{"report_id":"a5864e98-4880-4719-84b2-6412437f80fe","version":6,"status":"done","tags":[],"date":"2026-05-23T21:23:31Z","url":{"schema":"https","addr":"xrp.promo","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"title":"xrp.promo","dom":{"size":144399,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65146)","md5":"62e33e0ef715c24c683a7eb98ebc5440","sha1":"1a5762a0cc7571a3ffaf59f9f485d889aa54aeca","sha256":"8c59f3536e32a4ce91e081807347ebac206d86c3e9e30b9bf4b05940833ec0fe","sha512":"f9522a8b93e3d88e57c403a430432fbf72aaa3795404ce24b5e379378c95ef02f7495e7e55a9fb60364128ee8a3e25f00779738671564ae8eedbf59b9aebdd3b","ssdeep":"1536:z9As/Rnc104NCsurOhKokFy2DqVdG51U4qgTt3mH1Vgiq6YFPrNRU9ArdM+ZR52N:z9DLvcsFy2DqVw51U4DTt3mVVjYDZz0","tlshash":"11e34be93286b06153f609e640bb1806f33d7d16340994d8f29caddf3da648581bbf6d","dom_hash":"domhash40597245162150d6b1078e10c37ca622","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"xrp.promo","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-27T21:23:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"xrp.promo","ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-12-04","domain_rank":0,"first_seen":"2026-05-23T21:23:31.538709Z","last_seen":"2026-05-23T21:23:31.53871Z","alert_count":16,"request_count":8,"received_data":221452,"sent_data":8617,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f21cf947b110dff311e910da4a47caa","sha1":"1543512bfdee71671ed157d38b92b4c1f772904d","sha256":"a1611e54bf8bd9de7506dbaac234c2839a960291729f52dd15b8971202e47f7f","sha512":"c78bcad253eb36d6176fed5ed1073d8010c6b7b0d37cceebac764afd050d9368bb9bb85a46ca12542ebb66bee0cdecf850771723bd25f7dac43f82e8d5d2771c","ssdeep":"1536:m9As/Rnc104NCsurOhKokFy2DqVdG51U4qgTt3mH1Vgiq6YFPrNRU9ArdM+ZR52U:m9DLvcsFy2DqVw51U4DTt3mVVjYDZzX","tlshash":"c9d33ae83286b06153e609e6407b1806f32d7d26344d94d8f29caddf3da648981bbf7d","size":139641,"data":"","first_seen":"2026-05-23T21:23:34.783951Z","last_seen":"2026-05-23T21:23:34.783951Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e69858715759c49953487a5651490c91","sha1":"dd7cf2fe8d42f199b217c4a467cb4c5eb449f190","sha256":"6f5c301333afc1db1afaeb09fd52f1663992438b1006e01b30f8b4c545eae8ea","sha512":"458ea0fedabf474449ad98e46c73692a1d09fb081d64f1b43d4cb4fa13bfb42c9e3829b73b3ac62ccbc3fe761d50527472f55401fd9dae73cc312a098ad67359","ssdeep":"","tlshash":"0511c4753b1a5534cac5414b31bee7a93d7260617a029044c26cdc385d18dc714dfcbe","size":902,"data":"","first_seen":"2026-05-23T21:23:34.78724Z","last_seen":"2026-05-23T21:23:34.78724Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"bac09e2bd1e4d3b34a0b4bf0145c3f0f","sha1":"6bdabc820bede467a00dd467d25fcb2bf7f34c05","sha256":"4d5ed9f25266bc2359bd80a872695ac2c7a86cbe414ae445fcd680739d38f58c","sha512":"07435e07a228465ef8f4f0daa96fe602a0a4013930d99c313c9b34ea6c84efeb273c7b29a47e5aae4d2630034563ac2eadb89c3701d1386965c9f2f40d6fc987","ssdeep":"","tlshash":"abd0a76619758c3066d4014b60f6e7e926a0609067119140c1d8cc3e6e11dd304a2558","size":217,"data":"","first_seen":"2026-05-23T21:23:34.796925Z","last_seen":"2026-05-23T21:23:34.796925Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/aes.min.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3bb0c2cc62ff2dc7ab46f27e81ab3f2","sha1":"a433e0c21cecadb26eccea68b084e4f765448b93","sha256":"1ac3a3bdd7f1f4622f9d6c3e5b347616691a62b922c8bc6f24b870ef142e926b","sha512":"e69e6149b35a8d646909b469a2cbce0b1ead6dd7109c87becc5241489281202bda888769fc7ddfd42709056bd5be1522f39def89e5e42f5ed8b4cc762a38452d","ssdeep":"","tlshash":"7f612f503d5af08c293b84701e6f10b56b5588535c8dfa00a85bd0e1afe016b37aeecf","size":3448,"data":"","first_seen":"2026-03-01T09:46:16.546669Z","last_seen":"2026-07-08T23:06:56.385666Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7ad38472a8604129dabcbc63dc54c7f8","sha1":"f6dc72eef768c5930256650d0b692a2ad6cca951","sha256":"eabbb5908294396b8cd624efcd54a556b8439512562078ba6b383bf0482d4b6a","sha512":"1314d917129781aa3b061f1a40c2229d0bbb329c666e5bc49ab5933cac356d850b9e6cb2bce28dadc35f4d28d6327633ec94b48e26b17a7256ed052ba7e94813","ssdeep":"","tlshash":"8711b9fc4200b5539bb77047207989eb8d3dd74b60c5e61695c1b7504727408d94ef17","size":1101,"data":"","first_seen":"2026-05-23T21:23:34.804248Z","last_seen":"2026-05-23T21:23:34.804248Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b299af912198705213899daccb23afbf","sha1":"0753ed91ebb2ddfc7202c98292290eeb2c23f72c","sha256":"85a648f694e4c10d818e5c3a93684b7d6a2e119b5e160fa270f45ff936628889","sha512":"25c230bc5f1d0b638c0d084578d11ddd68eee25e54d47b0b55a927c3094f9a4cc8f44415fb4f1b1cc7630630bcd24fd9200c3e0e3b401a58697acdc0ae75c8a3","ssdeep":"384:zP+aSDAFH6e1IPXMGYUDbNZ6c+ZMBp14H9kecv71firj6sA04TViGPx+NP8HMxmc:r+UH6e1IPXMGYUDbNZ6c+ZMBp14H9ke9","tlshash":"c2b2b7be79c6b02d432aa575185730c7f36abd84240f1d1cc264aafef8617487627dac","size":24285,"data":"","first_seen":"2026-05-23T21:22:23.361035Z","last_seen":"2026-05-23T22:22:23.707321Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T01:11:21.863381Z","times_seen":121604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T01:11:21.863381Z","times_seen":121604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0954d35b5615ab13f736ec937b8ff8dc","sha1":"457fcede01e5f5dc0aae718da9ab56a3050ab3a2","sha256":"70a1cd291e8a2d1a020072065fa550432713a9d9779a26f44c6484d979fca114","sha512":"5807f1cd61e616fa67dcf87dd0475f83fb2ec43da6cbd52ef6f0b3040d06c5f41b9365056f3abc7c2064872165236d3ee4ff9fc3009bb59dcfc700707a406312","ssdeep":"384:ubLLFSBBMwmvML8Yz0BUbWHnskIsMPQPabA9vuhJbaTkEqYl:qLOMDUL3z0/nskIsMP7hJ+AEb","tlshash":"88a2a5a9bdc6741c1769ee38046b30c6e66aed41380f2c1cc764ebfcb4a13187662d9c","size":22965,"data":"","first_seen":"2026-05-23T21:23:34.773955Z","last_seen":"2026-05-23T22:12:57.465386Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"bac09e2bd1e4d3b34a0b4bf0145c3f0f","sha1":"6bdabc820bede467a00dd467d25fcb2bf7f34c05","sha256":"4d5ed9f25266bc2359bd80a872695ac2c7a86cbe414ae445fcd680739d38f58c","sha512":"07435e07a228465ef8f4f0daa96fe602a0a4013930d99c313c9b34ea6c84efeb273c7b29a47e5aae4d2630034563ac2eadb89c3701d1386965c9f2f40d6fc987","ssdeep":"","tlshash":"abd0a76619758c3066d4014b60f6e7e926a0609067119140c1d8cc3e6e11dd304a2558","size":217,"data":"","first_seen":"2026-05-23T21:23:34.796925Z","last_seen":"2026-05-23T21:23:34.796925Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:10.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xrp.promo/\r\nCookie: cf_clearance=tCtRbeWyMX2IdGFfGFKd2A4o5fIra42Hb3wJRaADvAE-1779571390-1.2.1.1-3tsjS1pHkH5FyFk57pMhE.TzOzt8fsw1sg1C56g2RmiReC_e7pgthcGUKXBXujBU4R6ExVuDz7gIfhaZStMD0d6VbzSSomlYcL0Nx9dX4d9hjwBj51YcCR2gKEsVk_.y3._6O2jLTbM4WrxfUhj9dDHNOHe1JvoowJi9kjcliW1A2XVaKLGCJjSgnAkSUgmhHU7ytXlwz5AQaakiRdIVs90aM7b9X8AemhbXtb.fKaJdk2R5B6yDUqEkysUsgE2F50G6NSW5uUpi5njrEcsZC_yWsY2kmcEW.ebAfzprTSjvQB9jHiHZjpwxXwqxz6q1XD7crf3te5aCw.S2o7Uxaw; _e3ff717b04=65484a774c6e42796232317666446b784c6a6b774c6a51794c6a45314e487855567a6b325956643463316c544f44464d616b466e53305a6b63474a74556e5a6b4d30316e564778525a3031555158564e52484e6e566a4a73645535715554644a53476379546b527a5a324e7557545a4e564530775447704263456c465a47785a4d6e52325448704a643031555158644e564546345355566163474e74566d31694d3264325456524e4d457871515878384d5463334f5455334d544d344f58786b4e6a41305a6a677a4f47526a595456684d544a692e514476726361506a6534476d5a7175703065726341756a4767337573504563366750413346462d5754314110101010101010101010101010101010; __session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiYWU3YTI3OWZkOTg3YTZlYyIsInN0YXR1cyI6MCwiaXAiOiI5MS45MC40Mi4xNTQiLCJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEzNC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEzNC4wIiwiaG9zdCI6InhycC5wcm9tbyIsImlhdCI6MTc3OTU3MTM5MCwiZXhwIjoxNzc5NjU3NzkwfQ.urvm7Vr1WEGn88y8duJNil27gY4X0s12Vle6v7sen3Q\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Mon, 25 May 2026 21:23:10 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8pHJzGQRxgFUfE8DVMRF8TjgJC6FW%2BSZ4qXnYMk%2Fg69xIGKyQhtd57aTdsqC0I7ynlBB3bkFIlx1RgqAABpGG0R7ULEze6RzB4KS5%2BPPTujH2ohC4e1VsjFMBEQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Sat, 23 May 2026 21:23:10 GMT\r\ncf-ray: a0071ec4dc5ab521-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12332,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T01:11:21.863381Z","times_seen":121604,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/favicon.ico","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:10.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xrp.promo/\r\nCookie: cf_clearance=tCtRbeWyMX2IdGFfGFKd2A4o5fIra42Hb3wJRaADvAE-1779571390-1.2.1.1-3tsjS1pHkH5FyFk57pMhE.TzOzt8fsw1sg1C56g2RmiReC_e7pgthcGUKXBXujBU4R6ExVuDz7gIfhaZStMD0d6VbzSSomlYcL0Nx9dX4d9hjwBj51YcCR2gKEsVk_.y3._6O2jLTbM4WrxfUhj9dDHNOHe1JvoowJi9kjcliW1A2XVaKLGCJjSgnAkSUgmhHU7ytXlwz5AQaakiRdIVs90aM7b9X8AemhbXtb.fKaJdk2R5B6yDUqEkysUsgE2F50G6NSW5uUpi5njrEcsZC_yWsY2kmcEW.ebAfzprTSjvQB9jHiHZjpwxXwqxz6q1XD7crf3te5aCw.S2o7Uxaw; _e3ff717b04=65484a774c6e42796232317666446b784c6a6b774c6a51794c6a45314e487855567a6b325956643463316c544f44464d616b466e53305a6b63474a74556e5a6b4d30316e564778525a3031555158564e52484e6e566a4a73645535715554644a53476379546b527a5a324e7557545a4e564530775447704263456c465a47785a4d6e52325448704a643031555158644e564546345355566163474e74566d31694d3264325456524e4d457871515878384d5463334f5455334d544d344f58786b4e6a41305a6a677a4f47526a595456684d544a692e514476726361506a6534476d5a7175703065726341756a4767337573504563366750413346462d5754314110101010101010101010101010101010; __session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiYWU3YTI3OWZkOTg3YTZlYyIsInN0YXR1cyI6MCwiaXAiOiI5MS45MC40Mi4xNTQiLCJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEzNC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEzNC4wIiwiaG9zdCI6InhycC5wcm9tbyIsImlhdCI6MTc3OTU3MTM5MCwiZXhwIjoxNzc5NjU3NzkwfQ.urvm7Vr1WEGn88y8duJNil27gY4X0s12Vle6v7sen3Q\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Sat, 23 May 2026 21:23:10 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OtAvTLqcnNuG6d9%2B3aPI11yjeTQtehMiZbk2YgLc96ca3rn3udrmabxRbmncJnxgyl%2FjDIojpHTuKJ%2BvoxyRgrOoPymGTofQqcJ36kNc%2BiW2POEyWqziImlTmdU%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0071ec4fc5db521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"597ba0d4396e9c906225140ce907092c","sha1":"28ae2ba65ccdb583d79f85b8cc9509fae697493b","sha256":"ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6","sha512":"8898f14bd6cb5c72d6ee5878af3700be6d03b56a5a21a3d58ef347f008acf4ac68a46a908903e1d42999c1e259e77d7df686c94765865ae07361b2c4e04adf2c","ssdeep":"","tlshash":"18c02b2d24137c0c8663307636c37050c1978337a67e10210400805330cf1998ac33af","first_seen":"2023-04-05T14:00:46Z","last_seen":"2026-07-21T23:43:04.70216Z","times_seen":37924,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-23T21:23:09.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Sat, 23 May 2026 21:23:09 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: no-store, no-cache, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ez%2FF2vHilFWf0rmryA8sR4Sn54jGJwj2fw40%2Fg%2FM%2B2W5DYnaaqcCLVU8YlA8tiyUAG5oVEL%2FhpONe3%2Bc1GA5pzeFfiA%2FHSMHKWUGsr6GGqj3SijHbqeSndsttaQ%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: a0071ebfed080daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2439,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2438)","md5":"6657e871c569a013cdf06a3c36d0871f","sha1":"edad160170597cc42652fd9e4729909ffdd3a4ca","sha256":"a40c4e40da0a0a3ef2d31bc6664a0e006e3c00e0fa27780cb2db86d5a906a5a4","sha512":"60739eb4d2f669ad55b7ac34e48cb2c86e95d0070e35bf9082df7764477131d625ab6e325177c56e5abdad6b2807a54814a279952cf7962629b9eda159f56797","ssdeep":"","tlshash":"4541c7bd6e11d521dae6108720b9e7ed2d35d1527641d108c2dcec384a19fc69c8fd1d","first_seen":"2026-05-23T21:23:34.768053Z","last_seen":"2026-05-23T21:23:34.768053Z","times_seen":1,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":55,"dns":40,"connect":1,"send":0,"wait":133,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:09.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xrp.promo/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Mon, 25 May 2026 21:23:09 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=buFqHghAf%2FzBfcKkAk1gSNo8nKGAIh4ls5H%2FJa%2FwgAIslFfgka3cAvSog4m3pSSTIOA9LFbk%2BIcTnB42vx1eTCNZepGUfR3kbaLuarVssUETk0sxX%2BURfK0Ysi8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Sat, 23 May 2026 21:23:09 GMT\r\ncf-ray: a0071ec19c2bb521-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12332,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T01:11:21.863381Z","times_seen":121604,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:09.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/1eec422858ff/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\ndate: Sat, 23 May 2026 21:23:09 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a0071ec1bc33b521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22965,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T01:24:25.529128Z","times_seen":17436789,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/cdn-cgi/challenge-platform/h/b/scripts/jsd/1eec422858ff/main.js?","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:09.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/1eec422858ff/main.js? HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ndate: Sat, 23 May 2026 21:23:09 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a0071ec1dc34b521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22965,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (22965), with no line terminators","md5":"0954d35b5615ab13f736ec937b8ff8dc","sha1":"457fcede01e5f5dc0aae718da9ab56a3050ab3a2","sha256":"70a1cd291e8a2d1a020072065fa550432713a9d9779a26f44c6484d979fca114","sha512":"5807f1cd61e616fa67dcf87dd0475f83fb2ec43da6cbd52ef6f0b3040d06c5f41b9365056f3abc7c2064872165236d3ee4ff9fc3009bb59dcfc700707a406312","ssdeep":"384:ubLLFSBBMwmvML8Yz0BUbWHnskIsMPQPabA9vuhJbaTkEqYl:qLOMDUL3z0/nskIsMP7hJ+AEb","tlshash":"88a2a5a9bdc6741c1769ee38046b30c6e66aed41380f2c1cc764ebfcb4a13187662d9c","first_seen":"2026-05-23T21:23:34.773955Z","last_seen":"2026-05-23T22:12:57.465386Z","times_seen":5,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-23T21:23:09.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xrp.promo/\r\nCookie: cf_clearance=Uapjemg64loJF6qwAzTCm_K1YVSmP3ag1j.5moRE3Ws-1779571389-1.2.1.1-OUqNweoXZMBAMpEoh6zs9u07Knac5ZJga1q0sG85FN1DZCljSc1vWUSRxoivvyKHtJfFbYtpIiRrTUX4odyjqCQs6UBNq3ih2qcFh1CobdaHsERtUw2UfemCZe.GQQXJfO.clz7lKFrlAYDXgAggy1LPjqlQKB7p0QG0aHJfn0b.U_fc1Gr1kbynoDMr2UfvxZ5ZyC30ocOf65pz1iIjrXHJ9DM99qZB9ZO3WlLLDjQ4eOXcqFrHA2aNfg9RKS4UyCDtzWL_2CTk3j0iWKxkuI3.L8GbGQHccytwucT8uSPrU49cLdEG413E3bQBFYIa6Wm23IRxC9FcOGvDKTpn7Q; _e3ff717b04=65484a774c6e42796232317666446b784c6a6b774c6a51794c6a45314e487855567a6b325956643463316c544f44464d616b466e53305a6b63474a74556e5a6b4d30316e564778525a3031555158564e52484e6e566a4a73645535715554644a53476379546b527a5a324e7557545a4e564530775447704263456c465a47785a4d6e52325448704a643031555158644e564546345355566163474e74566d31694d3264325456524e4d457871515878384d5463334f5455334d544d344f58786b4e6a41305a6a677a4f47526a595456684d544a692e514476726361506a6534476d5a7175703065726341756a4767337573504563366750413346462d5754314110101010101010101010101010101010\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\nserver: cloudflare\r\ndate: Sat, 23 May 2026 21:23:10 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mgVh1qYSMS1kZEi97oiy4XQRyU%2BKJGQ2s8KHc2kfx3wwLlMjXRjasiqiEws52r5lg4kSy5mluATO%2BPt9E94Z%2Bh3eQwHG4PB%2FYaFruaFqnvU0en6kD7DsDIJtzgg%3D\"}]}\r\npriority: u=1,i=?0\r\nvary: Accept-Encoding\r\nset-cookie: __session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiYWU3YTI3OWZkOTg3YTZlYyIsInN0YXR1cyI6MCwiaXAiOiI5MS45MC40Mi4xNTQiLCJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEzNC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEzNC4wIiwiaG9zdCI6InhycC5wcm9tbyIsImlhdCI6MTc3OTU3MTM5MCwiZXhwIjoxNzc5NjU3NzkwfQ.urvm7Vr1WEGn88y8duJNil27gY4X0s12Vle6v7sen3Q; Max-Age=86400; Path=/; Expires=Sun, 24 May 2026 21:23:10 GMT; Secure; SameSite=Lax\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0071ec2cc3fb521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":143239,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65127)","md5":"4eb23a31ee6b4ed56890751196946a08","sha1":"4980b4e093264fa6dbd04c2f9a8ca70652b906c8","sha256":"590e9078edc941d11fb6d26fa49f7a11f7e2969428cae99a66e869d88642fcbe","sha512":"0a0352875d75f6cdec44fb57435cce353cc35ff1520270a1aad4f8bf791753125f2e29fd245dfa53986d1cce4eb0ac7a39d973e15ebdf31deb2150f27327f64e","ssdeep":"1536:H9As/Rnc104NCsurOhKokFy2DqVdG51U4qgTt3mH1Vgiq6YFPrNRU9ArdM+ZR52a:H9DLvcsFy2DqVw51U4DTt3mVVjYDZzB","tlshash":"4de34be83286b06153f609e640bb1806f32d7d16344994d8f29cadef3da648581bbf7d","first_seen":"2026-05-23T21:23:34.777291Z","last_seen":"2026-05-23T21:23:34.777291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":150,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrp.promo/api/verification","fqdn":"xrp.promo","domain":"xrp.promo","tld":"promo"},"ip":{"addr":"104.21.44.186","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xrp.promo/","date":"2026-05-23T21:23:10.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrp.promo","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 18:33:34 GMT","end":"Fri, 07 Aug 2026 18:33:33 GMT"},"fingerprint":{"sha1":"C6:7C:2A:76:28:F2:45:77:E6:EA:32:10:A8:64:E8:27:71:7C:4C:EE","sha256":"AA:64:B4:BE:30:39:C3:6E:16:2D:38:D3:C8:0D:CA:A4:F9:2A:7B:21:A7:65:1D:B4:AD:1D:3A:BC:65:60:F6:46"}}},"request":{"raw":"GET /api/verification HTTP/1.1\r\nHost: xrp.promo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xrp.promo/\r\nCookie: cf_clearance=tCtRbeWyMX2IdGFfGFKd2A4o5fIra42Hb3wJRaADvAE-1779571390-1.2.1.1-3tsjS1pHkH5FyFk57pMhE.TzOzt8fsw1sg1C56g2RmiReC_e7pgthcGUKXBXujBU4R6ExVuDz7gIfhaZStMD0d6VbzSSomlYcL0Nx9dX4d9hjwBj51YcCR2gKEsVk_.y3._6O2jLTbM4WrxfUhj9dDHNOHe1JvoowJi9kjcliW1A2XVaKLGCJjSgnAkSUgmhHU7ytXlwz5AQaakiRdIVs90aM7b9X8AemhbXtb.fKaJdk2R5B6yDUqEkysUsgE2F50G6NSW5uUpi5njrEcsZC_yWsY2kmcEW.ebAfzprTSjvQB9jHiHZjpwxXwqxz6q1XD7crf3te5aCw.S2o7Uxaw; _e3ff717b04=65484a774c6e42796232317666446b784c6a6b774c6a51794c6a45314e487855567a6b325956643463316c544f44464d616b466e53305a6b63474a74556e5a6b4d30316e564778525a3031555158564e52484e6e566a4a73645535715554644a53476379546b527a5a324e7557545a4e564530775447704263456c465a47785a4d6e52325448704a643031555158644e564546345355566163474e74566d31694d3264325456524e4d457871515878384d5463334f5455334d544d344f58786b4e6a41305a6a677a4f47526a595456684d544a692e514476726361506a6534476d5a7175703065726341756a4767337573504563366750413346462d5754314110101010101010101010101010101010; __session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiYWU3YTI3OWZkOTg3YTZlYyIsInN0YXR1cyI6MCwiaXAiOiI5MS45MC40Mi4xNTQiLCJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEzNC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEzNC4wIiwiaG9zdCI6InhycC5wcm9tbyIsImlhdCI6MTc3OTU3MTM5MCwiZXhwIjoxNzc5NjU3NzkwfQ.urvm7Vr1WEGn88y8duJNil27gY4X0s12Vle6v7sen3Q\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 23 May 2026 21:23:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 47\r\npriority: u=3,i=?0\r\nexpires: Sat, 23 May 2026 21:23:09 GMT\r\ncache-control: no-cache\r\ncache-status: MISS\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y6pWGeR238L5jz8W9UWcRqBfefiRDEALpcqBF3S8fufvKtQNCfOS52WqFeHk%2FP5Lwc3G2YttrxUeQFBqcPOxxPOlBtkhPMQunyuJvfpr%2FCCN5fqswGsLbNl1koI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0071ec5ac6ab521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"77e5931b961213b0683eb48f557f19f4","sha1":"595169657723c65833309421fca0cb5bbee9761e","sha256":"92069c705f18655fe5c35687fa26ea4c5c460d470c789c54cd3c588e0aa0a3e9","sha512":"db72fd5ed27bf2fa0b7155034d1a22b539bcc09f13cb79e0e23c462cb6934854fc7430c690efe1ff19ff7e4e38db3fbb626807ef72f2c029bfaa30d080491c7c","ssdeep":"","tlshash":"a49002541106053d182e1668619a52784a55077214435185116b91d1485b0048d1950d","first_seen":"2026-05-23T21:23:34.780732Z","last_seen":"2026-05-23T21:23:34.780732Z","times_seen":1,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-23","alert":"Sinkholed","trigger":"xrp.promo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}