{"report_id":"a620e346-56b6-4588-87a8-c81ae2829b13","version":6,"status":"done","tags":[],"date":"2026-03-15T04:53:55Z","url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"172.67.156.93","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"title":"$WAR - War on USD | Trade USD1 Pair | Join the Resistance","dom":{"size":277,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"a142f7c4290322cd60f3ad06977532ec","sha1":"d76d54c8d24883c02272832c8181bb89d6facecb","sha256":"fcb86d15bc18816874f78533af79c188e4aa153563c96407dcc5a945f204c5f6","sha512":"f78cecc826aeb1666f6c5f6c1d58cf1606b85d0cbb72a5de88a950fbd232c4a7574033df75bea5794544e6e47ea8b36548705c7247f2d99d8e67628e6f51154c","ssdeep":"","tlshash":"c6d02be7c21104492a549b5046c6b50408cdbb1fb5108d6c6e37b0a9d8ad1b1c137344","dom_hash":"domhash8c2e87ac90d2b77a4d92dfea1f50d3d7","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"172.67.156.93","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-19T04:53:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"reward-waronusd1.com","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":99,"request_count":33,"received_data":7050549,"sent_data":16323,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9040e7efc714fba4e48378a29f608d4d","sha1":"95494d2077f952c245a3176818e9a5b110a2b4c7","sha256":"94be9d300b648fcaf0a17f135474420b668af625b92fe38b7b9530eb3d2684c2","sha512":"be24ed4cc9c393d672a8eb5b0a06290fca5e1c016bde4fd97e5251f7ec5813752b0a6d8d6e85ff592cbb1d807155e84f6c543336e07f7c4c83e77c57cd8448b1","ssdeep":"","tlshash":"82c0228884a08e60202d00af2238a2a028c8287c905220c6c1bee98ba46ae85164c418","size":187,"data":"","first_seen":"2026-02-21T20:23:18.600046Z","last_seen":"2026-03-24T01:53:43.140239Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5b767c078c6813816231552aca1d562","sha1":"34f99579b527c24b3a5af82abb42079a0d3e1a51","sha256":"c17d50bae5a02a35e0ae5d0005c694495952f093629bb5193c668070161b0f7a","sha512":"7b4aed1d33c4891894a556505047a8f7afd72efc1c30c064b5a428fac50a5475e895f3937869de6d047128910d762069084c41d12fbacecffd43cd98e84b2e48","ssdeep":"","tlshash":"70c0125d7010696614ce687d4ccf088ebe368812a20809c999dcd4547bb1e6c42e484c","size":185,"data":"","first_seen":"2024-04-08T19:47:46Z","last_seen":"2026-07-22T10:27:05.32214Z","times_seen":702,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/SdSVVMpj.php?s=%2Fipfs%2Fv1Gl2RMY8M6BdnpUUDUzFAe8ba416430374979e01ea110bbc0d980%3Ft%3D1773550413682","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8167f5053cde3bd00e53b840c1d48f4b","sha1":"9945d37625ea80e348cc33c83dbccf328a3a1e83","sha256":"844fcf4a346f95f8447d87510416269a7250cbe26b8b0b0516a1d0930bfb3bcd","sha512":"2a67fee398c113543137566f018d0d47567e38a454aa28e4b452cebbee3e2d8440cd833c38f0e67c95ba0b96ca46689af9f4931a7537804ec509e7ce3de74241","ssdeep":"6144:qh5gDP6Euno4xvlISDhTl0WHvfUp+v+9J87XGQOwOyyGpMy:qsPZunzvlzSWP8p0Q+Bz","tlshash":"55d499c08b4c357364802aea15fb446fdfdc0de82e4be8536bd09ca5e379b8351e5998","size":634343,"data":"","first_seen":"2026-03-15T04:54:01.552984Z","last_seen":"2026-03-15T04:54:01.552984Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"895f526ab37305311d1e998fa4d5a6e8","sha1":"06d0220830c81bf254c70552e908371c6dc1f18f","sha256":"90916b8b1fb2fbbd765a22eba866c30d8829f59aa2d7ee86869abd20207b2117","sha512":"6b087d2e2025f4d11073254448b124af8839ce24ff37eb45bf2fd1a2b66bee8fd4fdca2b4d23c08786d217dd71dbc660d1054b7876b37752dee3baaefdaeaa4e","ssdeep":"","tlshash":"2871bc3beb00173bdc8fa9fdced5b4c02e62497262496960691ce102a16cd7487bed88","size":3743,"data":"","first_seen":"2025-08-14T22:47:51.287187Z","last_seen":"2026-07-24T09:08:37.182527Z","times_seen":1364,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"reward-waronusd1.com/index_1.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:39 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cSt%2BYFOmbK7uqlc05sdO54FNbXUgASYFSmZzKqR1GHR%2FwgZ5zrYNUMt1HIM%2FpjrbeFQKoPzW%2BNpRJEP%2FNr4Hxk5or4I1gAtTNyL11%2FP%2BfuPPHiC7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea4689f8a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":201,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"accffc389519d78f05c94892222f092e","sha1":"5f957871f50031c238dbc92e56c69469781d5fa9","sha256":"fcaa07a7179caba2296eb8ea54a865e7ba25dbde43a391ac7ac53d08614cba16","sha512":"c0aeb6ebee410c7d970bde7b01fcebc8736abd44820cfb62ec698795f4063ceddfe41c7de520a3cdcc611aa9a51416f7156a8381f405b66481e2b610da22babc","ssdeep":"","tlshash":"6dd02226c4054a2bac428aa0c763e380c880c33afd318c61adf1aa20f68d5258a23688","first_seen":"2025-04-19T12:20:06.699203Z","last_seen":"2026-07-14T10:02:24.350945Z","times_seen":61,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/Liberator-Light.ttf","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /Liberator-Light.ttf HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/7887fd7f57dea799.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 14892\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:41 GMT\r\npriority: u=4,i=?0\r\netag: \"6996526d-3a2c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D0obTtgzsGJ%2FMrAZugpmvn076DdSyC%2FumpBsKrQW%2BW8TsVCAM0oHTi7cv1ozH6rSrYBRxdFyJjbYy7J4Ux7pWVtf876zbOKB8vAJxNpC3Vr8qH%2Fv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea471b4fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 13 tables, 1st \"GPOS\", 35 names, Macintosh, Copyright (c) 2014 by Ryan Clark. All rights reserved.Liberator LightRegularRyanClark: Liberator","md5":"af3e322cea756465bd5a0999b04015ab","sha1":"e89b565e8ecb1b6c5ee99dd1ba800527aacdbd8a","sha256":"40afc1c8064bcf773625ea7f2e1d2b8cf8f2e466afb32bc6b1a4cd601c4c1c1a","sha512":"8fed33a9ac1b7dc6454b397740e2f1e0b541fad3a6e6936e28e1bb663c69b1c5965e99ecb9eabc830df07fc6ddc9b0b844ec93f1c0634ce7fac57b9a3c79d8eb","ssdeep":"192:EgAMGuDiuXplQ/e/qUYZ/8C+w2YzhWLsfhK/NNCxTaVYEews+9jHssI/m0YaRLir:tAMGt0cGqUY/wsJKFNkUR370YaTdNe","tlshash":"0f62e61fb7d47716d0e346b59db44e9263b0ff187062671b3856920cbc6b2d0ee24b1a","first_seen":"2026-02-21T20:23:18.58924Z","last_seen":"2026-03-31T15:47:43.224018Z","times_seen":37,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/icon-dexscreener.svg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /icon-dexscreener.svg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ze5fRxfDAr70iHmcHFcxQmMXeY5zq%2FHWKJcekAw6leiUhFcm6Qp9Ls2IIEAiMi9vlU2XXY%2FqQlXxTJfBmRPRZI9JzgG%2BJf%2B0pi0mLwkrauAcKNbb\"}]}\r\netag: W/\"6996526c-dc8\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea45b86ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3528,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"557e5ce736922b68ca165080955b222f","sha1":"fb7f35d0228eb0d09151831c9a1370926c70e50e","sha256":"448f11db79da0ee3df437c480f4254d1b8b1fd8d88f985b83fb5b8356e8e1e64","sha512":"0f07702366b44010489441e35ceb9367132f04751e425b16472d60135915cb6dbe3918dc5d99f690ff79cb6355bdac793431abc5962603a05c8f04085328aaf6","ssdeep":"","tlshash":"8d7194ea53a870f0d602fbf4c336807a3a5720fe7b26de0802a89d15bd5156d448d8c6","first_seen":"2026-02-21T20:23:18.558911Z","last_seen":"2026-03-20T21:09:45.843648Z","times_seen":29,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/index_6.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_6.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oBm%2BW8Z6U7NnHhNNxZUQ9r55kNU8txM%2Fr3nZi%2Bnzk89vOxHG%2BnA%2B2K21mml7doWEBDN4jeU8k1Qc%2FF3PXsw0Gtr0c5bvkJsVX%2FV6dQVEH4FtRBRO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea4669aea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24861,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16001)","md5":"bdbf05cad4adb3393ee7f239a532e06f","sha1":"7732d48e27b15152e43084212c2525d213da8727","sha256":"9be2e0e32c8a7ab1c1dd11bff6953dc336d1177a8009b4da4748d5b512a1ad48","sha512":"99cc7746256c788540dded9d12482bb0aaeb00726c252c896d23eeceff1bb9bb1bc5de20c7eefb232dedb818d3dfb6c61513d26196c8fe844f54827480341202","ssdeep":"768:b0XQnUVYKKLsX0YrrJbHaWadnGGhGgexZbrnbOWYPZRECnPnRJORAPhhbPsmLs2Z:b0XQUd2T8Un/nezk","tlshash":"44b2e9b34951043ae35b6e81b7a76b09b3fa520dde0254a51aa53e78d2dfcd35003b8e","first_seen":"2026-02-21T20:23:18.573377Z","last_seen":"2026-03-18T15:39:04.148803Z","times_seen":27,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/camo-texture.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /camo-texture.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-67035\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NUxTwPhcdAShJR5g5WS4%2FKAEqY0l8pDwQqLuSA%2F%2Bc7yXUwHZ3OM%2FfQhP%2BdJ%2BN65N%2FJIITesrC6IunO%2FOenPtGbJby3mvNpIhHjIJyrYN6RwVl1VA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ba8ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":421941,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 816 x 602, 8-bit/color RGBA, non-interlaced","md5":"5b55b5d804d956124316431a0e6b2b32","sha1":"cc385b5e5620e9867589bb7a1f5c9394330be0f0","sha256":"d6e42b848f5ce87853c14d89c074745a7114e5e83e3e3a809269cec7d0761390","sha512":"f0b933f58b15b9dcd9a7e43e0f96c53279228231f26492ddd5a44c2c965d4f0158e5257539cca9ca5c7e396420e120075e404645ebc9e5db4c2774bb4a49e006","ssdeep":"12288:sw9vK7JhPkfHX2C1ypwmC8q3rcyqt0Htrrt:v9CWHD17vzqt+","tlshash":"9094237514c7d161df8cd9d42ae9706f7f0acaf2c4a48c39c119218aad9a3ecd4973e8","first_seen":"2026-02-21T20:23:18.561159Z","last_seen":"2026-03-20T21:09:45.883495Z","times_seen":30,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/traded-image.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /traded-image.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-37a1a\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dnzHmRtWuIWmEhXJR4BqWJ4poUSw%2BntJw99Qx60sudoT8qHG0gJpZmhDnqMTyqbVwXHckVTAAwkXwPiQvXjDoLywmuElJf6UmhABiiJENoDDZGK9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ba92a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":227866,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 612 x 408, 8-bit/color RGBA, non-interlaced","md5":"d062233c1893fdfe124526cd196853b6","sha1":"f010c51113c8e6172ea6a9cd3444e0ee5dbf37ed","sha256":"b7c55b41ff78964bb6711c2812b4c3a5ce55e94ecddd39b76890af4c52217a0b","sha512":"c4f98a47d8c950fd241b11689789d93e0716678566177ebd32b9c9b7553de82b2884abf4e9923e59e7cdb43e64d6b9527f049129b4a851a25f27061c97e99f7d","ssdeep":"6144:Qfin/HBIKOlr7TtD87o6WgYBEKsNs0NOuqW9O:QKnPzODDuoE0EKqTn9O","tlshash":"0424232d38c89d3ae9079910d3fc6dd32aa85d2fa4645c1d7e26b39c9de099dc0b43c9","first_seen":"2026-02-21T20:23:18.585478Z","last_seen":"2026-03-20T21:09:45.863781Z","times_seen":30,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":115,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/u1476882918_httpss.mj.runjH2hpAAhtWk_b2_bomber_hovering_in_th_e1dad761-cc0d-43e3-a8f3-5a11abcf6f23_3.mp4","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:34.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /u1476882918_httpss.mj.runjH2hpAAhtWk_b2_bomber_hovering_in_th_e1dad761-cc0d-43e3-a8f3-5a11abcf6f23_3.mp4 HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 1127342\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\netag: \"1133ae-64b21fb287300\"\r\ncontent-range: bytes 0-1127341/1127342\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tO85WomnYSh4fo3DZmFki5cmHKS3nA1zCZuEbCUleGHYIrRXT69Ad9n8zlY%2BBex7ydUEZ2x09ZVRhsg6DtiZdTFnN39kTKxJjdXt9PKfgvyCkNI%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea477c00a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43190,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"413ffbe535cf97906517fa96230d67eb","sha1":"f75392933f4f7a2b1700518918022cb4295c5165","sha256":"5a6ce9f0d6de41060235e2e2bbc5baa16cdaef5bb2e9a55af3ca6edd94062f09","sha512":"528fac8aa219b5928e49c453c148fbf11df99b29a4eff69626afce1eda951262845883d5f95247453c424583ed982f1fda20b3f9864ae11a513ac34be97ea4a5","ssdeep":"768:xogbhFsBGj3VuRg272YErf6/mKZJ6RDIir5LA0y2Ba4HwSjVgF8+4pYkMf0:GgbhGgj3H2pEL6uKieL0yp4djVg7CJMM","tlshash":"e413f1009b61ee93c204943370a853d97354eaaaf8cf930772c85e3dfc96a921f3b019","first_seen":"2026-03-11T00:52:20.858746Z","last_seen":"2026-03-26T01:11:26.232288Z","times_seen":4,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":101,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/SdSVVMpj.php?s=%2Fjmpd%2F","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:36.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"POST /SdSVVMpj.php?s=%2Fjmpd%2F HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://reward-waronusd1.com/\r\ncontent-type: application/json\r\nContent-Length: 1492\r\nOrigin: https://reward-waronusd1.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1492,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB5AIqAy0AEAC0AhMDLwA6AzAAAgEAZwMAAO8nhn2XtsKCAT1Md34qbxrAfjA7BGsCAAD7MBxoVLp0Q9ZDQ-keIc4DjUIcJG5hF40dQZLbRWd_P36RbiAUmW-XcDCIaYFQnJhTvgJZ6xQA4baWk4-O0WvaTptStNTmslfaQNzjR_3z97VR-iaivfhZw4Pfacv06Rr5gCb-n4EvZL_Q2dvlwzCPAo1PHIAC9Ldk_PbRXh2z0d3skJY8UthxFS6rfOiwaN8tGChPV2vKnFiAEeGmoyqFZ4jcxGoP2v1gdMJESVrZnUffCObSj6ykRtt-bUhLie5SBw6mCaaK3bdblsFGovc53Du10GOtUHowi0_zC2OUvuSKbS1Ml5_hKbyrMInh-hK_E2c8r_DA8_8TlCVoExNjmRpUZYe1o7vgKkuiqpSaChK22U88rlcqTFnZS3dCjbg9iRmzYE2LQgjH4147myfeA7Jpdj2T0bM6LiKiSec5DUSHZyaILNQIE7YhE2uQq7Dmwq3cX95VbG5mTZ5W_4_1BMx3SlrT6Fs2THK_VgsD2Rk9dgHCUK7dcuaZodzAnkNRZo5vp6m2DcroqoA8rzJpT21J26-tg0oa6h1-bNCqeDdc7gSk30uatg0HDFrEXIywXF6wYfuXX8V5CLfxJAN5XphJs_f4MxclSqvx16PV6QzheBxFUwF5UYg_kXykXPD54KvKw7uu47vpuA958hvzLv-H0ttgu2q8iF0Zp32FgI-haLL5p8vRlRqoSlYEmRBbhsHHTrklikzhxntjWC5u81DMGp8pXFNzlDG5Tf2-2rZvzDAOpwcpSr133KWHMlVgrXUgTx7-q_Qq9jdxLjG258agLBIlAY6ZB2BcZP4DWUGw1tIMaSEdxU43RApnV0JiEjAeSDRRwFEdFBS7Nor6Dpnm2mudBuxUOP1e7BGRf-JjcC-1NHI7CVcU5DIkptKJ1kZ4wG-LHeoP2rFynHdhw_oPdXrqu4pMfOn89fuXjXKcSJsu9_EfWU-3FL15QMjgS5eo8VHRnZb3qccSDMNPWLXosAa7i7APSEwAfr6Z082SQMrhRNpUIlVWaGSeU8VQS3zK_9OLL2FLD-xVX_OTs_gsV95v5E760fHYET4gzzMfM4euEXS5ShHfGMKiu55zon3LK9f2sbxjIs8u7iKfahg5iwGU5203mYtIVEa_ljTz2FEMGIrO-0b-eOWIODqgUvXyuUaJBBG3kpzsb1rS6tjkqv60O19X0NBOeNYQ\",\"challenge\":\"eyJpZCI6IkRMNDhrOXJ2ZnJnampsN0hKczlxS2ciLCJub25jZSI6MTc1LCJoYXNoIjoiMDAyODA2ZDQyOGY5YTJjNzA2MGQxNzhlZGRlMDhiYTZkZmE3OTA2NzY3OTI3NDgzZWM0NzlmYTVmOTljYjdhZSJ9\"}"}},"response":{"raw":"HTTP/3 400 Bad Request\r\ndate: Sun, 15 Mar 2026 04:53:37 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 11\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 3600\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EyhDHlrv5aJdwXLWE%2B4Zaz4Y%2BMx8KGPQxq8CuKKhaqZmmXcVR6aXAcdJlsXzYE6JFOSlT0Hktj0oOdRWU2gbQy7Cdz4Cye%2FmcYXUJfIlq64odkMj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea55df8da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"825644f747baab2c00e420dbbc39e4b3","sha1":"10588307553e766ab3c7d328d948dc6754893cef","sha256":"7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa","sha512":"bfe6e8df36c78cbfd17ba9270c86860ee9b051b82594fb8f34a0adf6a14e1596d2a9dcdc7eb6857101e1502aff6ff515a36e8ba6c80da327bc11831624a5daea","ssdeep":"","tlshash":"6550003300c0300cc0000000cc00cf00003000003000003300000cc300000030000c00","first_seen":"2023-04-05T23:04:48Z","last_seen":"2026-07-24T09:19:16.11251Z","times_seen":10428,"resource_available":true,"data":null}},"time_used":1284,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/SdSVVMpj.php?s=%2Fipfs%2Fv1Gl2RMY8M6BdnpUUDUzFAe8ba416430374979e01ea110bbc0d980%3Ft%3D1773550413682","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /SdSVVMpj.php?s=%2Fipfs%2Fv1Gl2RMY8M6BdnpUUDUzFAe8ba416430374979e01ea110bbc0d980%3Ft%3D1773550413682 HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 3600\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XpY8YSPEqg9tzpVbEK6eozsu%2FbYLLAWVvrWlnGvTqrgoqAhwnLvaD9PuAlLObLXk2lUBPFUmco9pyMIoUuQnsiCRx9P0KTr9mniVH2uGJBsMoquz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea45b874a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":634343,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"8167f5053cde3bd00e53b840c1d48f4b","sha1":"9945d37625ea80e348cc33c83dbccf328a3a1e83","sha256":"844fcf4a346f95f8447d87510416269a7250cbe26b8b0b0516a1d0930bfb3bcd","sha512":"2a67fee398c113543137566f018d0d47567e38a454aa28e4b452cebbee3e2d8440cd833c38f0e67c95ba0b96ca46689af9f4931a7537804ec509e7ce3de74241","ssdeep":"6144:qh5gDP6Euno4xvlISDhTl0WHvfUp+v+9J87XGQOwOyyGpMy:qsPZunzvlzSWP8p0Q+Bz","tlshash":"55d499c08b4c357364802aea15fb446fdfdc0de82e4be8536bd09ca5e379b8351e5998","first_seen":"2026-03-15T04:54:01.552984Z","last_seen":"2026-03-15T04:54:01.552984Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1785,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1704,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/index_3.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_3.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b9S8jHmpmJILrBjejciE21f%2F7Z9oCagEzFY8Q59ZOA3TNMCRG2v2Gdiyrswq3n1nMKZCKMoYOK219JYc3%2FZnFVq9STQ047W49in1tDNwjw%2BrhW%2FZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea4679c2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23541,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (14743)","md5":"f754b0c067fff35c09a015ae158e0647","sha1":"4c275beb43660f618492e09c565dc754a2f9ad97","sha256":"66fc9885217fed4c6fb92ff7978ad442d0182197eb55759c00869958e288bae2","sha512":"6a52679e59a1e0fc60e25a1b83d23b18d42bf1ac5fc392c53774b8222f903c2ce990853ec7c2cb56f033a240adacc5b133154aea7dde63f2245ab600a53c05aa","ssdeep":"384:sjqbXQDzUVsVKKLsw0YrQJKHaWadnGGhGAexZbrnAOWYPZCECnPnZ3WORAPuhbPQ:sjqXQnUVUKKLsw0YrQJKHaWadnGGhGA4","tlshash":"2db2eab349500039e35b6e81b7a36f0ab3bb520dde0264a51aa57e74d2dbcd75003f9e","first_seen":"2026-02-21T20:23:18.565269Z","last_seen":"2026-03-18T15:39:04.116978Z","times_seen":27,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/broadcast-image.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /broadcast-image.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-484c5\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3tA1loYYSjKlH5DFuKyLJEWXD98gnx9rko0CuX9n73vXbXMxF%2FzaLqdhPak8yxCFz64FrKVzChCuV74WuA%2BUy5vaHJMmaeqAyJep97r83s0Y%2BqTE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ba91a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":296133,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 612 x 408, 8-bit/color RGBA, non-interlaced","md5":"676766ba559308eb98d5723d7f460f68","sha1":"8d7ef2fdb46bf1d05fdd5ca3f0230c66d5a4543c","sha256":"d0d332cd2b3f2e9468323abe1a1e7caba2a7f4c8efed122983b0806c39f5510f","sha512":"d7e17d2a03c5f83e83cd30c80f22c1fc0a84fca903cfaf323c8722d06340f3cbb1a37b9ee3e85975727d567dad8551d0240140cfb8e00432ebd4e01e986c827e","ssdeep":"6144:/gnsmNYcvzuLMSnykqJGknVFUDXoxIdbDwCSgSVptZvAWO1ytPlj3YX:DRcKLJykIGIVFUDXJdQCSgmDaWwyzj3K","tlshash":"fc542359b0d6b26de07bc0a67d0fcb08f198e516b00d1e389a5b05e2b4e43d5ba1cddd","first_seen":"2026-02-21T20:23:18.58801Z","last_seen":"2026-03-20T21:09:45.875479Z","times_seen":30,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/Liberator-Medium.ttf","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.896Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /Liberator-Medium.ttf HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/7887fd7f57dea799.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 14668\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:41 GMT\r\npriority: u=4,i=?0\r\netag: \"6996526d-394c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xL8Fov2NIMkAvTK6cjslHk8IqimvgXPu6YpMg67VUG80FKYKifLfLgtYTdn8NSNaD4WvF%2BR73XpZhNJ%2BhiLFuimcTmmSRYfK9YrD6RbTOwflYYee\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ca99a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14668,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 13 tables, 1st \"GPOS\", 35 names, Macintosh, Copyright (c) 2014 by Ryan Clark. All rights reserved.Liberator MediumRegularRyanClark: Liberato","md5":"93f48cb2b0a5a6b6982bcf980097455d","sha1":"ddfc0529deeef3b9d5507dcd562543a4b89bd42c","sha256":"1acd9f43b3ea85475c53c9e1487af0c5a2c70ba3615b3e84225517dd76ec21d4","sha512":"cde25ff95a8cce3caa1d60d15950b600341b5a8811dcda06c01cdf40c767161e6eb946feab5573acfb0870acef807d15a3617604ebf0dfe3ab7e20c81e04399b","ssdeep":"384:SqT5eOlyTycBFB4lf75ZFf1C8L4RnHyjeeO:RX+ycB3wflHNC8L4RnHyjeeO","tlshash":"1262fa2bf7985312e0f357b8c9f48b4263b4be44b1a66717388b920c6ca95c0de15b1f","first_seen":"2026-02-07T00:47:20.614414Z","last_seen":"2026-03-31T15:47:43.222629Z","times_seen":40,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/icon-community.svg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /icon-community.svg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BCLCODzGp1ZAqm2myaAv2eVUk4aXMhBjsd5juegre%2Bzos9hxKkJsvbeueEyHuxFT6PCaLIzqsxyZoJa3pORfFHSvZ%2FTuct5xBoU6xvfBXup5WjRv\"}]}\r\netag: W/\"6996526c-be6\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea45b86ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3046,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ca4b331e85655b8345a6f33d73d46df9","sha1":"6e54e28b9dcb3218cdb720c8bcd309ac7984cc4e","sha256":"97c0f156ecfa1ce4c3b5b1dcb220e7db284bf7060d1565bf4a48b7be2438eb47","sha512":"6276353a9bff9446d1acf68b91b6f40fba8a12d99a7c6fbfdecbe3b625741b71e3b8d9738e2fac7b054e6e231c65ba3b81789e8ec61a5dbe226003a5ff7067be","ssdeep":"","tlshash":"7d5153d9e2e9d3d4e282a3b1960ff4363547a9ff6d008b580354dc3239804ad4e9d5cb","first_seen":"2026-02-21T20:23:18.590601Z","last_seen":"2026-03-20T21:09:45.865321Z","times_seen":29,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/index_4.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_4.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7XnsD4yiHkkWQsUVlmbbN%2FwULtrBLs%2BLGgtmAHWXMT3EcChZldMkTQ%2F%2FiWdZEmGkFI5C%2BuwKZH1%2Fg1c7WawsZqZYqgOzcx7vOj%2BQz2dr%2F%2FmZutA7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea46699da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23380,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (14981)","md5":"d12901facda5bc40c9ed76074ba0aee0","sha1":"255cf98adf4016c2348a5f295a84cfbbcbe44a42","sha256":"cba00eaeb766134c4d400e1f1c54a5b9f409cd41d456dcb56e227e2d693e13f0","sha512":"4f1877f525391f52f173e271d3d6e678803cac349ef578f728bf18024ad183148e5d48a3cc6a07b0707cbde9427922c9f59874ab2b6345cf6a00376eae0df52d","ssdeep":"384:+ZbXQ+zUVs1KKLsZ0YrhJMHaWadn3xZbrncOW+ZoECtnZ3KORy3hZDm9s2vjKbtE:+VXQ+UVWKKLsZ0YrhJMHaWadn3xZbrn8","tlshash":"25a2ebb349400439a39b6dc1b3a36b0eb3fb520dde02a4951ba47e64d5efd975007b8e","first_seen":"2026-02-21T20:23:18.569014Z","last_seen":"2026-03-18T15:39:04.14717Z","times_seen":27,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/index_2.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_2.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vrPGC1NAKiiSOgnTNcZRZXmfOXKVanSMSrLHJ5OfG1pECvmycOYusSd657HYRSDiVI2buHmaJ59%2BZybg78RnMuKPwDuZvJM14cdp81L96dQKVF8G\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea4679d0a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26069,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17075)","md5":"468396d827f90947e6a668d3efd6d4f7","sha1":"48faa2707b3f19785c28564f8ee3f1a3605f8c39","sha256":"556fc9112bed9fbfb301d0af3bf83a026944da7e51a21c1d1f958ef43b1e6f3c","sha512":"7ef1c82301bffe36371f20ddcb4c43ea3c32dcaeb6b127096cf2572b63d127e07861352429ba5445933100beddf11f092918845d71e3cd29ac750e0dadb7ab04","ssdeep":"768:55XQnnAC3KKLsM0YrIJKHxWAdZGGhGgedZbrnXOWYPZUECnPbjtORAPihbP2mWs7:55XQnLm2xrUTNWTVVL","tlshash":"30c2eab34950043de39b6e81b3a67f06b3bb520dee0154e51aa43d64d2efd939007b9e","first_seen":"2026-02-21T20:23:18.574622Z","last_seen":"2026-03-18T15:39:04.122398Z","times_seen":27,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/u1476882918_httpss.mj.runfOlSLlFOmjw_planes_coming_in_to_land_541a3cf9-0dd0-4358-b925-e7dec5e0b5b3_0.mp4","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:34.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /u1476882918_httpss.mj.runfOlSLlFOmjw_planes_coming_in_to_land_541a3cf9-0dd0-4358-b925-e7dec5e0b5b3_0.mp4 HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 851169\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\netag: \"cfce1-64b21fb287300\"\r\ncontent-range: bytes 0-851168/851169\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZfIu2KqIxexkvJ76fvl%2B3dEgiAlLCRQQvw%2FZeZgg11HMEz8IbirpTk%2FFrppzePnPwdSiLzzJa8TSBM2BFeGZ4mI7pny626FeyrigarJmhkuXydBf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea478c0ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216952,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"6883f45d840ca0d1118b8552015e0226","sha1":"244e286d6c530502b489081d65f5715e5f8d7920","sha256":"7c5cf60c677936d97f8c1846f943e76a965a0bc306e13775a7ec7c4bb60dff61","sha512":"b48157390dbac61d39a2aa35bd8276bfc1b457ca9da3b9ebd5fb37187e273f85f1ef38ead3b9746785492d7c9fcffdfa9399ab51d565ff9881ee87e4dff9bfec","ssdeep":"3072:fYyRe+oQ1/oLLt0eAzwsSLC8USJ4Tb7ovJCPIYDM3LTny40tciV0j3t/pg3d8pz:RVxqLthESJ43eUdD/SMSpgqpz","tlshash":"4b241379436642dcd225c4f4adc84a367b36c2f6d0b78663f31146a2fe85af26de900d","first_seen":"2026-03-15T04:54:01.556629Z","last_seen":"2026-03-15T04:54:01.556629Z","times_seen":1,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":125,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/7NoruMt1_normal.jpg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/index_2.html","date":"2026-03-15T04:53:34.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /7NoruMt1_normal.jpg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/index_2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-9bb\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qKyMFfnYlRu2K5biiiXsIvPQsjI%2BkGhUNN7bHDq76mpuCVCkIgSuWwAh8sl5ezJtbIekyXl7A4JeOfwXNcTpag534cOLQ3uWFmFsUqITDRLRDIrL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea487e1da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2491,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3","md5":"4515efa6b28ad83821f753d0a65dbde0","sha1":"77a61317894799d66af8f62b8d45f31d8bdfc64b","sha256":"a7e51ed9fc9902a72dd8dfc48df876e50f9da096400abd449efac01744d1eb13","sha512":"7a9b8d92c645e784d49c2b8dd835290846a9420652b773db5c374b617413470eb650a1cba1ac62def82056dfee1bbaa096854b04b71e8ddf854998299438622d","ssdeep":"","tlshash":"58510910d74c264ae93e73b16cd0cb70ff0a3f124b9e5bda758c860c3b698c18e14682","first_seen":"2026-02-21T20:23:18.581575Z","last_seen":"2026-03-18T15:39:04.10286Z","times_seen":27,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/hicJQmq0_normal.jpg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/index_6.html","date":"2026-03-15T04:53:34.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /hicJQmq0_normal.jpg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/index_6.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-62b\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jp8FlUyD7yBoxezmeKpnjrhVDJd%2Bke3XA2clc2%2FCcGSX77sSKXk7YyGoD%2BWGztTYT2HFt1kmfhpWC%2FL9kjccOj%2FW4TsTTitrOHhiR8Jy6oKldAf8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea487e31a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1579,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3","md5":"f8db2f21b96d1172097624ad1427539d","sha1":"b9902e15429cc54dcf2b3f923a6e1dde61e278aa","sha256":"6a566be766e20903a951fe2168a81d208d54d1181d5b6fa875c93264f4109b1e","sha512":"47ba913047cc44272434c708d584916e49e7353be00afe46e608b12ff054a6e6036176b3dacc1a34942b788bd0d41828c4bb3e57ce0efb7a411e1f099752d782","ssdeep":"","tlshash":"6c3195b14b592706e92e173410d02769eba93f23edc6531fb584841c3b6b0c1cfe42aa","first_seen":"2026-02-21T20:23:18.564285Z","last_seen":"2026-03-18T15:39:04.1123Z","times_seen":27,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/airbase.jpg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /airbase.jpg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-1fc44b\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=maTl3k%2F9704USfaqaYumKItLOfWjit5SjWkkQsilq74%2F18HpTnMDHpUigd9Q56OdSwgZ65Nrm5LmNjPdRqvJnkxAYzBI8YxlrJ8iD2PyYCEasiV%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea45b861a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2081867,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1508x1889, components 3","md5":"caa0ccb59a5cf098ba8d7ab842e9a953","sha1":"fa486b8aefc44aa207e0c900435dc18552ea3a3f","sha256":"569191c79e496c1f6ba11ca44294343f9e131936c23304ded674b789f5f8b286","sha512":"1e6e39d9a0708b433682fc38717f271ada0934e31d75001e385ee3937fee7d25f1144c30a8dafe4525db93625bc5aadd6a2feb0b231dec960de493a6856dac69","ssdeep":"24576:S5NODAg//xPT2P50PiofiOElPLMo70bMqGXnxT4pYGJOypEP:S5IZKKPdfiOElTMo70bcxT4GIEP","tlshash":"b92533657b22139bce080921547e2f465a24157c196cb45a02eca9db983ef634cbff3f","first_seen":"2026-02-21T20:23:18.567714Z","last_seen":"2026-03-31T15:47:43.225249Z","times_seen":37,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":191,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/index_5.html","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /index_5.html HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=53LR89ALPtkQq3SravAjHHCsTliskmRuOkLH2YNysqxw6Q9JZQph%2FKjzrnEbxx8CeFQngtimIHodRHR3MIDpr9AZq3L4Zqo7EnDpUj%2BH0z0FUHBJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea4679e7a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":292,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"67febf8167b0d5469be352ae513f51df","sha1":"d6cbac2d124095585f81bcc0d2778318bd3c7567","sha256":"aeb74e673be38ba39fa8956909f68be8702559f0a71929e145943d8efae1d0ae","sha512":"ecc3680f076b615ce684c1e249a1af19b43e222d3a28ace2a2e789bb75c4aa5658b34fedccd20b2b1a686ebd2b359c03cac93b7c03922292c3733e7f2ef9f4bb","ssdeep":"","tlshash":"20e02bebc26104492e54ab904ac6b5140ccebb5fb5118e6c6e77b0b9eded2b1d137344","first_seen":"2026-02-21T20:23:18.580264Z","last_seen":"2026-03-18T15:39:04.0954Z","times_seen":27,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/Liberator-Heavy.ttf","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /Liberator-Heavy.ttf HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/7887fd7f57dea799.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 14724\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: \"6996526c-3984\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pJwkgaWg3l2UUQ4exVrc895CK6sBaChcC5pxMfR7x6Lf85ZQsJBfb3eLnF8Vgu2e0hRCLZINajv%2Fbu0xNUXnKpvz0qHGC4OPLVaNa6q%2FK5mTBPij\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea473b83a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14724,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 13 tables, 1st \"GPOS\", 35 names, Macintosh, Copyright (c) 2014 by Ryan Clark. All rights reserved.Liberator HeavyRegularRyanClark: Liberator","md5":"3616b9ebab2971aa599027526096cf8d","sha1":"a80756bbf7d227ba9655d5488469b04dcfe9e24d","sha256":"1a1753ca55378e317d4727123c3ab400580856391841551322d50b4604a6fcdc","sha512":"5d0edfb11a5ed5524e0185c4b85d3a5ee2a7cd4e55d68aac89344ec98e51e5581c61aabf2f3669c373cae1c49400555882afc06d758479fa59a4ad7f2411c5ec","ssdeep":"192:y0eJXnN4N/jiR/UGZTSmlMuMu0K6qWHncWbcIo/+ywZUmeZQD7plM6AIBL0xg1c2:onNiLSBygyHSI9DeGpYIZ08sO","tlshash":"6762091ab3d45327d0f30ab4cae48b9253b0ff4575a6a70b248b964cbca94e0dd14f1e","first_seen":"2026-02-07T00:47:20.601416Z","last_seen":"2026-03-31T15:47:43.223274Z","times_seen":40,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/join-the-forces-bg.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /join-the-forces-bg.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-20c560\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HFGKEpl2ixP84N7ryhljk8d%2FBIvU4KNhJSlQGE87GJI81hRpLSXVbY7KpWY5RCikHLkypYMKn4UKxSpKD0wOSxZh%2FmK1DQN6jaI6GBibEqmANoFT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea45b867a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2147680,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 4096 x 2304, 8-bit/color RGBA, non-interlaced","md5":"f2c8480a46a489169554d560f8984ca4","sha1":"8bc22071bc4cd9e2452a5f648825d454a66f695a","sha256":"72e86101441b15444cd26093f08ee47109e3702f168f72cd616d4b3f8bc6102e","sha512":"e95a42777e838cefc6472e87a0a11612ee2927afd8d95a774ab07b4e69ff9efa7d7cde961f9dd7dd5e29378b7b4abb0c77f908dda115897bbd33a859a89b98eb","ssdeep":"24576:f/pXeJv9bQw6UGsjVi0ss3OODgu+6oo3opSxX9UZ/Kdia+:3pOJOw6UGcVi0r3OODgu+6HopSc7","tlshash":"7825df53cf51a9bba6840578b74324c6813628b7b259cf0f1f86613b6a93bb4fd30d49","first_seen":"2026-02-21T20:23:18.597863Z","last_seen":"2026-03-20T21:09:45.879319Z","times_seen":30,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/commoditised-image.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /commoditised-image.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:39 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526b-32fe7\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aA7nZMAQOtneDEyJ5eigzuFSeFhRBkyh8CfrqlCCT%2FY0G6t2J7HAH5nCw5LqYDZ9XyYxFK7oduqVebi1p%2BKQci7Jv2YzO0eNYNdXNfEXvFhWDDIL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ba8fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":208871,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 612 x 408, 8-bit/color RGBA, non-interlaced","md5":"fce64125e5c126bb4042647835209f56","sha1":"361e4a076ec2a617e8c3b07e660b88b44ed32081","sha256":"9774272c7ad7b46e9dbd0f6dd731d64ba2f819bf6cf4973a6c3fb13a2c80e563","sha512":"25551cf94e63163ac667e46779bb862e1c4c4abf9ab190e73ab5b064399e82b3943584de49b51204324147900a4da1e05f96e2dbc35deb6f31e4e612e8061a9f","ssdeep":"6144:5iKbytOJ/66DyRifOq9S6BEF/r6QGcZrsBG2FLI:5YY66DyRuZEz/6ugsa8","tlshash":"88141269387144adc577af6f4ab91a190392f290929cf1b2fc93448c6642bd027fb4fd","first_seen":"2026-02-21T20:23:18.570844Z","last_seen":"2026-03-20T21:09:45.85982Z","times_seen":30,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/YjUypt9K_normal.jpg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/index_3.html","date":"2026-03-15T04:53:34.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /YjUypt9K_normal.jpg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/index_3.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-88b\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cgFu6BaAiw82hEZ0%2FQns%2BQNj6eM9hjxSUFxWF2iPOej1%2BRKS7hyZwhPbh27GD5%2FF%2Fs3kEaqbX9kyfqZi4fKeH%2F9Muf2v5LLgt3KSpGqB0ZBtTTHu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea484dbba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2187,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3","md5":"6bdc3ade311e9b3c1e24d9137e827a90","sha1":"1892fbb159a3b2f6916bf73e54d4f1933cf22abc","sha256":"dbbe75c2d89830bcd0e7f59859faba5b27e40911d67bd0fce86e6d4f72fdebee","sha512":"0267314a3c58aaf526ac75059db0e06b3a27d67441ca702c498c282b00ae82228adba10d297bb5354023473c6dbb4aa70c83688e63e74b671c277629dd208e3b","ssdeep":"","tlshash":"5841b7a617041a09fe5e167c30a44762f29cbf24eda9579fba8d2908636d0c15e207f7","first_seen":"2026-02-21T20:23:18.560076Z","last_seen":"2026-03-18T15:39:04.133775Z","times_seen":27,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/1f1fa-1f1f8.svg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/index_2.html","date":"2026-03-15T04:53:34.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /1f1fa-1f1f8.svg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/index_2.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bSsj%2B3tqj2SHdFZ5fpag9rIyx4vQmfsBCugeayYU3dTwpFLQ6Ix%2BTaaln5rutedk8mGevhenopz99MuIJ9GPjB%2BFKJE9bcrryLBwt9VGihCNW4Cw\"}]}\r\netag: W/\"6996526c-99e\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea487e30a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2462,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d788b9231ed2028dc29245f76cf0a415","sha1":"84b0e307ec9e553db1b6cca0ce7db506672aae4e","sha256":"1feca2279a6e78133bf577b99e4f3e82896622c255d29017cec5f5cfa93e4d16","sha512":"0b6ffe2a426cdd2a35abc4adee091354eda6f540a15c027b198da4a5c2ba4c80cf5b41a2d825d81e9e00a3df3ce1bc256488294c5a0cf9d34a047d20c24f32a8","ssdeep":"","tlshash":"e45110c5c5b3d38c870d92f61bfb591c01810c5668fa8ab3dacd8f226312280ab4f65f","first_seen":"2023-04-17T17:03:28Z","last_seen":"2026-07-24T09:03:09.295504Z","times_seen":2444,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-15T04:53:33.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 05 Mar 2026 22:42:21 GMT\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EffkRbdTFq%2FadrrvjNebqDgzytWiCEqqVg6T5jJ3U3AwGvIXdUIi%2B%2BtOWpwWu66WLrMKmzSC659zEG2fazm4CV8cG6I0cSQmhJu%2BHT86hW0Zyi9U\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea43fe1f120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50344,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3791)","md5":"02a45453ef064e1779e2676bcf135469","sha1":"71ffdfd860297ad1474db9fe79e76fb6fdbbf7fc","sha256":"e01cf8c52cf07dc30b45d2d5d15863ea92138e19299df5339a47748a534624d5","sha512":"8835326fff732838c552f7749945299617ad0422c5dfc79ecd5880c3c5af8115a1a4c921d98ba2b8e3ec5649d63ce6fad8000fec5db2908c734817147278d472","ssdeep":"1536:mHJ/3xtkUHxJoWSNyoYUlA02Dr8fAOBs3H1fvzoC5:pAjh","tlshash":"d033c82597e111585047e0a8fae2671d2739c203a70a0dac35ef37e1ff8f6d186676e8","first_seen":"2026-03-07T01:34:08.982074Z","last_seen":"2026-03-18T15:39:04.104172Z","times_seen":23,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":49,"dns":41,"connect":1,"send":0,"wait":70,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/war-footer-logo.svg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /war-footer-logo.svg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9Z3Oiltbbay0bxqBkp%2BtO14sUJ68TnWGhs6ynh1lsjH%2FQaI53qcqzdvdYI3FmDBFncPrMRWvnY4SN%2BGuSiMY3AelIa8GRq4sVeplE4OpsO3n10A9\"}]}\r\netag: W/\"6996526c-2db2\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea45b85fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11698,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e26562b1a17c8646b0b58aa42b3179b9","sha1":"2bddad66ceb3aabc8e157a69c8dee2f082cbc1ff","sha256":"940e1deb343b4971541a632374e4e97b39daacda6bad2ade218cdf779c1131a1","sha512":"240a8edc82ff7829063a54c99def5a9d13a7ad9b775afd4f1ea032ad77ae4710563666255a237369230682b20e82ceb068ed57f5b3b40685f474546de021bb03","ssdeep":"96:7/qQ6QxGflnNVX4hpJSBsTk/5C3OTDREfVFnqIXeG4v9dvaTGwGnXJPWov40zQNG:PSlNFmNOP+7XpJIZPPKuA4P8pv3E","tlshash":"e6324fdc4a45c3e4f4a0d6feec067a1c765334fe7ba15361c2689e823be656819098cf","first_seen":"2026-02-07T00:47:20.611798Z","last_seen":"2026-03-31T15:47:43.224647Z","times_seen":42,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/oil-footer.jpg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /oil-footer.jpg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: W/\"6996526c-4b5f5\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ak3JKcp3YY51IQ6oBWlxEhT2QUBt7oUItzR9l%2FHTTuxwaaYXr9uE6lcwGvnb3uW%2FGlSwUG%2BJGtU58%2Bwyfd3lyPMqFXXMqXNDrRqQdAKOW9PLBPqt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea46ca94a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":308725,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1512x512, components 3","md5":"90157bf9704477e9bc87b795e9a38146","sha1":"192ed391f86553d048809d70f1ac9939216b9bad","sha256":"6c0ab18ea20114695b6162540dd3366b8bc40108f59e6494635d28eca25fb4dc","sha512":"fd63a6f422b96351d8468a5ef306d83f91683f7d5cc95e197ee11118ce2250ae9f166523c314609d347bc3f9c85547bde4c4f598c160f2965550c368acecc68b","ssdeep":"6144:mnSkcSxEaM5qVLQMRg3xTaJXi17lExOXRz/KVRWI4+4wjwfm4Wm:mLcZUVsSmoi1BEkX5iVRWIJcTWm","tlshash":"c36412a0fbcbeb240757a47e10bd3fbb5b2226e8a6d0560b11572d648818fb141c3b7d","first_seen":"2026-02-21T20:23:18.586794Z","last_seen":"2026-03-31T15:47:43.218578Z","times_seen":37,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/u1476882918_httpss.mj.runfOlSLlFOmjw_planes_coming_in_to_land_541a3cf9-0dd0-4358-b925-e7dec5e0b5b3_0.mp4","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:34.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /u1476882918_httpss.mj.runfOlSLlFOmjw_planes_coming_in_to_land_541a3cf9-0dd0-4358-b925-e7dec5e0b5b3_0.mp4 HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 851169\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\netag: \"cfce1-64b21fb287300\"\r\nage: 0\r\ncontent-range: bytes 0-851168/851169\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XiO8TkKHP8K1uoFkFyqPafd3q4q%2BaOPyjbiYtxFtNCYCpCl3881rHRUCDsQ%2BUYYVyClB0vlSQ4Dk8LscMzW2Wa3yHDm6NsTWiBFOtJ3xW5P8hcHh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea478c0ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216952,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"6883f45d840ca0d1118b8552015e0226","sha1":"244e286d6c530502b489081d65f5715e5f8d7920","sha256":"7c5cf60c677936d97f8c1846f943e76a965a0bc306e13775a7ec7c4bb60dff61","sha512":"b48157390dbac61d39a2aa35bd8276bfc1b457ca9da3b9ebd5fb37187e273f85f1ef38ead3b9746785492d7c9fcffdfa9399ab51d565ff9881ee87e4dff9bfec","ssdeep":"3072:fYyRe+oQ1/oLLt0eAzwsSLC8USJ4Tb7ovJCPIYDM3LTny40tciV0j3t/pg3d8pz:RVxqLthESJ43eUdD/SMSpgqpz","tlshash":"4b241379436642dcd225c4f4adc84a367b36c2f6d0b78663f31146a2fe85af26de900d","first_seen":"2026-03-15T04:54:01.556629Z","last_seen":"2026-03-15T04:54:01.556629Z","times_seen":1,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":125,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/war-favicon.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:34.279Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /war-favicon.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 661\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=6,i=?0\r\netag: \"6996526c-295\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=me%2Bttqvs0Rfmlq7IZYRJnt4MSwMBeAbPweWMYMB2FQAWkc9gZL3ouGy8SdB8EMI7RhMYKM9MqnZGw%2FMDS05prU2dEhGuv8QpX9DtIM0bRGuUZmIb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea493f74a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":661,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"b9f6bd2a4d6e531a395a8cccd662a061","sha1":"9caaa3ecc568595863bcb536557785e061d40f0e","sha256":"b0bfc5cd9cff1709a44a52447de893515a567a5da4355d30362142ff7c16f95b","sha512":"751e20fe5fe395d6a8ec7fba4b1530c347f985506c719154bc556b34f72c2bb12a18711859490a15086b61a953ba3ec983774f5f7265a929879e4a2ccb8283c8","ssdeep":"","tlshash":"eb0123c2b76e54bfc87314d4527a2be6685b1d669762c6068c8a1421427fe01005b762","first_seen":"2026-02-07T00:47:20.628512Z","last_seen":"2026-05-23T21:47:33.008702Z","times_seen":70,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/7887fd7f57dea799.css","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /7887fd7f57dea799.css HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VpWTzGNcaWk2KgqBipsqYL7wi3JcaF%2BP6ZAP%2Bkuz%2F%2BEUVl4u0Qiv73KQOddBdzsEdIjkrlnQBcGt2qpoLPcEw4s7DUf1lvJf4zGOE6w6LL5YH3e3\"}]}\r\netag: W/\"6996526c-3e7\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea45b85ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":999,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (999), with no line terminators","md5":"213370d7dee286d1c63cb2b1606e4144","sha1":"dc04dacd9be5883fa1ae728a6c3026b2d49880d6","sha256":"35707d84316b4fc2dc9b9fcd5724efaaae86ec0f72e9eadec237ad2c6cc78604","sha512":"341078b781c267b36fe4ce0ddf48dd862b1c36faa5a3ecd36b99af6c05f3efda1a22828f10a7f2071a88d39caf80f9a09e03166c57964bb4002b5b634b90f915","ssdeep":"","tlshash":"6311e62420599970d0b5ae6774ce3f2a391c342592a9493be52a1d39ede78a723e0f34","first_seen":"2026-02-21T20:23:18.578614Z","last_seen":"2026-03-18T15:39:04.115413Z","times_seen":27,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/icon-coinmarketcap.svg","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /icon-coinmarketcap.svg HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f9DNLHvz%2BFgnWJqCVwe7r6occJHbjEY2dSSucx2yXP41sFI7QXnF%2FOCzdVmHJ49IwfpUMBPsM09uoZE1eDkGCJKqHBFwHA9WfMOX59wH%2BPiCiiBo\"}]}\r\netag: W/\"6996526c-692\"\r\ncontent-encoding: br\r\ncf-ray: 9dc8ea45b86aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1682,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6b5408c101e79872ec53804a3fe52cc8","sha1":"b0adaeaa15da9d8ba9e15574d19e4cdce40b44c6","sha256":"41e87f02ec5fa4ee8798c8ead8cc7bb0132e88c1f42a9c26f155d5cf3680899f","sha512":"c2192d84a7daec0ddd3f4f28bb5148e09962704020f08909fc6fc57b1e19986fec8ab6f84bb93285a151c218de87170ac2bfa358628abf40c1a3d4736235e9d3","ssdeep":"","tlshash":"4d3142d8ab28921c60c583d9626454ec6aa3bcc55621cd58b3c09c5bec87c1c89e0c8f","first_seen":"2026-02-21T20:23:18.592642Z","last_seen":"2026-03-20T21:09:45.862101Z","times_seen":29,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"reward-waronusd1.com/x-icon.png","fqdn":"reward-waronusd1.com","domain":"reward-waronusd1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://reward-waronusd1.com/","date":"2026-03-15T04:53:33.731Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reward-waronusd1.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Mar 2026 07:16:21 GMT","end":"Sun, 07 Jun 2026 07:16:20 GMT"},"fingerprint":{"sha1":"4D:4F:D4:9E:9A:52:0E:81:81:AC:C2:5B:E0:6E:CC:22:AD:FE:E1:CB","sha256":"AA:3A:23:78:98:FC:5A:BF:AD:50:6C:18:B8:3A:8B:FE:3A:F7:2A:88:9D:1F:75:E3:AB:5F:5F:B4:84:D2:1C:4D"}}},"request":{"raw":"GET /x-icon.png HTTP/1.1\r\nHost: reward-waronusd1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://reward-waronusd1.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 15 Mar 2026 04:53:33 GMT\r\ncontent-type: image/png\r\ncontent-length: 549\r\nserver: cloudflare\r\nlast-modified: Wed, 18 Feb 2026 23:59:40 GMT\r\npriority: u=4,i=?0\r\netag: \"6996526c-225\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZHqZ9VLsoJcx43ME47evIlT%2FH9EzEQ2apGUkXzqpah7CqVQZd%2FP%2F8cJHR9e9NINQj4cWUw8X9WyTE9OTkS7pW8ABIL3aT%2BjS0uLGGkwS2QJ0vp9x\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9dc8ea45b871a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":549,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b84d3f0e3156f61f37786c7955212378","sha1":"b114079602069721999e00f06776b54dfcaf6fac","sha256":"ba68a4f4199c9c54c34f2fb6b97be6277ba1e43f24610fe963f4b4ececcdd295","sha512":"d6f53d609b898eb49a12308f49b77147a5b3b55290f981ceaaca93f2138d9e21d7ed32bc28e33e3acb0df69405bad77435e3ed3a29410ad48cd1c070aca598ab","ssdeep":"","tlshash":"b0f020dc538aae2ac01d0afb1ce2729cb4e31c2c1322390fa824a15b7a865a4b385175","first_seen":"2026-02-21T20:23:18.584212Z","last_seen":"2026-03-31T15:47:43.22197Z","times_seen":37,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-15","alert":"Sinkholed","trigger":"reward-waronusd1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}