"1536:kFeNSQ86JDzg3DJe+lPMPdx2HDUemOicyVxKNy7IJDOxe/2ztvX:kFe46G3DJe+lgarmNVxJIJaxe/2zJ","tlshash":"9d53f230576305fafb8716f570e328d0ebcbbe094fd96582567a5500c4cce7a418a7a9","first_seen":"2025-04-13T15:41:41.157921Z","last_seen":"2026-08-13T05:37:07.562324Z","times_seen":242,"resource_available":false,"data":null}},"time_used":352,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/9.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/9.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-5cc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bxnrjLJlTfCAc4APhxJb5p5J%2B%2BFxQFfJI4QubralB6r5hhds%2FCitL6VjUoQGpC3oHi5E0SPA7rcZdjbTr3LusDzuYRrTp%2Fr%2BnECndr1K\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e4c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1484,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e6512ef706e779a095a733a58d6bf815","sha1":"65b1fe6fe0ad54f108c81a42326ab1e3220ffbb3","sha256":"a0b7f6198ae47e55e41799f1fd99380d34a38d70de57be56618e98cb68dabb6f","sha512":"e71c3b78bb84e5cbd62b395e79dee9256b43bd953db16614b20815686be9cb97e4c3f0cb590cf5d6c27063b8d996b1b756a95ea7d1d43526fbe1654ce3517fef","ssdeep":"","tlshash":"b031d7ad9219cefda2b89434a4f28d01e22fd5d580ef885501db5e3c1ea4079f7b1664","first_seen":"2026-01-14T14:10:35.571476Z","last_seen":"2026-01-24T13:46:44.996114Z","times_seen":3,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/11.webp","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.403Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/11.webp HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:20 GMT\r\ncontent-type: image/webp\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-254\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1lc5n4oviCPq1eoaNRqKQMGSBuuVT1KkZ5waj5BQmLjDJJ8%2F02XkazqEWvxIqRaRU3uhUpbIyEnpeqqeMFgN5IagsWN%2FV8rJl7DnXGof\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9f55e555ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":596,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3256d635c29c8add9a5e59ae1613b642","sha1":"c9386715f62280068c16c34d7ceda6539a46225d","sha256":"7f46feabb47b36331956caeb4f7dde4d3e30200622f4a55d117629e61655dbd5","sha512":"10a119c79e863d10d61e9409e84189e5dcd820353f64db781aad38e00ab97e0da3e24ad73eebe28d4afbc5a7de74db6d07d875fcff46a9eacd5d5c0796fe66b6","ssdeep":"","tlshash":"a1f0475d3de7c914ed8f94371ca86086a305284259a56314f44a2fe1403407a8b46958","first_seen":"2026-01-14T14:10:35.526492Z","last_seen":"2026-01-24T13:46:44.997013Z","times_seen":3,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/stylesheet_0.css","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:19.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /stylesheet_0.css HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://eigcnlayer.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:19 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\netag: W/\"695c6833-438\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nHGprM06g8qsKL9saL9bSxOk9MFBsC80dYV7ikHCDLlYTrGli4HbBIMEf%2BLEmhf6ihCCnnhzNXkNFogTrndp%2B43HB%2F5RZ%2FtXAdjYCjtB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c2ff9efae645ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1080,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1080), with no line terminators","md5":"684a1c313d6bca8198f4a295c5cf3a41","sha1":"211256bc84c08ceccb02eee73153f31b5f069d26","sha256":"92c99f0b5968e595e00dfdb500f516c372343f3c1c5f7c706f7abdb1e1e4f41b","sha512":"802e79907cd32541e480764d9c3ea7d91fddae2a348534f2ece445b894fbfdfc2fdd3ee3988d13b9ca73122666641f0ab72d6aedb1b948fc6acab88c6aaf60b7","ssdeep":"","tlshash":"a8112b30082ab844d2fb8c3230c478031c0de04487d76a12eb1a15fc4fe99366397725","first_seen":"2026-01-14T14:10:35.578471Z","last_seen":"2026-01-24T13:46:45.006251Z","times_seen":3,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eigcnlayer.xyz/images/4.ico","fqdn":"eigcnlayer.xyz","domain":"eigcnlayer.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://eigcnlayer.xyz/","date":"2026-01-24T13:46:20.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"eigcnlayer.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 01:08:07 GMT","end":"Mon, 06 Apr 2026 02:06:49 GMT"},"fingerprint":{"sha1":"B9:28:C5:EC:32:89:3A:68:79:5B:3C:2A:24:A0:6A:39:85:6B:A4:85","sha256":"0C:56:3A:66:B0:C6:07:58:44:DE:87:9A:48:A9:BB:B6:D8:3B:D9:53:E6:1D:9D:B7:27:58:5A:2E:18:12:8F:B0"}}},"request":{"raw":"GET /images/4.ico HTTP/1.1\r\nHost: eigcnlayer.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 13:46:21 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 01:41:07 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MNo6siN%2B89TMej8drSU49FooYflGPUm7mV0TGx0ZGo74T82Tu16jvycTuUKfhSPyePhfUfbeh30By25iGRwOIIgo%2Fyc94NUJNe0nG5rT\"}]}\r\netag: W/\"695c6833-13f\"\r\ncontent-encoding: br\r\ncf-ray: 9c2ff9f88d8d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":319,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced","md5":"4988994a4eda60ef3d9baec856809d91","sha1":"8dcfcb260d6ff8d4c49f25e5d9da3b25db46c5ec","sha256":"08a0fad5dd4e8b90ca110d494319c4e2780287d359b447dad06a56c99cc975fd","sha512":"7a56d63716ee333ee3d903aa20ff52500f1d6cc1ffc2302cc02e71a161eb92ba069fb66b808c11114156518f084739961b50b50b93f3d2e63f3073714cab3faf","ssdeep":"","tlshash":"a0e07de37b549a65a7996a6245035148fc93134c2e2843a04157941a0a7f23196f4747","first_seen":"2024-04-27T20:44:18Z","last_seen":"2026-03-28T17:28:38.080128Z","times_seen":26,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"eigcnlayer.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}