{"report_id":"b435d8dd-6c6f-4589-8436-264901328653","version":6,"status":"done","tags":[],"date":"2025-09-08T14:26:37Z","url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.64.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"title":"DeBank | Your go-to portfolio tracker for Ethereum and EVM"},"submit":{"url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.64.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-13T14:26:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":12,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":39830,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-09-08T14:26:18.540420+0000\",\"flow_id\":369156323682236,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":39830,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3511,\"start\":\"2025-09-08T14:26:18.534460+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":39836,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-09-08T14:26:18.544428+0000\",\"flow_id\":106579203078350,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":39836,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3512,\"start\":\"2025-09-08T14:26:18.538830+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":36076,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-09-08T14:26:18.579118+0000\",\"flow_id\":515215276554685,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":36076,\"dest_ip\":\"104.18.10.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:18.571837+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":36078,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-09-08T14:26:18.587821+0000\",\"flow_id\":1190667603327627,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":36078,\"dest_ip\":\"104.18.10.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":914,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:18.572043+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":59112,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-09-08T14:26:18.598462+0000\",\"flow_id\":707616926497114,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59112,\"dest_ip\":\"216.119.155.40\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":4434,\"start\":\"2025-09-08T14:26:18.555354+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":59128,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-09-08T14:26:18.601525+0000\",\"flow_id\":1222132533721600,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59128,\"dest_ip\":\"216.119.155.40\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":4434,\"start\":\"2025-09-08T14:26:18.555520+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":55410,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.068269+0000\",\"flow_id\":549871367685766,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":55410,\"dest_ip\":\"54.155.105.176\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":921,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:19.001670+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":57896,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.071696+0000\",\"flow_id\":1667250059426473,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":57896,\"dest_ip\":\"20.105.41.175\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058788,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"1rpc.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3435,\"start\":\"2025-09-08T14:26:19.015017+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":55394,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.072376+0000\",\"flow_id\":1875474368890370,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":55394,\"dest_ip\":\"54.155.105.176\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.001538+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":57902,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.075166+0000\",\"flow_id\":846713737396617,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":57902,\"dest_ip\":\"20.105.41.175\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058788,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"1rpc.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:19.016777+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":59074,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)","source":"{\"timestamp\":\"2025-09-08T14:26:19.305884+0000\",\"flow_id\":1264549630813996,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59074,\"dest_ip\":\"52.30.121.212\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058796,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed2.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.239404+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":59064,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)","source":"{\"timestamp\":\"2025-09-08T14:26:19.308691+0000\",\"flow_id\":1138625484662391,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59064,\"dest_ip\":\"52.30.121.212\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058796,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed2.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.239223+0000\"}}"}],"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"bsc.drpc.org","ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":2964008,"first_seen":"2023-11-21T22:39:48Z","last_seen":"2025-09-07T16:00:57.134912Z","alert_count":0,"request_count":2,"received_data":7691,"sent_data":985,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"1rpc.io","ip":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"domain_registered":"2022-08-02","domain_rank":47066,"first_seen":"2022-08-18T07:06:26Z","last_seen":"2025-09-07T12:50:23.447776Z","alert_count":0,"request_count":2,"received_data":534,"sent_data":980,"comment":"","tags":null,"fingerprints":null},{"fqdn":"debank.com","ip":{"addr":"54.240.174.20","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2005-02-21","domain_rank":22286,"first_seen":"2015-11-21T14:42:17Z","last_seen":"2025-07-12T21:26:32.216962Z","alert_count":0,"request_count":1,"received_data":7013,"sent_data":423,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-09-03T15:20:50.935949Z","alert_count":0,"request_count":2,"received_data":798869,"sent_data":892,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"de-bank.run","ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-09-08T14:26:41.315845Z","last_seen":"2025-09-08T14:26:41.315845Z","alert_count":59,"request_count":59,"received_data":10403543,"sent_data":26469,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Lightbox","description":"Lightbox is small javascript library used to overlay images on top of the current page.","website":"https://lokeshdhakar.com/projects/lightbox2/","common_platform_enumeration":"cpe:2.3:a:lightbox_photo_gallery_project:lightbox_photo_gallery:*:*:*:*:*:*:*:*","icon":"Lightbox.png","categories":["JavaScript libraries"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2025-09-03T23:51:20.030348Z","alert_count":0,"request_count":2,"received_data":935,"sent_data":846,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"binance.nodereal.io","ip":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2021-07-19","domain_rank":1804985,"first_seen":"2022-10-20T10:44:48Z","last_seen":"2025-09-02T21:11:52.855346Z","alert_count":0,"request_count":2,"received_data":7443,"sent_data":999,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rpc.ankr.com","ip":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"domain_registered":"2007-04-23","domain_rank":541361,"first_seen":"2021-10-24T12:41:06Z","last_seen":"2025-09-05T07:06:00.702791Z","alert_count":0,"request_count":2,"received_data":1405,"sent_data":991,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"bsc-dataseed2.bnbchain.org","ip":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2020-01-13","domain_rank":4924478,"first_seen":"2023-11-12T11:28:58Z","last_seen":"2025-09-01T23:49:31.442577Z","alert_count":0,"request_count":2,"received_data":5971,"sent_data":1013,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":39830,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-09-08T14:26:18.540420+0000\",\"flow_id\":369156323682236,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":39830,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3511,\"start\":\"2025-09-08T14:26:18.534460+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":39836,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-09-08T14:26:18.544428+0000\",\"flow_id\":106579203078350,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":39836,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3512,\"start\":\"2025-09-08T14:26:18.538830+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":36076,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-09-08T14:26:18.579118+0000\",\"flow_id\":515215276554685,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":36076,\"dest_ip\":\"104.18.10.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:18.571837+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.17","port":36078,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)","source":"{\"timestamp\":\"2025-09-08T14:26:18.587821+0000\",\"flow_id\":1190667603327627,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":36078,\"dest_ip\":\"104.18.10.59\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058812,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .drpc .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc.drpc.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":914,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:18.572043+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":59112,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-09-08T14:26:18.598462+0000\",\"flow_id\":707616926497114,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59112,\"dest_ip\":\"216.119.155.40\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":4434,\"start\":\"2025-09-08T14:26:18.555354+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:18Z","timestamp":1757341578,"ip_dst":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":59128,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)","source":"{\"timestamp\":\"2025-09-08T14:26:18.601525+0000\",\"flow_id\":1222132533721600,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59128,\"dest_ip\":\"216.119.155.40\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058825,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (rpc .ankr .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"rpc.ankr.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":4434,\"start\":\"2025-09-08T14:26:18.555520+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":55410,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.068269+0000\",\"flow_id\":549871367685766,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":55410,\"dest_ip\":\"54.155.105.176\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":921,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:19.001670+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":57896,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.071696+0000\",\"flow_id\":1667250059426473,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":57896,\"dest_ip\":\"20.105.41.175\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058788,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"1rpc.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3435,\"start\":\"2025-09-08T14:26:19.015017+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":55394,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.072376+0000\",\"flow_id\":1875474368890370,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":55394,\"dest_ip\":\"54.155.105.176\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058791,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (binance .nodereal .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"binance.nodereal.io\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.001538+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":57902,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)","source":"{\"timestamp\":\"2025-09-08T14:26:19.075166+0000\",\"flow_id\":846713737396617,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":57902,\"dest_ip\":\"20.105.41.175\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058788,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"1rpc.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2025-09-08T14:26:19.016777+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":59074,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)","source":"{\"timestamp\":\"2025-09-08T14:26:19.305884+0000\",\"flow_id\":1264549630813996,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59074,\"dest_ip\":\"52.30.121.212\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058796,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed2.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.239404+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-09-08T14:26:19Z","timestamp":1757341579,"ip_dst":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.17","port":59064,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)","source":"{\"timestamp\":\"2025-09-08T14:26:19.308691+0000\",\"flow_id\":1138625484662391,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":59064,\"dest_ip\":\"52.30.121.212\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058796,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed2 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed2.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-09-08T14:26:19.239223+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-24T15:46:38.937275Z","times_seen":732133,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/08d0f66d-cde5-48d4-b2b6-8fe9c449f9f6","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"05997da4a9c3d58ef33a7cf3d716af57","sha1":"3a7a7913c31aa2787a11dc6ba6fb5b5f2c525ac1","sha256":"e268ded9f58238c3885b4e0e83ddf10ea9552c488dd25538c8569ec2beff7eb9","sha512":"83413571115e6b39abe7e3b6573a81b3198125b35ae13e31d14c7cb3c81790b24a11cd81531a58922386bbf6e2d41ab6e449fc3206c8b7f20932820cdf58aefe","ssdeep":"49152:D+2KKNjyR5WP4CQjNn9GU6lCLsSPOnLUfJ8KZTcbQQqG7r8aQO/iSJNHoRO2sxSQ:RD8ew45JV","tlshash":"20f591496bf660358213f0795e6f8801b234a40b2949ed5c7e9c92f09f4953c8bf6fe9","size":3517001,"data":"","first_seen":"2025-07-12T22:38:09.134446Z","last_seen":"2026-06-18T09:20:21.342859Z","times_seen":4173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":735973,"data":"","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-15T21:03:46.662531Z","times_seen":8481,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-24T15:36:32.820559Z","times_seen":235947,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/bebd2193-0b8a-4f74-a476-dec835938986","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6efc1d225b5b46870b0b91885890d8b5","sha1":"ef0bf81bb19705ac4ec42efd10f8e86ad8663fc8","sha256":"3e6599f592bb0cdf44f0e529253f3afae6e26ada72d17b4e04a6bbf947ad64f2","sha512":"304b351ad2e6995f0426da5020af3fb41ac5682fa45adb0f4721a915902e6ae5867a2a2ef7f25684670785b65a9dcf272d9c1014f850f0a92d50506ab287a923","ssdeep":"24576:lPe6dy0AJfq7Mi+ISnw2hq23aPIniqXeo6bKgN:l2jIzRnqU","tlshash":"4226a68bca8a1eb44fedd6e55b338540c40726518f6c2ddaf8dd7c9df34c61a92a3026","size":4802062,"data":"","first_seen":"2025-09-08T14:19:33.840641Z","last_seen":"2025-09-08T14:26:52.156565Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/eca9bb7f-e414-441d-8221-ec3fa492b850","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec26a722169cb2cef03353fcf8dd144a","sha1":"6eec6673abcde3d29547796a38361256d9efde1c","sha256":"01861fcd47bc63bb7be76c480bad4c6cc987c8996ab0e023a4e692b68c94b05c","sha512":"c885e5d94bd96fa4a573524356e0ca7398b1489f5a39fc1120cf7f4e469950630ad3e9f48dd0392acd36da390c27a4be1e81da943d1d9ecd48890d1691e416cf","ssdeep":"6144:Ufg7z90bnvLZqnWTI9esVTMuyEvtzXNglxQP92L:VzBe6kEdOxQoL","tlshash":"bf740980b261b07247da24e10477540af339e96c744a40acf6a8d8fb7dbd589957ff38","size":357754,"data":"","first_seen":"2025-07-12T22:38:09.13306Z","last_seen":"2026-06-28T16:47:47.454007Z","times_seen":5087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","size":60819,"data":"","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-07-24T15:54:07.919427Z","times_seen":31759,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"de-bank.run/610.368ff984.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /610.368ff984.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"687c7-63e38798c7b90-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mKyITJhvk2vR9GmbdM18ffpbEycA4QpqHsVKMGQzN2YTodP4V9uc6410p5aYa3g9vlViKc4C7xQrmGMXLJUZXSLq7WIWRVyM1jVC\"}]}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-ray: 97bf1e9a3f6121fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":427975,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65530), with no line terminators","md5":"d91c2379beb20f55901ca98331821383","sha1":"576f36704d8ec6cd1e4cae87c9f566cfe1a36c27","sha256":"4062dfe73ca0af9e6cbd90a9c7a06c5f431acb853c61267e78e87b8969233d32","sha512":"b636af79e6f3da6dcdae46b9aa5172b3052e1ffc3e3d841641316a8ed8d569fdd0f4d0d5f55c1920089d77249ae8d0caf4e2ca816b762baf891726dca9063f31","ssdeep":"6144:KARR6npCDC65gk+1MInbtNzRri7CGRSJFkHBVb9fz:EOC65gk+1MInRN9ri7CGRSJFkHxz","tlshash":"95941b26f255ae3af9b7a42fa6d1d54c3024ca03c9a3afa6f5a1901dc1c76d3276170c","first_seen":"2025-09-08T14:26:52.04291Z","last_seen":"2025-09-08T14:26:52.04291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/S6u9w4BMUTPHh6UVSwiPGQ.f1405bd8.woff2","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /S6u9w4BMUTPHh6UVSwiPGQ.f1405bd8.woff2 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"59d0-63e38798c44e0\"\r\naccept-ranges: bytes\r\ncontent-length: 22992\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iH5%2BcGytHSTiShndHRc6SLSKGN2KTpd3bBLvivswF%2FP1ElP8GAmDlcs01Jsx6xxf%2FXu3yE7%2BxWhtAg%2FdJacd7CXmvDQSVxLM4Pkc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: font/woff2\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb8bb8f21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22992,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22992, version 1.0","md5":"1efbd38aa76ddae2580fedf378276333","sha1":"8a49976f2470ba2a1db6144245355d3b889312e4","sha256":"8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20","sha512":"dd16efd323a38dad99a105e7443546e112ff42158018c885091df498c8c5b88c4d83737b4887332ea54ef3a83483e660c783073c4ce61fca4098d24aac05ed6c","ssdeep":"384:i8dkfSOTyQBgarmZBcC60rEJq/VcteWhh/nqgYA7L3ittJ2MY+0K7YXr5eC:xfHQBgGmZBtnytL/tYSLStDJY+0K0bD","tlshash":"5ba2d0ae5a223af4d77235a4d1bc351db3ddf0c22193e90e73e77138cc7a6451182069","first_seen":"2023-04-07T01:34:48Z","last_seen":"2026-07-24T15:39:38.716121Z","times_seen":2567,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/subset-regular.99cbecb6.woff2","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /subset-regular.99cbecb6.woff2 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1608-63e38798c6420\"\r\naccept-ranges: bytes\r\ncontent-length: 5640\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rnGka6vK48eTYqxRPGs%2BCgC6%2F9XQ6isTwdVlEtyXSQfoHQUO3TskY89Bzv%2Fmx5uCuU2PWiylW06EKkXcSOXQ3bqdqS%2F01pYJnkZz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: font/woff2\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb8db9721fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5640,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 5640, version 1.0","md5":"b81c463a053ad87f2d6d983031a0e3cc","sha1":"ed9d51d5cd4dd0b13d619618297ff458ef5612a2","sha256":"a4fa1bb813ae926d32f202426d9dd8b10fcdcbd3d392b2bca70a08fb98fbe3c6","sha512":"0ff24a3b3215e6c069842eed29e13eb3b0ec0341785721e830880db39dbbe2f32699a6718b7bf5d6a8fd625c4228777e1cb0c8e66ac873ab3c4a535e65799e33","ssdeep":"96:BpSSFBNvOJNLBzeladXNyL+GH2HKRVTIwNQgKrwlRfZd8A1ejUPW:2ecSlaXNGHHRewNQgjMA16P","tlshash":"28c19f10412db075ca4994bd8f45df7125d28cc49ce2db91abbef5c4ed24902d247ba0","first_seen":"2025-01-03T20:58:36.91708Z","last_seen":"2026-03-27T19:24:36.988081Z","times_seen":10,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p1-info.a255aa4c.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p1-info.a255aa4c.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1996b-63e38798ce508\"\r\naccept-ranges: bytes\r\ncontent-length: 104811\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=untk2LgaEahsQ64aU%2FpNegIm4tDbt1w7oua1BXDFNHDT5z%2BpCwmGY%2BQ7mWbZl62A3IVvT1OBKPNtJiMrrvEkCCTMPJ9dnm3DyrWU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6b21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":104811,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2184 x 1228, 8-bit colormap, non-interlaced","md5":"2b9ebfad2907a564566a59c6156e7832","sha1":"5f6d5939f210229e71dfc89d680d9c66ba2ba93d","sha256":"cf62d5390114aef84887123bf79da248fa729e752f946197166c0e478dfb468a","sha512":"87f3bd454c2be8485367dbcf1cf97a51af35c5256010030dffe1d28c34ce6be67768094b59a423a0df12619f99156fb3f9adeb5c7d39055f4ac03947265ad391","ssdeep":"3072:K63e3orm6ylFTQJPtdIZEPmC3evZjRKPY:Kge3ZlOPI9HFRKPY","tlshash":"e9a312d1362a6df12f50938662781f400c0470aada1721ecc7e58fbde581dad1f68be7","first_seen":"2025-07-03T01:46:45.667837Z","last_seen":"2026-03-27T19:24:36.983191Z","times_seen":9,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p3-info.f83d73a7.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p3-info.f83d73a7.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"20622-63e38798cf890\"\r\naccept-ranges: bytes\r\ncontent-length: 132642\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eXh2ibjlTW0n0yEH1RW8fdNCH8vAKtDnh%2BfnK9ldecJP3YLugMjdC2%2BZtluHSqxKpCRynjXKxsdbWQtR%2Bh7oDwh3bXiK716APncp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6d21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":132642,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2184 x 1228, 8-bit colormap, non-interlaced","md5":"4cd975d1d9959d8dcebe267cbdae5a29","sha1":"cbf2cd9928b62b53fede828373a8490740e4835f","sha256":"87bb7318f0fb982cd75ef2dded63fe474688eb57285aad805ff167199a62d181","sha512":"84858b1758a639a047dc3d1af30d0c2febe87fc08497611eed17e9d4e5b758ad75c42589e66bc95d09b861462324b4eee2403a4ab03de33a94387aa425f89419","ssdeep":"3072:gD/BD8HB2Tu4bOPEOnkCC315WYMU3QF5GH6drZPOKM+U0M2QwOya:gQRaOcekCC31QYRAGHk5MEAya","tlshash":"7ad312716d0d00edeca0453a1e578935fbbc4acc4a8c5e3bd7a684f3319b7732256652","first_seen":"2025-07-03T01:46:45.709799Z","last_seen":"2026-03-27T19:24:36.985006Z","times_seen":9,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":268,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-analysis.58ad3050.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-analysis.58ad3050.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"52bc-63e38798d46b0\"\r\naccept-ranges: bytes\r\ncontent-length: 21180\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oqELkZ5N7Q0flAR%2F99bmBZlwLyrCnkgxIP%2BK6EpxZGAQnLtA6T3mg6UQM2Df1cMNUJY81XI034%2BIE2kFUXbLCxOKBsObMGvzhFUT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7621fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21180,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"3941be400d563497973774c0f199daa6","sha1":"a2329a7249a1d94754f23a5daa8e59ec568c7d73","sha256":"291eee97b4099cdf0d671ec534d79524f45bb0cbdd31ba54aa39cfe5a8dbffff","sha512":"ea463f3ccef921d55c8b10ec3b052b7127624712838c4d2cb140cc1738176e76abcbc6ce24b0452003c01568b34b583353e0eb56f8565a759f509b04829b3f73","ssdeep":"384:Cp/lBhIonn1P/oXgjZZjagoQln1FnpkOOCXlglAW3vzhZMTQev:Cp/lhnn13oUVlln1FnaYpW37u7v","tlshash":"5792e1e2d29c74b8177f01e4dada0742650b03e016925ff0e1eb89222e6bcb1d5b51df","first_seen":"2025-07-03T01:46:45.676999Z","last_seen":"2026-03-27T19:24:36.99697Z","times_seen":8,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":445,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-avatar.8d3bb160.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-avatar.8d3bb160.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"5dfd-63e38798d4a98\"\r\naccept-ranges: bytes\r\ncontent-length: 24061\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RxfsXExGvq%2B9l4tE4flQvUMwJxyI0zmJ42UAoQWVFlBgKfi9q9DYNoUi4CY7yM1OSXLmzswRFvHNjVuND3MAH4ZhjshFiIfu04kR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7c21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24061,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"8289e32940ce3c580977da9870be8bcc","sha1":"825d56f9d70d3410d8067bb604b6bd370df7566f","sha256":"d3125e3b7133a275bc23a20836fe59047151fc14842a32d5ca1f41c7139bf406","sha512":"bfd06fe7eadc9ffe4dd233fd41b9db2871718aeac44a5c3d1163110af3dad19439a8e03b4918f48d12d1f465bdbded6e4045f9e7f3077360c5d9d2a11ff284b8","ssdeep":"384:ZkzXbZRzrMJyPTBiY9ZFsXJZPWoa9SbV4xfSzq7kq43C4dvWe9c:ZkztRHYMKZPWoPGxaskq43CGvWeG","tlshash":"0eb2cf14f409ba8cc8e705b2f6dc8ad16b7c5371df4e8a99365205c0e5cbfda2689307","first_seen":"2025-07-03T01:46:45.687789Z","last_seen":"2026-03-27T19:24:36.969932Z","times_seen":8,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/app-stream-tile.6e0757c5.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.268Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /app-stream-tile.6e0757c5.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"25518-63e38798ccd98\"\r\naccept-ranges: bytes\r\ncontent-length: 152856\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QCYzghiw%2Fq0oxWEPRV3AoxTJa34%2FojDmcIaXmgiviJOYV0zJmNXGBNGMw4DHmecC2ma9mDL1vA4ZpVO22I4RREW83x025f%2FRXffI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8a21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":152856,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 586 x 1090, 8-bit/color RGBA, non-interlaced","md5":"632e3deb7c7e52633d605a3e365027c3","sha1":"5b64ec00937fa9f7fe9fa64fa6c4ad6deecfbd4c","sha256":"5baeba737f1640f91e4527af510a346e440918799417aee685683fc6de7b8be7","sha512":"7687ef6c9adc39f134e348be2c5f1d980aa6996c6ab35715948e8bf010d19893a3d37491af04ab9a637d67d5c34b7ad1a147cabe26f2e6a4ae77ef57356b3b66","ssdeep":"3072:leiaKX7I5gfdr0tiwDYQA1oWKwm8CWkgSKAhtj035jbx46FyKTAmxWAvAEfjoprM:leiaKIgf+tiwMzE8wgS1Do35jbm6FQmf","tlshash":"9de312c663ad16cce0461471b9073b7a2bf0c35f59b8610108f4ff29e35e9e626dd628","first_seen":"2025-07-03T01:46:45.735547Z","last_seen":"2026-03-27T19:24:36.998307Z","times_seen":8,"resource_available":false,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":574,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.744Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Jul 2025 11:43:07 GMT","end":"Mon, 27 Oct 2025 11:43:06 GMT"},"fingerprint":{"sha1":"0A:91:99:6D:49:3A:2D:61:FB:0E:6D:EB:6C:CB:67:DD:A6:F6:EF:4D","sha256":"92:66:B5:09:99:C7:87:4C:F6:60:B6:C3:59:71:7E:6F:31:DB:A0:53:24:52:5C:1D:C0:C8:79:22:5F:4E:C2:00"}}},"request":{"raw":"POST /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: application/json\r\ncontent-length: 229\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version\r\naccess-control-max-age: 1728000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":229,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"42e136a22281d105bd21fa496816706c","sha1":"bc02950079004b0d4f4bea3888dfd4517cddeeff","sha256":"ede226c79ae326ce9e4b099e9f4dbb4e3d7807da2b793bdfadfafeeb84d7175a","sha512":"a41403da8b9e698eb2823bbe0925160b68682c55d4c64e5c8b27193f8fd8bf4fd118179d26eadb446ed41c2c9c12d46523b6f5094caadaae8a03ba3c1d6bade5","ssdeep":"","tlshash":"33d02313c6470537e34f4633371567c4f559705071105f1b4e1c0315024f97b0255351","first_seen":"2025-04-07T11:34:31.00119Z","last_seen":"2026-07-22T08:33:36.653329Z","times_seen":2992,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/css2.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"95c-63e38798cd180-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 593\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NSyC%2BhMK8kSlaY7dr4eO%2FpnoSqAVGXmZYk79EZM%2BdbkQsRdly92nK%2FWZ2eMFM7DPwK54eibv7VyrOV0ApM%2BpfVOdsdYxXtMGVuI8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a2f5e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2396,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f223d4549430a57e9fe2ee8f9daca866","sha1":"491e0a30a0ad322bfa77548a12bce743ae324fe0","sha256":"385238b18b6b2db6254ae1718f833cc19438076e0cf1d4a662d12168b53ec405","sha512":"a5c1340a7cc9de1ddc5d11f6f9e89fc591ced0c865c670b29837f9b345965d42078bdc5f81b29eb0fe45110e8efd400828dba88293e8062777ff5019d6f010c3","ssdeep":"","tlshash":"6d4167a0406e9044e6479cd133cf7f3a9d6da5146045d67c5ff91428aceed3513b2b8e","first_seen":"2025-09-08T14:26:52.068438Z","last_seen":"2025-12-13T11:00:19.087897Z","times_seen":3,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p1-card.9466fd05.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p1-card.9466fd05.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"36c7-63e38798ce120\"\r\naccept-ranges: bytes\r\ncontent-length: 14023\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IDJzBvL8WgOYahY8UlysQFYAknVwERuroAURyckIb3IAr%2Bs15x4hhKaaH3ku0tOGqf71UEh0m%2FSqcrpmOkusrDBBroFpVXhrFCo7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6821fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14023,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 616 x 262, 8-bit colormap, non-interlaced","md5":"8b707bd323420cd8de5df9aee8431e41","sha1":"41a0b5e74cc78e4c81ab35dcfa019e686e5a9b90","sha256":"e40f7e265edc4937c08b27b85e22bd6e119c8b4b456db46342cb8ae5efd64863","sha512":"77bf96631ad03068a8b18700900b72d13ccac8cf7744d9318d261a4977be4757053daabefe113160f25f9d77a95100f6a3077068dfb2ee0781a0119182ed0926","ssdeep":"384:3s93qq7eRttk9Kk4/DdUOMebzZRSTyfDkgCpZatYjeIETrTxWh:89D7eTtk9pyUZ4ROy7foam6I0RWh","tlshash":"d652c0fd93399301a4772afb6f05350a2f85d97686f5646ce33af86cfb4b8565008053","first_seen":"2025-07-03T01:46:45.727707Z","last_seen":"2026-03-27T19:24:36.984361Z","times_seen":9,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-timemachine.1f9185fc.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-timemachine.1f9185fc.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"6b46-63e38798d6208\"\r\naccept-ranges: bytes\r\ncontent-length: 27462\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BfmfHknJaPxRfSmpOjqURZ7fMR4O9%2Faem7UCLKEXNeQ0USh%2FijKLmjczDcVuyhp6ELo6abFfSxpEMseTMcRD306Za93GnLxapOIV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7421fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27462,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"2bf4e636d5cb8107cc27f7f4a31b47ce","sha1":"90ad580bf7abb723a9e13ec310925d74e5eb4c60","sha256":"66444e06c6407e8a32dfeb5ef8b425d60da49285365e14786d46e5d6452656a6","sha512":"28641529d321e253cf4285587614785f5fefe53d0a6a1b2d0fdebb74d9b42b051a95b84b3f11a0fb7ecb1b8fc58ecfc8b03ce469b00c556d3bf5d49ddb350c81","ssdeep":"768:vpqLmLKb7ACVqFDnBsMSSfyLeOYG/HWtLmOvjLgD/P:l0tVqFbDEumOvjEDn","tlshash":"c5c2e1a2368076dee6d3583258b9ae085c572838ceb5cf796d6746b0b241d337408fd7","first_seen":"2025-07-03T01:46:45.732723Z","last_seen":"2026-03-27T19:24:36.990522Z","times_seen":8,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":439,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/profile-background.c3511aa0.svg","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /profile-background.c3511aa0.svg HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yiqXaCC%2FGqOLPqk8CO5q3rw4ZzTiD7%2Bxlf0%2FouKuOy%2F7KbIeJ3y22PECXKPyOmSvQ%2FhegdOeAty%2FfiRPIMJK4NoWB%2BY%2FpnJw7KPQ\"}]}\r\netag: W/\"3dc-63e38798c3d10\"\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1eb8ab8d21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":988,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"131c6078b1ca5687a5c5ac1a2f7a4868","sha1":"b005debb679a68138ec16a26764a20c36b0bf632","sha256":"7c41fdbff8443730efd58d014fd9d6a5308f11bff12d32528a2679eb6b5aaf6f","sha512":"f901f55de2826ce1be839db35ac8b592fa3764244adb2249f02c87a387f8a1a896f86995478349a160b61f61458b48d6aa705dad765ce3fa89f2ce515dfc6d4a","ssdeep":"","tlshash":"881165b5f07e7c19a154465cf7e544e11055409a4292c2d9c09fbf3c4435bd1385f2e8","first_seen":"2025-07-03T01:46:45.69194Z","last_seen":"2026-03-27T19:24:36.958871Z","times_seen":9,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 05 Sep 2025 03:22:08 GMT","end":"Thu, 04 Dec 2025 04:21:53 GMT"},"fingerprint":{"sha1":"E6:3E:4F:B3:FC:53:DD:27:D8:25:AA:72:59:23:FF:63:FD:4F:1C:73","sha256":"B4:1F:47:61:EC:D3:B5:F8:B4:5E:F2:BF:CD:E8:CA:5A:7F:1E:80:E0:D8:8E:F2:70:3C:14:BB:81:DE:13:23:9A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: text/plain\r\ncontent-length: 12\r\ncf-ray: 97bf1ec1fb9356b5-OSL\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=685\u0026min_rtt=444\u0026rtt_var=303\u0026sent=11\u0026recv=12\u0026lost=0\u0026retrans=0\u0026sent_bytes=3632\u0026recv_bytes=1269\u0026delivery_rate=5294332\u0026cwnd=257\u0026unsent_bytes=0\u0026cid=2d7bb6440922c888\u0026ts=152\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":15,"dns":1,"connect":1,"send":0,"wait":130,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 23 Aug 2025 11:18:44 GMT","end":"Fri, 21 Nov 2025 12:18:42 GMT"},"fingerprint":{"sha1":"7E:4B:33:A3:C6:27:AA:84:98:FC:53:87:7F:CB:E3:93:C1:A0:43:E7","sha256":"8B:29:3E:66:3D:E6:CF:19:E9:48:1D:C2:39:D5:7F:CD:33:ED:88:58:61:61:D7:B7:82:B9:0A:E5:01:B7:17:0B"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding\r\nx-drpc-owner-id: cb501251-31a8-4028-8b0a-54679f15c385\r\nx-drpc-owner-tier: free\r\nx-drpc-provider-id: drpc-public-multiregion\r\nx-drpc-trace-id: 721f75cac247b08ffac4e39e0d488f01\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\naccess-control-max-age: 1728000\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 97bf1ec3dceb568d-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6374,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8cddab4c6b3bdd125741fea6f6871ad7","sha1":"89bdb44fce716f9de64eab2676f97773a15a56c5","sha256":"09895382537cb3db8470f3c9089fffa5259749eecec52412221d38154adcb281","sha512":"d2a4c8dfbb298b36acd708e5a0bc3477b728459e1c33ecf421b286adf4d709d2db8db123eb0b37d5ef63d3e982e8f0631e67acb1c0f97a5741d127fc9daadc15","ssdeep":"24:Y2tXa257vaoWH3eGZsthXvUzZ5+hdex1qx1xxNU6xvQaNBtXX60jv:Y8am3QytxvU15+doY1jNNTt9jv","tlshash":"b5d10bf098c98e50f19b5a81b798bc9400113caf7fdf8f40415cf8b6a0f549176a448f","first_seen":"2025-04-17T10:18:27.874943Z","last_seen":"2026-06-28T16:47:47.420106Z","times_seen":907,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1rpc.io/bnb","fqdn":"1rpc.io","domain":"1rpc.io","tld":"io"},"ip":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:19.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1rpc.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 Aug 2025 01:23:19 GMT","end":"Sun, 23 Nov 2025 01:23:18 GMT"},"fingerprint":{"sha1":"77:DD:9D:03:9A:8B:27:57:64:8B:DC:3F:84:87:56:2B:4C:AD:62:3C","sha256":"98:20:17:06:F7:B2:60:4B:A8:A1:AE:72:47:3C:9D:A4:FC:C0:39:C4:F7:3F:EA:8B:B3:19:01:4B:E6:61:CD:6A"}}},"request":{"raw":"OPTIONS /bnb HTTP/1.1\r\nHost: 1rpc.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AutomataGeode/0.1.0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 86400\r\naccess-control-allow-credentials: true\r\nContent-Length: 0\r\nDate: Mon, 08 Sep 2025 14:26:19 GMT\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":69,"dns":1,"connect":27,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed2.bnbchain.org/","fqdn":"bsc-dataseed2.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:19.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-dataseed2.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:19 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: 700b1b4653b754061f437d442e916ed6\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4902,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2188b7f1b90a143020f7faf12d10e91f","sha1":"e6a95e4d574d05948b7c8517861a71e6f69b38b8","sha256":"4a8dd94310fc027a042dc9ca0311f20e9341084839e00b8d7a830ab52cdc8096","sha512":"08e8f648099fac2b075f96396f2f9056ac526f12e5843bc16d07fd725fcd74abeed4021a9ed64f53ef3e1dbb57a707ebee71bc51b230f5b5ee4200c2da1d7b1c","ssdeep":"96:oigW53TB2SzrZYpTbDaOTkSO6mdSInccYGS9FzelVLY:r5TB2SzAT/7kSRRrze3k","tlshash":"e6a179f0ee02c891f1be4768f2ddbe0461383726eedc5a4604b45a991ee5a51bd0dccd","first_seen":"2025-01-17T17:24:07.906471Z","last_seen":"2026-07-11T04:16:11.451036Z","times_seen":4821,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p3-card.73a307dd.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p3-card.73a307dd.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"43fc-63e38798cf0c0\"\r\naccept-ranges: bytes\r\ncontent-length: 17404\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3NnsQT%2B59Iyz5EbGB7xnS0s36ZxDTwA4Bs5dhtQL3VpvOeOtFUiVEXkIfufw1FREuK75ELkz8VUgNJt%2BfNDz0Pd29uzIaBAaEShM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6a21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17404,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 616 x 262, 8-bit colormap, non-interlaced","md5":"5774ebf6f5f9ef4a1966a9cedb45f0b2","sha1":"6d89372bc37f53fd2e7efc359a996aff4a9864a6","sha256":"fbf6f642c8886730082dd40ccb4d432ea428b20281b1073d4234aefb89d60c45","sha512":"8aca6d5b6f2047a63e70919ad0e9f80574e665ddf0dac62acced8cadd8079ccf9a066babfb091efaed309270fd9733df97edddd586508e23bf7cfb7d566cca38","ssdeep":"384:BcbhwOq8tOBtrBStjMR8EdztYFiBg7dSq7P1H1DG2eiQMqax6NRPehdgHrIMs:ibhwOq8qR8EdztYF0gR/p1bt67PeLg0F","tlshash":"d272e1e6b6b46ec3a6139e7bf301f1226e048d26d10f832cea1055f2e855ddd68a56c2","first_seen":"2025-07-03T01:46:45.708748Z","last_seen":"2026-03-27T19:24:36.96363Z","times_seen":9,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-timemachine.811e5cd3.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-timemachine.811e5cd3.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"4eff-63e38798d8530\"\r\naccept-ranges: bytes\r\ncontent-length: 20223\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c1LIIfUiHgjQ5b6Fbk9FQo087X5m%2BEzbXbywqoeidMrkPwlChTdT0M9VYcLjvCrKO4VcvZp2AzKjDeuuU3WlsTtx1T7UoZmRdfB3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7521fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20223,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"28489901e007517793045a87c7154ba9","sha1":"57f3fb4f4bb3178cd54dac66a5a36b50d2218991","sha256":"ac185014e2c434a15817f2b7f50a5e482a09251a32bd083d62f85c4ae4bc6026","sha512":"d4cb34ff2a83ca912f2413a4f041050fb71cabeb938b7d1cb19b3296b6bd555d90bc53dd4cb9a1c71dccca65c7cb91c941d3f35b47ed8518f64c9d38ee052ae6","ssdeep":"384:JZjOlcqSSso+mITZPydIuDBCQ+jZ3d0F4cvAN1OCnNtJp:JZ+CSsdFZPynEdtCtAnPJp","tlshash":"de92e14146b2c5351e46707621825fd3f0eb9e9fa5d37cb0ea60621ca0c8eb65a97b34","first_seen":"2025-07-03T01:46:45.704875Z","last_seen":"2026-03-27T19:24:36.956685Z","times_seen":8,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":443,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/app-bg.c7ab6e78.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /app-bg.c7ab6e78.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"315c7-63e38798cae58\"\r\naccept-ranges: bytes\r\ncontent-length: 202183\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1HSsxETJHcE9HyXqiDvo%2Bk3DpGw7dCPtglUtuK8f2mHYe2PgEdDmSq5uNGtwcQjdi%2Fe2qwcEy8VvmBMfB68nO6uXSxJqU%2BXX3JP9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8421fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":202183,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1580 x 914, 8-bit/color RGBA, non-interlaced","md5":"c86db12c7bb42e92af651bb6fe56cef7","sha1":"492f6e341d6b9f7dad354cb621b8f1b8c16b7080","sha256":"8364e04a9e433a8c429ad109983f6b6a7631f20e0612f5795b6d934c4e64f14c","sha512":"b5d50540201f409214d453c38501ebd366646906b8c210fa1ca42e9034d00e7c5d555b5b0ad775b0c5d303228becdb2ab86bb73dafb8d454d8b0226c7ca8d96e","ssdeep":"6144:XtU+iP5dbsXMy/wr8LsABewva/LIrBWR2lu:vCdbsbNTi/L1R2lu","tlshash":"151413956b5b8312ff7fb937802db5412f5a59a23436013f2b39f1f1d9e0938194b42a","first_seen":"2025-07-03T01:46:45.698194Z","last_seen":"2026-03-27T19:24:36.986864Z","times_seen":8,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":466,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"debank.com/192.png","fqdn":"debank.com","domain":"debank.com","tld":"com"},"ip":{"addr":"54.240.174.20","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:13.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.debank.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sat, 08 Mar 2025 00:00:00 GMT","end":"Tue, 07 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A0:8B:5A:47:44:5F:C8:AB:84:2B:FF:D9:FF:61:73:86:DC:A1:AA:35","sha256":"98:DF:DD:71:46:A1:59:4E:8C:38:6C:BE:57:61:69:41:1F:F9:D8:26:51:6C:F4:00:AF:27:2F:FC:76:F4:10:9C"}}},"request":{"raw":"GET /192.png HTTP/1.1\r\nHost: debank.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 6355\r\ndate: Mon, 08 Sep 2025 14:26:14 GMT\r\nlast-modified: Fri, 15 Aug 2025 05:14:50 GMT\r\netag: \"eb414e8312b519bf4e0af23bba509721\"\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\nserver: dbkserver\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P1\r\nx-amz-cf-id: PXBGJVx9QYX5BVlMewZTrKAnBSO4OYrsKVJfzD_qyeC-nbwLWflmsw==\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\ncache-control: no-store\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6355,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"eb414e8312b519bf4e0af23bba509721","sha1":"e00a8e8c57d1427ce53d14f4f28c5925376b1e41","sha256":"61723689db2b51daca9ca5d12034edeb60fadc1de2fd523a7f2fed89f1eef349","sha512":"72262fc429539a1f8ba363463e71e53cf4679c1ef0750ce1bfe1f56e0e2616020aea6357314b6ef377f2099f3e5d73130e8284685f8485c51081c0b9ff296c07","ssdeep":"96:nvn+ZXuIoIQ87F+ia+f/2o9OCp0Bxi2XTwtKQoD1b0JBl7XYln25yf+ykS:vmHoV8Aj4d9OCpI1XTw0rD1Htt+4","tlshash":"ddd19f25bb64cfed71815bb70482821417bcb6b3940641a353a9103535dd8adfeeed1b","first_seen":"2023-06-02T16:35:47Z","last_seen":"2026-07-23T01:54:16.630958Z","times_seen":117,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":23,"connect":1,"send":0,"wait":281,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 05 Sep 2025 03:22:08 GMT","end":"Thu, 04 Dec 2025 04:21:53 GMT"},"fingerprint":{"sha1":"E6:3E:4F:B3:FC:53:DD:27:D8:25:AA:72:59:23:FF:63:FD:4F:1C:73","sha256":"B4:1F:47:61:EC:D3:B5:F8:B4:5E:F2:BF:CD:E8:CA:5A:7F:1E:80:E0:D8:8E:F2:70:3C:14:BB:81:DE:13:23:9A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: text/plain\r\ncontent-length: 12\r\ncf-ray: 97bf1ec20b9756b5-OSL\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=638\u0026min_rtt=444\u0026rtt_var=278\u0026sent=8\u0026recv=11\u0026lost=0\u0026retrans=0\u0026sent_bytes=3266\u0026recv_bytes=1269\u0026delivery_rate=5294332\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=2d7bb6440922c888\u0026ts=133\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":12,"dns":3,"connect":1,"send":0,"wait":110,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/4791.6a03c997.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /4791.6a03c997.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"42158-63e38798c9300-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 36564\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6dVA1wZxVa0RIg0RphNG2W4hnUUKR8Sh3VD7WMY1ywXtEX1t4IDIZZAbpch5iGdfpWBfumRNon4mxmsZ2kDdh8CVRM9QrWH%2FXnN5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a2f6021fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":270680,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"8cb9a6717fd27bae2a9f584bd71887e5","sha1":"35d05d5b07c934f3aa25a38c41a1ee4d0aaf5c50","sha256":"0814eb90408b9ef60a058b5c3b2de15130dcef8544a8143a53987f01ab2f289c","sha512":"a96328d32d4aceff17705ee2ad12f188b300d269314bc934f8667a35d84e25aabadbce473abfb8800af51d9aa8bfafbc120de085c8a591752a47f24f2855bed3","ssdeep":"1536:+ARRRb1xvdkx+BUGyJoiMheAvWMNXvgXj5GFpPi3w/F/iENFmzIm7DLriIKqAYC2:+ARR91xTEMheAv/nGp","tlshash":"9e44c7659781207ef16b873ad5d2f9081934de41d95fbff8f2a0b60882c39d622e7b05","first_seen":"2025-09-08T14:26:52.08253Z","last_seen":"2025-12-13T11:00:19.103029Z","times_seen":3,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/298a8bec0dfe086d40ec032d6a817163346e75f3.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /298a8bec0dfe086d40ec032d6a817163346e75f3.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1be5-63e38798c6fd8\"\r\naccept-ranges: bytes\r\ncontent-length: 7141\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D5UscMhyhVAIEJg0aRFDSCDWEOvvp93GL5AobrTo2RWL%2FoableYkZnbnn4OSndzaKWlmq4YDNIkbhAjgl%2BMBXIM9F8y2m5oJZJv9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8b21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7141,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 205, 8-bit/color RGBA, non-interlaced","md5":"8c84389b17d589eb3aa315a3c3d4c3ab","sha1":"298a8bec0dfe086d40ec032d6a817163346e75f3","sha256":"4080e0383b782a795816d032499b4a3f23a41fd6694a50b014ed168e9c07542a","sha512":"8fb4dcfc7ebf7bb4d567313f892504bc8655f75aaad8ca5e09c990ea7cf8930104bac20ce208cad884def4bb370aa7416ef59c2abc9cd55322ade0990f18b628","ssdeep":"96:ji0u9qv14GtSWsLBQzKXf+ZGVHAIf2iwCmVXNgil2xdXFrSolyVupLLea58+0/rL:ObXGtSWOP+82O2BZi88FrHlBwH/rkU","tlshash":"c2e19ea0726371aecde7946704d385419c2a874dde16f16da91287ec20f8cb4d87b312","first_seen":"2025-09-08T14:26:52.085057Z","last_seen":"2025-09-08T14:26:52.085057Z","times_seen":1,"resource_available":false,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":590,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/d4f9e147eb6645910f7883f7183a9d890ab3382e.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.275Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /d4f9e147eb6645910f7883f7183a9d890ab3382e.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1a9b-63e38798cd568\"\r\naccept-ranges: bytes\r\ncontent-length: 6811\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8CPDJDaqx9aTZJtsuJ3zwWBDIjEoexj7M%2FtX%2B0J2ZO0Q%2BM5T9bBD7J1i6pWjr07zBUSLi7POBfPSePa5wD8Kb4VzMLwFtD0dVjuK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8d21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6811,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 157, 8-bit/color RGBA, non-interlaced","md5":"1197d502bfebbf5c0aea312254edc223","sha1":"d4f9e147eb6645910f7883f7183a9d890ab3382e","sha256":"7cd719e7f84bab267b6e75a4ccf12d48058c173c50a7f46abb55739fd83c9a37","sha512":"94be40660d86e401f8d861e2062ac89f5224812f8d829f70211e4de8a1a15f19a0c0b5e6fd7cad9286726aff2d1f7329bfc1a94d941da84b8cc8a5ac8f78593f","ssdeep":"192:OaYCVophZHTLKcX0HzEZQp8mB9VuUpBrfnD:HBophFaCEKQp8mBu4tfD","tlshash":"c3e18ef5564131f2f60eb1886dc782216c1625df37fee1b14980e93b0138ad8c426f7a","first_seen":"2025-09-08T14:26:52.087608Z","last_seen":"2025-09-08T14:26:52.087608Z","times_seen":1,"resource_available":false,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1rpc.io/bnb","fqdn":"1rpc.io","domain":"1rpc.io","tld":"io"},"ip":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:19.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1rpc.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 Aug 2025 01:23:19 GMT","end":"Sun, 23 Nov 2025 01:23:18 GMT"},"fingerprint":{"sha1":"77:DD:9D:03:9A:8B:27:57:64:8B:DC:3F:84:87:56:2B:4C:AD:62:3C","sha256":"98:20:17:06:F7:B2:60:4B:A8:A1:AE:72:47:3C:9D:A4:FC:C0:39:C4:F7:3F:EA:8B:B3:19:01:4B:E6:61:CD:6A"}}},"request":{"raw":"POST /bnb HTTP/1.1\r\nHost: 1rpc.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\ncontent-type: application/json\r\nContent-Length: 60\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\naccess-control-allow-origin: *\r\nContent-Length: 41\r\nDate: Mon, 08 Sep 2025 14:26:19 GMT\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":41,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1877d2dbd5f3c5c0f374a123316937bc","sha1":"1e59de948989ba95ed1663d4cfd8be966d9d6ee7","sha256":"612a2414ea40a9440eaf55ea5b8925feedf1a347cd886754429398d3ba46e519","sha512":"917c789b9e250bde8868e95540316aeb9bfa36ad70cb51e9f07773e5d3de93b2e2ba6827eee59a8c83c4f9e0f48ec33d4e8669faa369e010a46bf2cc34a85be2","ssdeep":"","tlshash":"a79004c115070731410c0c01d004004030433f5445050f44444fc5447554147530c335","first_seen":"2024-12-22T12:26:48.477521Z","last_seen":"2026-04-10T13:43:45.315277Z","times_seen":254,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":2,"connect":28,"send":0,"wait":28,"receive":0,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/css2-1.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /css2-1.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"3ff-63e38798cd568-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 378\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=URgBW8KL%2BcKoO43YjpUlWYINyhdepRPeIkmyU9l%2BcG2vZQnrW%2BstvJMLlyoD2uTn14DY5ppvHWKVQ1Yi7yhxASP0qE%2Be%2FpR6lXrL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a2f5f21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1023,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"e284172c3954606d4276f46433e2af4b","sha1":"c355338540581c27f5d1f33df7d07e81b90d5274","sha256":"bfb568a6814f44ff71fe3aba75a17e5073a897fc92361bda8f2960874e9c42d7","sha512":"2ec10998b2e8e77d5767661e15e5d0d6c4e0b7d84320e8c399893334b2fced931b7d277a3d613a5cc1f799edeb4a3ab021ffc2b2cf3777c5452f088508c1d53f","ssdeep":"","tlshash":"4c119b50087a5100e7871cc627ce7f36ae9db284b445d9386ffe0498ac9ec6563a5b0d","first_seen":"2025-09-08T14:26:52.09157Z","last_seen":"2026-03-26T06:39:20.735039Z","times_seen":4,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p2-info.531318e3.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p2-info.531318e3.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1f304-63e38798cecd8\"\r\naccept-ranges: bytes\r\ncontent-length: 127748\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l5%2BitG%2F8TiqGoa7wWkeMl2i8Z3auKVvwQaPRBo11Db3o0rqziUgEZZ0MGsVwBL4iTERnOf6X9JTC53%2BmVlTM3vvXK1X2KD817qme\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6c21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":127748,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2184 x 1228, 8-bit colormap, non-interlaced","md5":"75fcafa0d9b04551b71c83c98d53cf5c","sha1":"1b50ec9a6076180836255beb4af1178fee440b8b","sha256":"d9b8e94b7378e69d6122c33b52f94a06e05056479a89c4a9350a14e9e2b1259c","sha512":"7534fd1703e5ca91a9a7567b7d55f4cf97a402258ea36492b2359d937c82122e4b6eb985afc8bf970aa72b037c3833dc8804f52d5de9ce2c6e55f7c555b34f92","ssdeep":"1536:ZCSRJn+6AokmvFtufA+ciQGLtuUClg2lOh/FSp/h8V7+SUqdKJF7ZSVFrlaWqwVc:8o+63tA9ci3Lt+Lu4qIW2brcivVWC","tlshash":"34c31386f02e4283bf2c950d1a8538696073531edae222ede0d6d53f16d195b3f9d332","first_seen":"2025-07-03T01:46:45.723317Z","last_seen":"2026-03-27T19:24:36.955588Z","times_seen":9,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-analysis.0384fcee.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-analysis.0384fcee.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"50df-63e38798d69d8\"\r\naccept-ranges: bytes\r\ncontent-length: 20703\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PVGHlt8LDRFWzRe1cfsOVZ%2FFmY4lgeuIbBAzVA0JSjUgngp1VamVoo2H9N2rGyFOyp0NLltMiMKQe0Kvncjz9jEo1knf35lQVI2Z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7721fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20703,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"ad80de895cf7b188f62f4c5ea4e2e6f8","sha1":"5eaec9c61def47513467655c68fc22ea44979f82","sha256":"8d12f16a15ae04cb2831a80e4d2819dc69cba1ac13c19f9a4952129dc256d986","sha512":"16dcee4193fe408f7ef9164816610c54ce628c53ec7b583a92a6992bf26cd2203eeee6079f2517f2fd6b210693c1054b4f02524c851bcd16a7853b89c4a373a6","ssdeep":"384:y03gs7QeFcM/Cx0z0fyvLVf+NRLNO+KU7GlOB6cpdd0p6YTvU/aCOyB5JfFYOwLf:y0wic7+0fyTd+NRLNrKesGqcYMa85bYt","tlshash":"4d92d0a826f2d24c3eeb643492651f9777b7a24b03d97409e48ddc3ea457cdd3a42305","first_seen":"2025-07-03T01:46:45.714991Z","last_seen":"2026-03-27T19:24:36.968896Z","times_seen":8,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-changeview.56413ea8.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-changeview.56413ea8.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"48ea-63e38798d71a8\"\r\naccept-ranges: bytes\r\ncontent-length: 18666\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IndfSpLoO8G8vBPa3CjHRQzvSobN%2FvqlpyyaAFdC1fX6v%2B8v6ZDednEhUDrtQfYH%2BT4yr%2Bf2h9HOFHMm%2BvQQlY293NRR4A5YIMx5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7921fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18666,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 404 x 372, 8-bit/color RGBA, non-interlaced","md5":"c22ab29561b4b74870565e870b2096e0","sha1":"f8eb2ebcebb5e06e0b2e01ddfc9e6b30a8560c07","sha256":"a2d0e6506f4ed3e66a0d2a9c1eb3c0b99a4969f9fa07107d49b71d913b4cfa59","sha512":"63a674df23a6e9819f2867f51bd7efc3ff3099f0d78ef4a115843540a517885c6b79ebc2039d7a18f97bc8e664df9070420e0827ccf74b44600f4ee59a83b31b","ssdeep":"384:HZJiFyXQHlQG9F/M8CKA0vHgva1vC9yR6rjV5eg0CrsCoSl3:HS9HGG9FoKA0B1Ckorjn0Crsk1","tlshash":"a482e1d589224faac4acdc3a22d0921ec470214919ffe0ed4e68084fdd5d7f15d978ba","first_seen":"2025-07-03T01:46:45.678489Z","last_seen":"2026-03-27T19:24:36.99764Z","times_seen":8,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/82e573330be6e1b4ff796b84ab57350d17940236.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /82e573330be6e1b4ff796b84ab57350d17940236.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"233e-63e38798c6bf0\"\r\naccept-ranges: bytes\r\ncontent-length: 9022\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ICbHsnAyE0MnuucgGmP44qGF91wi5upH27rENFM1JbftchXHwklvxZxuDMSoc2zLBMvIZmP%2BT5npBT6EyipdsmJeQ6SD00hryIbC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9022,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 251 x 322, 8-bit/color RGBA, non-interlaced","md5":"454985594661f3912eecbd63c03d24d6","sha1":"82e573330be6e1b4ff796b84ab57350d17940236","sha256":"0c3847cb2427e50214fea1d994618008f173386faf8a928a80e9c6229e5f634c","sha512":"5ee9de2068df5969081be4d587bfb49773a1b45cb388e1b4beea190baba32c22ac04320ab72eaa4ef8e11d862a19e2a2bb9e2184073f8b9da878d3d5c18d822a","ssdeep":"192:QkZjGDsf+eMOR5zSqLh5E+ANeopzMjpBE04mkzzAA7vEkFoqwmbDql:VGDsG4TLh5E+6pQBE04Xb5hwmHql","tlshash":"4b12aee730b5fd64ed53293b01929fa79227002f60d86ceae117a71e082efd09c96943","first_seen":"2025-09-08T14:26:52.09642Z","last_seen":"2025-09-08T14:26:52.09642Z","times_seen":1,"resource_available":false,"data":null}},"time_used":592,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/preview-quest.d7a7a43e.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /preview-quest.d7a7a43e.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"346f3-63e38798d1000\"\r\naccept-ranges: bytes\r\ncontent-length: 214771\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TFTmx41QR7o%2BzklDSp0SZrpEt10SBM1X9PJSDAv3WyvEqnt57gi5Cepr7DvUWhP2PkQMiAeVjKrsOw%2BoWOTPl%2FBsWom6zabbPAhV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6f21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":214771,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1416 x 1634, 8-bit/color RGBA, non-interlaced","md5":"48357a5b0ccc1198d21ea80f412de69e","sha1":"e8e460eba9c945d1756e78e8a43a93bb04c2a02f","sha256":"6b329ab91108ca014125722952d773d8fc977f5e381601415469eab1bbcb4ed2","sha512":"42811a6814f90edd90bf3764f6e804f2a7f141a6b0bf8ce58e081071d5174289212a21e6a72c3c2525ee0ef7a64c61ac9faad4eb7055f2793245a92afe1d5520","ssdeep":"6144:bmzow1YqiUfOoAHLkymWGh6OPrk0xmkb4cK42C/i2:bGyL8OoAr6WG1PI0TrK42C/h","tlshash":"f82412969874ea44dc4fcaf9a7beaf2730cb05d702f93252eb54fe5d090bc114878169","first_seen":"2025-07-03T01:46:45.724797Z","last_seen":"2026-03-27T19:24:36.992356Z","times_seen":8,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":321,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/hi-guide.12f13afb.mp4","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /hi-guide.12f13afb.mp4 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"184847-63e38798c3928\"\r\naccept-ranges: bytes\r\ncontent-length: 1591367\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Et5g1C211o0Co2%2BvKKEyYbxzSVZgQLcPUZ9v0Bpwl2jLrPKSB%2B9rDaXR6j4vLEKHyWkWuuxCj8UaHdAm2v9szx1%2Benabg3BVeg68\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: video/mp4\r\nage: 92\r\ncontent-range: bytes 0-1591366/1591367\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb93ba621fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":349161,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"96d00cc48022dcda5f8badcd6e7fc802","sha1":"c6dfe8e5d6e948c85c5232c91c89d88d55e3227c","sha256":"5324c7a0778bffe2ed104bc8f64e6a82be8dbe22c008812ef89c64a6c7137803","sha512":"10ebdffcceebd94de0ebfcdade802c1406b3b136284cc89ea266372aa9a4d2113a86f80df0a081cb616dd5a464a0fe28eb9371bb49a39251e38188b0eb5e291c","ssdeep":"6144:bI4BgLGsi7sB2Tf8SJVdpxB8i8gqJrYrOVOyLaLXDWl10cNxK3vdIffoGESO:bIS7Eaf8EF8i8bgOVOsuncNMdMflVO","tlshash":"e874aef29b34c12fe13b51f74b824eeb12a5e0610376f73b11b329632856986db13a57","first_seen":"2025-09-08T14:26:52.099702Z","last_seen":"2025-09-08T14:26:52.099702Z","times_seen":1,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/sub-badge.d564f0c2.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /sub-badge.d564f0c2.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"2c4ed-63e38798d3328\"\r\naccept-ranges: bytes\r\ncontent-length: 181485\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wx6rqp01f228s0sawG%2B7f1%2Fl5am%2FSkw0fTnus51oTVhCcC%2FXpsGRyqiUJPHpXBNHUwtuwFb0h5F%2F5GNKaJtveMKVxMcAdZ31ShIu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f7321fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":181485,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 675 x 525, 8-bit/color RGBA, non-interlaced","md5":"ca74159407c1d097cc04d9f21097c7de","sha1":"2f26362064b1b44d619eae0dade14763755cbf75","sha256":"120a6bbf1ed7bda3c742de0665ddfab899ddd5f1ef5c335fbbfa03e02807a8c6","sha512":"b8380d6550e6429bf3205fb6dc6698e8c1a0326b3fed2e63a85d6e5a7cc3881ebfc266c91f7b5236531db3fbdf30f70b1a15b724587a38c94bfd7fbee1a95ab4","ssdeep":"3072:AEr+xKqtGiRTrEZAq/U2BLykWeDAhQmyJ7301Kg8MFpcZnnPdsEu91pXwW7zzfkG:b+4qtGidrEtlLygDKQmyJ70c72Gnn1dC","tlshash":"c004222cab4fdc8699213209f9ccb05d768b344fcaae2077a635b35518f9f76d314489","first_seen":"2025-07-03T01:46:45.681463Z","last_seen":"2026-03-27T19:24:36.996319Z","times_seen":8,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-changeview.224b3325.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-changeview.224b3325.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"49f3-63e38798d4e80\"\r\naccept-ranges: bytes\r\ncontent-length: 18931\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9yNcAczexyg%2FWvPE8VUii0VOCca%2FwiVfC4BY5bf%2BsvT%2BEiNLkSBWHfkGquYC7jdn%2Fhv%2FOxkEwT7vsCDzmKpWE3tpFcB6nP5zNmmS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7821fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18931,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 404 x 372, 8-bit/color RGBA, non-interlaced","md5":"c6f0941dcf888f731566a99bfe4a5123","sha1":"61d402960684f5c15ce271500f15042d11f231e4","sha256":"8bf7ae843173ba9f894029f66252f6396b3c9ade35a8f9e7c7b5dda2d7fbdae7","sha512":"fa6a033cbb94243e20951fe43440a12d188e047237588ca116e9de99b16c63207ef2860a934b55351549d82312a44e816b5a165650b33b4cea766d01216e2747","ssdeep":"384:D7SWSHOkqFy29ZWlj4VRE7FpNhP0Ck3JuB2QOhnw/ipE1wtWHtykQjDB:DL6ky27WlsUfNh8CJB2QOhiiOjtoB","tlshash":"4c82c0296562d8f4caf685bc772f213ea0f952332cdcd00b373469583d8be64ae99614","first_seen":"2025-07-03T01:46:45.694767Z","last_seen":"2026-03-27T19:24:36.985614Z","times_seen":8,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-summary.a00e9749.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.248Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-summary.a00e9749.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"4206-63e38798d5e20\"\r\naccept-ranges: bytes\r\ncontent-length: 16902\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hmOC4BFjLBHH0t5CMoQHy4girYTiEpqMoL7wdrL3RSMAUVUwr9Gqi0PYS6KUwXZ9%2Fjmgaho8%2BILudUXVpMBWF6FHrxlDq8DyMWFH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7a21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16902,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"bf41c215f7a2c053c4ae9ce588295f6e","sha1":"9d918386b90abaafd2e796b1df2d50cc460718b5","sha256":"6960004fc1f88459fe5b9f27d5ef0649ad773421821bbba6836799182d374f65","sha512":"50ed2a428eadb77b86a41b8fe42f20e2eb286bf25492e58503d1fb31e49142ed488e283380a0dc65b66086d6bdd9260deab3920215721035a326e6628bbf5ff2","ssdeep":"384:WrBP4JEJ41RWWdJk6Fzz4XYq0kUV8a9PvHpRfVb8tFhk:WxfJ418WrjFzEXYxkU8gPBRfZuvk","tlshash":"e472e18dbb033de00ea7370e233802cd4855246d5ea2e833e4a4d995a43f958877db56","first_seen":"2025-07-03T01:46:45.716148Z","last_seen":"2026-03-27T19:24:36.993641Z","times_seen":8,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/f5916fe5136eb91a11575e1c9f9354df42483bd3.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /f5916fe5136eb91a11575e1c9f9354df42483bd3.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"23dc-63e38798cd950\"\r\naccept-ranges: bytes\r\ncontent-length: 9180\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7%2BFtl9b%2F5bSmrI%2BGQJsZ6oRX9zzuVzxtUTSaIyC9pi5qXYSwaOhzeUOAF1uPvNJ0f9HkNmVp%2BaVOkYi%2BJ96Ctq0PtWQ2wVdp6LLY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8521fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9180,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"b5e9436df81f2064c3d126669dba8c7c","sha1":"f5916fe5136eb91a11575e1c9f9354df42483bd3","sha256":"6d6d3c85cacce0f2856c35c22aca6a0b26781ea3f20d230f3b20d9344ff2ecca","sha512":"c22118aa6601b591024702a379d2e49e9b387e40698dcd71779f11351fb26daf951912632b2df6bff83255410872eacf51d44eaba987e2d7ca77e2a93e8df9d6","ssdeep":"192:CffESdlTXHnovNxIn1Y5Vx1NB7Nr43n2eILw:C3ddZHoVaW5Vxt7UT","tlshash":"3b12bf59efce01dec11eb73be667139570f393924039ee5c40d09f4856482bb94a5f12","first_seen":"2025-09-08T14:26:52.105942Z","last_seen":"2025-09-08T14:26:52.105942Z","times_seen":1,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/app-hi.7fe0c60a.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /app-hi.7fe0c60a.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"2710d-63e38798cb628\"\r\naccept-ranges: bytes\r\ncontent-length: 160013\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lc2s5U3S0BEhfEDrbC95jxA27wg03tKbOsiN8L%2FAPUX9pshdixQNxUj3M%2FZQTG%2F2at70s%2F5FIOLBXZlyXdTXCnORRb2EWejCNlfA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8921fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":160013,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 780 x 1676, 8-bit/color RGBA, non-interlaced","md5":"44c638f9d88ba087415ee200ed3d6aa3","sha1":"a011e295e3c389f5e116936936787a1311618185","sha256":"7734fd606e3100cba762e1880911ca7ed69f1bd4d27aac899dfa2c0683746458","sha512":"26194204e290119058d7081607a1b8935959e3d4d5fb5235646ad88c1e00d5a8796d39b1864226e9774fc223bdc46e2e295dea0d6bb01820663970ce4165db6f","ssdeep":"3072:TiPFg0GkQ+aj8smzHRCwH7g5BHBpOH3MmgSnRU1h21v8Brv81oFyI1HyXoXvS2:oLQpmzHRCwH7gBkcmgSU1hgE9voGMofN","tlshash":"a9f3126319fddca0dc27d079d4f46fba947bd83386f427c7c7a518ae6495d0848a85c0","first_seen":"2025-07-03T01:46:45.699397Z","last_seen":"2026-03-27T19:24:36.95781Z","times_seen":8,"resource_available":false,"data":null}},"time_used":574,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":552,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"216.119.155.40","port":443,"asn":13213,"as":"UK-2 Limited","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Jul 2025 11:43:07 GMT","end":"Mon, 27 Oct 2025 11:43:06 GMT"},"fingerprint":{"sha1":"0A:91:99:6D:49:3A:2D:61:FB:0E:6D:EB:6C:CB:67:DD:A6:F6:EF:4D","sha256":"92:66:B5:09:99:C7:87:4C:F6:60:B6:C3:59:71:7E:6F:31:DB:A0:53:24:52:5C:1D:C0:C8:79:22:5F:4E:C2:00"}}},"request":{"raw":"OPTIONS /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version\r\naccess-control-max-age: 1728000\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":68,"dns":17,"connect":20,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-summary.ced5805a.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-summary.ced5805a.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"3d3d-63e38798d7d60\"\r\naccept-ranges: bytes\r\ncontent-length: 15677\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DirpeCRJUMs8Rf9ecyQktXDfTmzw9l%2F1JcvHd9vVhuDzwcsxI4FuXeU0k5Evpc4s4FBieJ5879x%2BNSRsxrVu25lvWETzSrG4RJnE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7b21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15677,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"c331dda97877745a381a5b6d4f6e7cac","sha1":"eda3c0bbd2723d99819b4c488a9855d0368340ce","sha256":"04b57112d28298cae2f0658430fb5dc7800511c0f1c9b524498a4310289a240c","sha512":"67d0f194d6037fb085ed9a67102ce4adeb1122bb26e8926bfc43af6abf1a653abd8c1d636836ee7daeffef2a07527153d50a283babf5d6786c5379e1ff241b03","ssdeep":"384:TlHMXE8GwsbFRxPFyH9MSfyYFX+L3fKu+KhHehT:TeXEfwspRxPF09tyJjfKu+kehT","tlshash":"0c62cf677739e72a7a2c019f3f78ac950a1f80b4bc912de4b47ca14cf06a570862bd12","first_seen":"2025-07-03T01:46:45.712827Z","last_seen":"2026-03-27T19:24:36.975337Z","times_seen":8,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run//secureproxy.php?e=ping_proxy","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET //secureproxy.php?e=ping_proxy HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1e34-63e38798d8918\"\r\naccept-ranges: bytes\r\ncontent-length: 7732\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YxIR%2BqPxHVcblKYV4Tko%2FYVxybtafsfzaSCvttuu6Qtc2iaLS9fF04xTLr8QgXTjWwVySzly4CUeEJFm92g46bfBc3XGoQjxsxFh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 97bf1ec43ca721fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7732,"size_decoded":0,"mime_type":"text/html","magic":"PHP script, ASCII text","md5":"266ba4231e44862da9e32e4f9b6a8012","sha1":"eb2b688e2b06e66a65aa7446809b35e10aba6d7b","sha256":"a568132ebe184290adad1a5970f34e9191d3f38894c640ba6d4d0acd9237cc4d","sha512":"59fd83eb968a9342a72a2214e6c9718e02f558f7abf9cb4938b8b7eb01e5645e140b4b92a656ba78cd9a31d244fb0fcde96a4e313739cd9496ca3d81b777fb65","ssdeep":"192:q6vgpPDNF6iTypG/+WA4yAXg9bDI6C4VCRnw0Zy5q:epLeit2WBwRhVmX","tlshash":"b8f1611079e37a80a177e0bda74fb8086609a80b441ed909be5c23931fc033cebf169d","first_seen":"2025-07-12T22:38:09.124273Z","last_seen":"2026-04-09T02:34:42.258638Z","times_seen":964,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed2.bnbchain.org/","fqdn":"bsc-dataseed2.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"52.30.121.212","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-dataseed2.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Mon, 08 Sep 2025 14:26:19 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":1092,"timings":{"blocked":525,"dns":325,"connect":32,"send":0,"wait":38,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 20 Jul 2025 17:08:10 GMT","end":"Sat, 18 Oct 2025 18:08:03 GMT"},"fingerprint":{"sha1":"66:D5:51:E0:8E:D7:2C:D1:E3:98:58:99:22:9B:73:C4:6F:32:FD:EC","sha256":"52:CD:3D:83:E5:5A:57:37:9F:D9:0B:EB:C3:EA:67:B7:4C:F1:74:93:B7:C9:E8:0B:E3:E8:CB:2E:7A:94:A2:78"}}},"request":{"raw":"GET /ajax/libs/ethers/5.6.9/ethers.umd.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 125841\r\ncf-ray: 97bf1ec09d1eb4f3-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"62ad87d5-1eb91\"\r\nlast-modified: Sat, 18 Jun 2022 08:07:49 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 421659\r\nexpires: Sat, 29 Aug 2026 14:26:18 GMT\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=ea4CJWkue67WkMvVBT%2BpQWZjSwB%2FcE%2FRz2D0dcUwn9%2BHTMaSUnHiPrzL79kljDNDxVGwi5sYNhODXj2Og7oSX3c4HBTn%2BofHTktFg%2FLMnV4vzWiSInVFHNVzI%2BjyjZSchkch06ua\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":735973,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-15T21:03:46.662531Z","times_seen":8481,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/4362.fb29b370.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /4362.fb29b370.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"ab77-63e38798c8b30-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 8202\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZDQKMNksDEIgCWl9%2B7WuUkUBnfEK0VRaXDPeuIiQ0a1pud0SQgGUHPkxkQpYhChTBS5o7sPYwZtKklvv6R8JhPSAAgsm%2BYOI1L6Y\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a3f6221fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43895,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (43844)","md5":"07c25bd17555bc5903c2d6b9eef03c32","sha1":"a08adb557c9c066907d4f626d99a6e2b4596509c","sha256":"6306a36dc297ac74527800daddf2e4c2a24d1c88d8cfc235518ee3190dc0ce51","sha512":"4868b50b08296c519fcfcf8663499def51169f70f3fa1df7a2e900c6b607b15ab4241cff0795de5e49cf225fdf5b2ab4568f5f46cc591a12765cb8d9084b3531","ssdeep":"768:ZWDRQ/Efe6jdn4xRRJVE9c45i/sjlb3HfppbgDCK8+k3Gc:ZWD4oXRBgLlA","tlshash":"c313c7319aa1e63af5b75a7e82c4c8d8f050ef43c5a7dbbada109515c0c7cf327a6604","first_seen":"2025-09-08T14:26:52.115809Z","last_seen":"2025-09-20T14:01:58.3271Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/2758.cd80235c.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /2758.cd80235c.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"e79e-63e38798c8360-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 11112\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I00zAOzQF45Omg4%2ByfYQgeHL5pWZuC%2FGOwRJmd1k1bfpfS8l2SGfw5XscGCJuLfRkenfvpSpYQPToPJyXg3EQUGdW0GJEn1ie0kh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a3f6521fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59294,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (59240)","md5":"7deae1ac22df2dfbe904d598dbd4357e","sha1":"7a6449d1bf222f8b9f4db7baaa46461469a703ec","sha256":"c9a581ed01a19c40e168f94edaf54b25b0d534d9ea5993354c4f886ea079f337","sha512":"1664f18673ec0ff9d25f452949dcd902d7d9e46c175f323f406830436e66d03dc246fe00cfecfe6f9b561ede180fc2fda7a430f07dd20d8d3b679a750fef13ef","ssdeep":"384:RYQZNZSeVsmaiZWRWIprzdDyaHXdN7kSTVKEeGJmCH/JVXe9F9iICu9vdFDoognN:mQWdRh9lPOF9iICu9vk","tlshash":"d243c7335314b639b42ba42bddc1d68e3154fe4389b3eb76ea14942bc0d32e39766709","first_seen":"2025-09-08T14:26:52.118181Z","last_seen":"2025-09-20T14:01:58.15412Z","times_seen":2,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/sub-xp.5ec6b9dc.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /sub-xp.5ec6b9dc.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"2eb11-63e38798d42c8\"\r\naccept-ranges: bytes\r\ncontent-length: 191249\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9sU5MZvBMZAT9ohq3GKBNa%2F0rA2pJGDTl96Diyyu4ickK9AwgglF5aLVK5Y2tljcHHDMDBLXjeoJEv28cTSuYqOxF%2FXiljQOLSob\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f7121fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":191249,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 800 x 525, 8-bit/color RGBA, non-interlaced","md5":"8fc7d5cb299bc93391e0158a02f7cb38","sha1":"cf7b67bf0f23655a43f1c026d38f47c6d085995e","sha256":"0fe589cd48912d679b61ea4d1916eea908ce7f6df3e82b13d40e5dec3482cc99","sha512":"128d4d6087d8dca2f32343d514bcfc5ad208a8f1c8735f1f7bf2d62008bf60b7aef67b9feef2b020d7136ca957031e4fff721b8aeb4e34f87fe0e1909da40104","ssdeep":"3072:9eXOZQAQc7KsqlzasWIQkeT/OcibovGs3RDTHcTPSFVtAcazZMYSP26R3hrYmzvB:cXOZ8RleQ9erxisvGERH8TqbG/C59VYg","tlshash":"3b14135a98cd424290723426cbca740f9fd7a03fb857642e3590df62ca8f379466d1fa","first_seen":"2025-07-03T01:46:45.675444Z","last_seen":"2026-03-27T19:24:36.993102Z","times_seen":8,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":386,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/5f8856b106b21acd8bf8d1874591cddf7e92417a.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /5f8856b106b21acd8bf8d1874591cddf7e92417a.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"11be-63e38798c6808\"\r\naccept-ranges: bytes\r\ncontent-length: 4542\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VmDun4a2H3SWW8%2FntLVaCdSXz9CrDKvRIy4gV8rT%2BQqhCyZk5%2BzhryqD1UU8%2BCgSdV9oLMhtn6HLbaDSZ9cunWFPAFZj9tOd1qlo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8c21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4542,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 111 x 81, 8-bit/color RGBA, non-interlaced","md5":"59ad1b0e4c93f1ca05ca695d53d8c7c5","sha1":"5f8856b106b21acd8bf8d1874591cddf7e92417a","sha256":"35527f37b89fba80283cdf2c12ea5e3f649c6294892f7ca4ca68c0aff5ec0725","sha512":"bc596a26fb0cef98ac4bb7624820049f0617b73a94786aceb0397f61c5f816f2482775e26327f13978a773dc3471214359413eede5bd5481976157c987cdd621","ssdeep":"96:jTFibAW6fITtBbkLau1CpLFtTzUVLwy29+DbrvkRtVHl7:jC56fU1gC9FtTAxv29u+V","tlshash":"63916c6be760740680820b66dcb9d7961b83bcfb9318d15f38b8600994dad4ae8bd1c9","first_seen":"2025-09-08T14:26:52.121387Z","last_seen":"2025-09-08T14:26:52.121387Z","times_seen":1,"resource_available":false,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/S6u9w4BMUTPHh50XSwiPGQ.f33015cf.woff2","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /S6u9w4BMUTPHh50XSwiPGQ.f33015cf.woff2 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"582c-63e38798c4cb0\"\r\naccept-ranges: bytes\r\ncontent-length: 22572\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oNT0A6FBIgwGKKZH9pbK0xB9HIkwu0yNpPC2lk8NjLe8ZHC97Uw5a%2BLKbvQKMT5DAepQjw4f3%2FqJXNr9CvhLUyZd3TWOtgJVVEhX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: font/woff2\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb8bb9321fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22572,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22572, version 1.0","md5":"947e87c53b5765bfc8982613ccd789e9","sha1":"521905bb4c4ce849285620eb0db5969d14d557ba","sha256":"7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6","sha512":"4b7dd8b3986eef0e14a5fdf87d94d74cbe7a8c87da16a75a9af6ed043e99ecc64592a22d26c8873380f6a1c097736a4d6f910c738e1ee1fd8a28b0b0260ac56c","ssdeep":"384:rUd0FkbLjX9Q6XvbDWN3sE/cZIoERh33SXy89o6fmAFm+Oyjl5j/Hk:4d0ID9ZnE3sZIH/33SXT95fBFMyjXc","tlshash":"01a2d178c66b59cd7fe6443cb3b49ad23552470234a2d1c38a2ef9aa444c6c8fdd760b","first_seen":"2023-04-21T18:35:28Z","last_seen":"2026-07-23T01:54:16.646953Z","times_seen":653,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-08T14:26:11.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:11 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\ncf-cache-status: DYNAMIC\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FAGCTFJkhHy2cP42iEENuvzVEeDYHQuTdCNjavmOhQw0h2TWU5h2k4XwTU8hHfyybwak0uIBbTrHYmzHOYJrFc7UOYDZckUENw%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 97bf1e97bbe37129-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Lightbox","description":"Lightbox is small javascript library used to overlay images on top of the current page.","website":"https://lokeshdhakar.com/projects/lightbox2/","common_platform_enumeration":"cpe:2.3:a:lightbox_photo_gallery_project:lightbox_photo_gallery:*:*:*:*:*:*:*:*","icon":"Lightbox.png","categories":["JavaScript libraries"]}],"data":{"size":143440,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7758)","md5":"d9fd66f6c5af60c363b92a4ced3ac7da","sha1":"275f1cc6ea7ebbaafef94389617759659d6b9d3d","sha256":"b456407632b57aa5884b5ba2e5f02ad0a7eef7c3665d95ac4c0a4553c29ae18c","sha512":"93a2a39eba5a7808d92269b5464b5db6a1d74212e1aba45270d5d105a17ab9d3f8d1843eb0a6354681a365039ddf89f8b9ede13287eb15f5a3a8b5fce7f52a03","ssdeep":"1536:8sFfLTUKsIZYEdriyDXDnvrwYg3q9WlOQBNUgP4MfS59MMDMb:jzTpriyDX59gPfYob","tlshash":"bee31bda53a310f1f00793ed5bba791836b534a7eae5cd14f3ac29810fd69dc484a84b","first_seen":"2025-09-08T14:26:52.124732Z","last_seen":"2025-09-08T14:26:52.124732Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":18,"dns":1,"connect":1,"send":0,"wait":139,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/849.e3ac8ecb.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /849.e3ac8ecb.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"f1-63e38798c7f78-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 219\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tV1gm2dl3i7yAD5CZW%2FYTY2DLUii7BDqgLw7d%2FQjnJtYrOJEW9LIBuFz7RrKoIq36Ce6DF6zL2nNaqKxG1dIbRrJvq8AD5jFzD5Z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a3f6421fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":241,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"513e67d9f79ab9f564e3ad556a3e9138","sha1":"75ac67c78876cf7de2d45c46be297dce550f4c01","sha256":"d50715d68c5f9be1c3390beae084ea02733ac338788a2e95f5c090bfb0fa6bab","sha512":"75523338fe0c1ba400c6bb3dbe4657a04a99f0e8899b25444650c677ce90f3a1525964795afc2cd70e4cb1617bb08b8d2e658983bdb46b18b1a2a578c1e5d3f0","ssdeep":"","tlshash":"61d095738d435d7dd631a8344b5482cdd0d4c1a1b910438ea848223543f92450cb4f44","first_seen":"2025-09-08T14:26:52.127508Z","last_seen":"2026-03-27T19:24:36.951599Z","times_seen":12,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/app-assets.e08acd69.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /app-assets.e08acd69.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"4e145-63e38798ca2a0\"\r\naccept-ranges: bytes\r\ncontent-length: 319813\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uJM0AdkdL0EvoLqlX9pB9E3QoObkHnyavCHYP15jJ5Z3VoH0D72Z4xcTESSz6BhWl9QULUr4RxbbKuobIN%2FOR6jbW6ebm6XI4NoD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8821fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":319813,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 780 x 1650, 8-bit/color RGBA, non-interlaced","md5":"0b06e4bac79996099c68edd27762b2dd","sha1":"44f02717a579f9627635e2762ba09a6fd9786971","sha256":"f9a2e36ea64745754affc1ab6ee78a5dbd9488a08b7881190dd61fb870016d0c","sha512":"e867ac85e3c31e298f5fdfd07bf078698e2fc15fa93285bb8c5349dff97fef81387fbed0b899840e47023212ad6cbd4f937548cd5b188c484b3088e25a3a6b2b","ssdeep":"6144:xIy+kEAZrGx1/HmcC2MSyfpVu7rxLhTB05JrjFgRg2pFNKGz6X/LlPgbIJWF:xFZ9sndMSs+X1hTB8pgjsX/Ll3J8","tlshash":"1b642242bb76d97cdeeb033b1cd42fc68c561cb091f88594d3e802af549af101866bb9","first_seen":"2025-07-03T01:46:45.696968Z","last_seen":"2026-03-27T19:24:36.954521Z","times_seen":8,"resource_available":false,"data":null}},"time_used":553,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":513,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/6d7b6fc7c249c9e1e475faafcbf030aa.a6d7189e.woff2","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /6d7b6fc7c249c9e1e475faafcbf030aa.a6d7189e.woff2 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"3b6c-63e38798bfe90\"\r\naccept-ranges: bytes\r\ncontent-length: 15212\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hT0JZy0fwuhRLTSgCbK3LgqZcrhE9c%2BzhE8o0dVOFYTMX5QUp3qrYuSxdBNlie39fzy2ikV48fhM2EQhnDUTV15D7YRCeeOTmxEM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: font/woff2\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb8db9821fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15212,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15212, version 1.0","md5":"6d7b6fc7c249c9e1e475faafcbf030aa","sha1":"fb025258de257714c9bd81ae31317de20756eb11","sha256":"1a96b23f121848e4e067a166bcf5f826d82ebb5e9231b48513251317c23414be","sha512":"dc799964d9369a62b955802f56c074bc23a5c1a047833a2f412e49bde119a8fb79130fb6d401824d71fac6f175b6cfe7f76f5950769f3d7334479b8f073a615e","ssdeep":"384:B5KxfjLBtp0DZh+hbw4YLFdNZleYJKxhz74Pa:BQ7H7kZleYU94Pa","tlshash":"a462d06a88531d04c227c5bfbf9867b1f0a3b5840b86369c7b463ad042775c0da9997f","first_seen":"2025-07-03T01:46:45.673671Z","last_seen":"2026-03-27T19:24:36.960378Z","times_seen":8,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/3423.bb92a8b7.chunk.css","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /3423.bb92a8b7.chunk.css HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"ff-63e38798c8748-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 222\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dTNYKDCwByCnXjPVf4DUe7Rt%2B%2FaP9y2zEBoBdW%2B1dtlnq9K3xYNFRrinlaah03wXZXtPDVXriHdEr2FRUhuqIcxneyhOE%2F%2B0gHPZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1e9a3f6321fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":255,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"3b52a268eb43600d4d1ae433804c7a7b","sha1":"187aefb78ae3920965d558ba24bcdf8fe6959afd","sha256":"ba5635c564a05497209b35d19c77bc03c3b653a537ad5937230c8298b146a018","sha512":"f763da57cf257933865574cc2a271eca9520cf15255f46149558cfff1de20aa81489021171d38a0bfd560764bbdafeae94424f499e56a0dd43652133b7c9f912","ssdeep":"","tlshash":"73d02b6692b1b465feb6187822d8054875c086826846856cd94a512483da4f3eaa1b05","first_seen":"2025-09-08T14:26:52.132166Z","last_seen":"2026-03-27T19:24:36.988658Z","times_seen":12,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/preview-stream.04c4f81d.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /preview-stream.04c4f81d.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"65aeb-63e38798d1fa0\"\r\naccept-ranges: bytes\r\ncontent-length: 416491\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TW0O5eerushhUoVRT%2Bvn8wypcS8Lgil89BmDlmf9G7%2FfQA0z9nKX4jMraDdq5wFsi8XLhhyF3q%2BO3gnoJCuvSUSiW3QnXqIER8uG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":416491,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1416 x 1634, 8-bit/color RGBA, non-interlaced","md5":"069690adb21bb53399a2ffc735bd2389","sha1":"201a840c1a1d5e0e79c1c31b9282bc8bf98be04c","sha256":"88b4ec69a46e287b8efd4b487249966fcdd5dcb9b02174e41127ecfc9c080685","sha512":"35e5f8939be361278f001b94b4e2bd4187bcb76d057725ac8c3c71bdbc13b076181f1c46e8393c137e2b2506b6a96df95854e973477dd6e1cbc1e6c654b24dff","ssdeep":"12288:5he1P6OV8ZPawfahcL8W+BnQizTSyAjZyB2DN6WtI:58tkRJah68W+BnQH7kB2JtI","tlshash":"cc942216b539f19cde8f0670c4d87fdba3874452eee4cb71c79822ec290ae407966395","first_seen":"2025-07-03T01:46:45.711741Z","last_seen":"2026-03-27T19:24:36.995634Z","times_seen":8,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 20 Jul 2025 17:08:10 GMT","end":"Sat, 18 Oct 2025 18:08:03 GMT"},"fingerprint":{"sha1":"66:D5:51:E0:8E:D7:2C:D1:E3:98:58:99:22:9B:73:C4:6F:32:FD:EC","sha256":"52:CD:3D:83:E5:5A:57:37:9F:D9:0B:EB:C3:EA:67:B7:4C:F1:74:93:B7:C9:E8:0B:E3:E8:CB:2E:7A:94:A2:78"}}},"request":{"raw":"GET /ajax/libs/crypto-js/4.2.0/crypto-js.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 19621\r\ncf-ray: 97bf1ebfb8788be6-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65384d58-4ca5\"\r\nlast-modified: Tue, 24 Oct 2023 23:03:52 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 124363\r\nexpires: Sat, 29 Aug 2026 14:26:18 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=fLEuY6oUp%2BP63Ew%2Fc%2F2FjCZm%2Fpyj06qYkpQcSJ3uddyzt8%2BBLx30gppL4aTLlOnaQQ0SrRY8OC44yUTfybmJFmY6X0dhPunlJZ9zHuUVt2UAWgjggPjI%2FC%2F8aLaeM9TLxUYQIm8H\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60819,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (60819), with no line terminators","md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-07-24T15:54:07.919427Z","times_seen":31759,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":15,"dns":1,"connect":1,"send":0,"wait":13,"receive":1,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 23 Aug 2025 11:18:44 GMT","end":"Fri, 21 Nov 2025 12:18:42 GMT"},"fingerprint":{"sha1":"7E:4B:33:A3:C6:27:AA:84:98:FC:53:87:7F:CB:E3:93:C1:A0:43:E7","sha256":"8B:29:3E:66:3D:E6:CF:19:E9:48:1D:C2:39:D5:7F:CD:33:ED:88:58:61:61:D7:B7:82:B9:0A:E5:01:B7:17:0B"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\ncf-ray: 97bf1ec23ac0568d-OSL\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\naccess-control-max-age: 1728000\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":26,"dns":33,"connect":1,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/secureproxy?e=ping_proxy","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:19.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:19 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZBOMdCAlLmpd97GQMj%2BdTmfLZuz8ncpWewjF8My5F8unyeKlr%2FqNiPhlk%2B60JR6J7ixbAJGzTsmZyq20rqjv2qoJegj0OqEuvk96\"}]}\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 97bf1ec4dcb621fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-07-24T14:20:03.092527Z","times_seen":8956,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-avatar.e771d374.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-avatar.e771d374.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"470b-63e38798d6dc0\"\r\naccept-ranges: bytes\r\ncontent-length: 18187\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=92iBGHGAS7%2BcnsVfd4WlHmiNGgjlugKEHf%2B0jClFYNAOIdICJaTKp2JqTm1cLijet3d05K0tfD2EXqSXvp043Skqb9sYP3MAm0cF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7d21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18187,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"ab1a2c260d2e7f0c54767c9d2aeb3da2","sha1":"3cae87aeb2482d41058ccaea63a000f1d2174930","sha256":"060da3532cdb7f20c7a9b27c196ee0c86df566675f90ac01e81840fecf30f57d","sha512":"b61719d9fef46d49482a8b491aa5783c6660ace8c6a01a52a9bf681d3aa4f28197fdf684601bfbacf2460d141d5b6a8eab62a8b0bd387af45d894610c20d48fd","ssdeep":"384:rhcpStdITbgOEET/F5vNM1Bxi1a56/LH4Z:rcStuTvG1BxiI560","tlshash":"2982cf2b89f6e8c01d268d3232c75f675ebf2ac8d6c876d4d986f55fa600c0417c1a89","first_seen":"2025-07-03T01:46:45.733514Z","last_seen":"2026-03-27T19:24:37.00879Z","times_seen":8,"resource_available":false,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-follower.5c21730e.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-follower.5c21730e.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"839a-63e38798d5650\"\r\naccept-ranges: bytes\r\ncontent-length: 33690\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CDrD%2FiPSHsRjRNjxzK7CTr9qzfXeCaP3t%2Fs%2BrVIGZlJKhxjy0COelxu8OwUQrHBmq4z7RgD4VsLvv9%2B%2BMtiSXhn1iwD%2Bbi5WKDAx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8121fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33690,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"2e6cd2724b14319d442570af61f3c1f7","sha1":"735e7b60d7726e5570afec9f85a61da359b65aac","sha256":"8c2b4217dab951d7fa8fc548874d47d282d0f1d9d8ad3c7113d46d37e696fc5a","sha512":"32f20f6451adaf6dc801ea8429ba4afefa3da6c6f081ddadc8f131bd3d7ca113e42dccd0a9744bddd045af51ac78316204c6a1234531f32f81f62d328bae1166","ssdeep":"768:D1rRUMZsM0V+/Jp5sp+kDYx5kT2OAh4hjJh3ivNpBrAzjiJwMFRb:D5J0g/35sp+kDwdhstZiV3ryMwIRb","tlshash":"e2e2f1cbbc8486079e9f2031e83c9cc044743a980fe2d387fb395570aa5ea51b417bad","first_seen":"2025-07-03T01:46:45.670221Z","last_seen":"2026-03-27T19:24:36.978738Z","times_seen":8,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-officialfollower.135580eb.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-officialfollower.135580eb.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"4d60-63e38798d5a38\"\r\naccept-ranges: bytes\r\ncontent-length: 19808\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QuDtoLrdIXqSpPweQkFCCyAp65wHfREQWng%2FmsKUJiUAvND33GzNG2X4z36gXGEMN5MpnyfTY4Qc4d%2Fu4lx07YaqdcDX%2BEy%2Fepol\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8321fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19808,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"c23d0ecffade97349d81b592143b8c96","sha1":"3dc1d4ff512287bfcfa351cf6f1f22f0cb72f587","sha256":"e6baaaaa7bfdb6a13960f5d75575848868aa6820091ec00812aede40ab73175d","sha512":"a71aff29756b6c018b9933088c0dfe73fd18f9ed43b0e4d81aa72a9ad8ff6c8e546d9efefbac03a2bea55e2a1ccd57d570018136724201b036ce9a5c8b425293","ssdeep":"384:Ys9lPqS9fmkUXajj1/31/PoDug+FDhtNf9:/9Uim3qHXHWGFN39","tlshash":"f792e17f316561b4ed2645f4ac75a671a3f4780efbd54495808f392a8e884c3b08e3f6","first_seen":"2025-07-03T01:46:45.689163Z","last_seen":"2026-03-27T19:24:36.953197Z","times_seen":8,"resource_available":false,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-follower.fb9534db.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.257Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-follower.fb9534db.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"520b-63e38798d7978\"\r\naccept-ranges: bytes\r\ncontent-length: 21003\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sIDNV03PaZQWO7GpSgo4GWVPIhRDNyOJb1LI%2BB2ZrlcAl6ZVlOpI0TlZSXU1ScTmEEQxGLwdWEVARUAMGptoe7YyVV4C%2FF98hTiW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8221fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21003,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"fbb7022246c7eaba70191ff54e7b1c16","sha1":"6051ba1312a29241576d53892d6cd034ba81eeee","sha256":"abbd1b86df673778ffc1c1891d17a20e7a6e6b13c06c9be6aed2049b65599c24","sha512":"415368e528d8d976cd5ed2275ce1df900e5d30b0211146ddfcf3ff21c465dc8f67dc44c002c0190f9c98a3949a73970325ca5c8000f978d9270973436aa1e53b","ssdeep":"384:RRgjo9clLZQTVphmeHhNQWS+rbehejPN0coSKBR49jSkc8KQZuTkcU0vbFE:RRgjW0EV3meHYWSebeheLN0co0S8ZWHq","tlshash":"9a92e1d8bca6e368e9df4b75c3c41eebda551338cc8b486d5d1600298453f117e792e2","first_seen":"2025-07-03T01:46:45.734694Z","last_seen":"2026-03-27T19:24:36.941759Z","times_seen":8,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/lightbox2-2.11.4.min.js","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /lightbox2-2.11.4.min.js HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"572198-63e38798bfaa8-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x6Hc2wWNARXcxPbOUy3e4pEFelhoaIi32HFxbE6TMLeKoGPHArcVPN%2BOiw3TJOnwrAGC6LbykcENg6zu%2FfOZ%2F3qbA5ZfljOh71W2\"}]}\r\ncontent-type: text/javascript\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-ray: 97bf1e9a3f6621fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5710232,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c9eb3fbebf002851d3b98d22ec1b5f97","sha1":"52bbe6718dc4eb85b272d146bc5a56de9e3a68d4","sha256":"ad3aa3f590dd1c0b4eef98000342464d656a313e7c5aca0e538d5651012af037","sha512":"d62270856cb15f3aab071f791f185d369bc26a5323f684d0abbdb39891c2630f2321238739e0abba90abad7dd91908b4403b2e349db54b1793ef195390572b76","ssdeep":"24576:SH6g0k57MQLnWaq0Bc5tIllUDEsrBnfbqsxaegJvIZVnp4Nm67:Sapk55LnWaq04t0mxfOeGvIZLQ","tlshash":"942512d6e042a0e3661a9121e5c62aece94e80572ec1173d3a98fcd470e75a6c7dcfd3","first_seen":"2025-09-08T14:19:33.819898Z","last_seen":"2025-09-08T14:26:52.141334Z","times_seen":2,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":199,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/profile-banner.e9d2ff94.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.227Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /profile-banner.e9d2ff94.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"ff58-63e38798d2b58\"\r\naccept-ranges: bytes\r\ncontent-length: 65368\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NiYNd61QH6FTqJu%2BGuuEyMPiu26H8cAiX9z0pHty4MkvF0mfzi%2B6nWuVkvl3G1spv23zQM%2FGWiNa4ZRH5MLO31lRVmOgc9OT2N5E\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6721fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65368,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1130 x 837, 8-bit colormap, non-interlaced","md5":"7bcf7401f471dc6705b98f677084d964","sha1":"1fe9ce49bdea393f83945037b7f7910da3645ba9","sha256":"11e651e79500d00e3b56cc855b05a0bfbe318a9978d40875d729505c4ce22a70","sha512":"069bc644cfa0c34190c79c13c6e675666156d04ebf6c29422ba39a7368d2200fb875df598ffd8218611b270989218ce8e609f80d5232babfbdd64ec3fdd346a2","ssdeep":"1536:c5S7pLsoSOwM+OasTq0lxsHNfhpeCWHKXU7KewfLfqfR94F:cs7z+O1TV3sHNfDIKXU7wLGRqF","tlshash":"a953023f29a5ea55f1d6a87cd32dc88b5d99d354e900d4146326388dfd89ac8034d73f","first_seen":"2025-07-03T01:46:45.703893Z","last_seen":"2026-03-27T19:24:36.989312Z","times_seen":9,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":243,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/p2-card.968afa6d.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /p2-card.968afa6d.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"37e6-63e38798ce8f0\"\r\naccept-ranges: bytes\r\ncontent-length: 14310\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p%2BKRttl0VvOWVrJilQ9mHqTwS9%2FCTrjduHadAaLds8snANJZ0SrHhUL%2F1q1xSfTMJeLpWlWDxuK%2BBQEBlaqp209Zni%2FR8Zqp6mQB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f6921fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14310,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 616 x 262, 8-bit colormap, non-interlaced","md5":"8aaf2c9b63c7f37349e4b220848fc418","sha1":"172cc723306d0915d2990b6a7c75bef48917b0b4","sha256":"af7713157fb00cbf3ba5dc404cb238cc0527c815a2cdb8b751cfa60f4cc3a53b","sha512":"fe5d38c8517b62c9864b0f543a1b4605122f5a071e35d1d686a9bfd6351c561f4e87bbdb3c30fd341757c3c357a1ab869e7d22fdbb42900ab2d373def89fd9ee","ssdeep":"192:tGd35FErZ7JZCLlRY6h98Dn7ecy5/3b5Q/RE4jaZHmM98r4pdZYj3+TQDG4lFRKY:C33EdJoLlv98Dw/3ARPjan94STQFIMr","tlshash":"7952af4fb6c7c4f5c1aa9c3899058bf9b20e0c3b6e95788e62bd4411c215dc4b5a77d0","first_seen":"2025-07-03T01:46:45.665391Z","last_seen":"2026-03-27T19:24:36.99173Z","times_seen":9,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/sub-credit.4c025042.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /sub-credit.4c025042.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"fecc-63e38798d3710\"\r\naccept-ranges: bytes\r\ncontent-length: 65228\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8cXlsYeyFOS%2B5hAnLeH9PJBKfXFt1Wt9lk5Dz85WVwDnK7QR2OfwW8oRC%2BR7wzu5mryPTMtoWGTO0WjmihNTSBVosRuQamU3fLbK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f7221fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65228,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 674 x 524, 8-bit/color RGBA, non-interlaced","md5":"da7d7e5b4f95e4ed88f802d2f0d6d5b1","sha1":"dc483bd81fe8f202380deba54f9f3381468b0b0a","sha256":"cb4085e4e9761b40da39688ab002cd4d1926cf9b895195c4df336b5d1b228bbc","sha512":"f4de12e48a00315e02401a73895f48fbc89fb20511dd8039f28d40d2de59ef9d851b174bc2a141d2a77ef0a8af136459cd705da5cf30504223b775c23f0f39c5","ssdeep":"1536:TDcescXRAMyAfu3veVHyIE0W8ExzELEim7an3:TDjBfxV0KEvBan3","tlshash":"5c53010d6a90de4fab063067eb5d8e52ca2f26d27bd021d75c9ed7d0241e8738938e71","first_seen":"2025-07-03T01:46:45.728573Z","last_seen":"2026-03-27T19:24:37.004237Z","times_seen":8,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-cover.94cf1b0f.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-cover.94cf1b0f.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"38e7-63e38798d7590\"\r\naccept-ranges: bytes\r\ncontent-length: 14567\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kezy238AllxBjLK6DdDG0OoHpWLIV%2Bzy%2FmhdPh4r5sRYQoehmU7SGnAb7VQAR4n01L91MET%2F2yBnwwhYczynQbsM6jM02k%2FiBlLR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7f21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14567,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"a4311953eca47045293c99b4ad07dea8","sha1":"e64449da4d1f70668ef5ec5f0554d4b4699ad1bf","sha256":"b9c72dad6605ca7f7bdfdac1f1718b9d77fc332c8dd7ab7a4ec275a7dac3c469","sha512":"1afbad16dfe5af44296a2e8907412efbc0bc17bdb419e54a908d74914bbde467ca9fdfda44e322bff326f9514c17b0559fcd5b47c019c057d2c5c9f4edee83f4","ssdeep":"192:VqVv/bPJPQmIgyJOT9XYC9Cdb1D6hnjCKHrfs6gJOt/0NrfM8bgh9fVo7NWabpmI:Av/bJPQVyoCIdKYB6Mr0Ugf2q1S9","tlshash":"f262c088a879f880329ffeb54925f84ed0de8a34129e01f59eb9a1718934d9517cd960","first_seen":"2025-07-03T01:46:45.695858Z","last_seen":"2026-03-27T19:24:36.986261Z","times_seen":8,"resource_available":false,"data":null}},"time_used":459,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":458,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/app-stream.690e83fc.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /app-stream.690e83fc.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"38bae-63e38798cc5c8\"\r\naccept-ranges: bytes\r\ncontent-length: 232366\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wx2xlS34uOgeN4dB8xofuyZ9PasxPrNGXI%2FOb4nhjJETFn0QHe%2FOzrClpeQnVXY7TKgxsGLdkWFHHFTIy4xrif5z1ju4WwG7paNn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a5f8721fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":232366,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 780 x 1486, 8-bit/color RGBA, non-interlaced","md5":"2dda87eb7581a9f874cf636cd47253c2","sha1":"5c843f3883255bb02011c6aaa602a30c425255f6","sha256":"7e15d8a3f7fb7aba3f0c7d1a525582ba0c0a717ae1281ea4568661457d6772c7","sha512":"513e81efede8fc12a7b2e1b35825d080d874c0c84dd50b9af8e63ceef708dc47a1076f5ce1cf84918ec3117e101de47f9f883a590972833c578b3b92dbbe1d25","ssdeep":"6144:QW6sC5dLhrSFu6MdI7AA9qtc56/nTjEyf:Q4C5dLhrSFTZ7AAgc5Gnvf","tlshash":"e9341295d9f3e7503f2b2d3120ec7b8f2367d44454ee075ab803698cf0aad6889ea4d5","first_seen":"2025-07-03T01:46:45.690659Z","last_seen":"2026-03-27T19:24:36.983807Z","times_seen":8,"resource_available":false,"data":null}},"time_used":513,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":485,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/favicon.ico","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:13.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:13 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tj9JgIDfR3yXOkJIrc3VyHour6M40U63i2tJ7weOsxFaNedJhpTOs02Cc0OyC7mLV%2FJYGTyS0OIU6n87jASYUX9LMtnDkzGy3Df4\"}]}\r\netag: W/\"702-63e38798cdd38\"\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/vnd.microsoft.icon\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 97bf1ea218e821fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1794,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"bb9365694ce34361a66bbfd7cbe29675","sha1":"ea159758c5c1340b10c28fd3e5f3b3a30ecb2574","sha256":"a40866ce0369888b908edad0d93cc6105810efd2bad5e5532d7629b728548b12","sha512":"8032536ba37a1ed201ea1dcc5aa3b0a5ccefff71d78c4b4aa033e6bef55dee9f3fc15260e619218c4412d92cb0091c4b0bf9457d3f9552c8056cfec911dc56ad","ssdeep":"","tlshash":"0c312959d2eb8e89c24462328a2b2f9a9f00d4f9320e461e7944e0b3dc01c0fef5ce42","first_seen":"2023-06-02T16:35:47Z","last_seen":"2026-07-23T01:54:16.627098Z","times_seen":151,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:19.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:19 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: 1865ea1ecf252e02f055806862197feb\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6374,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fa3dbe9e7a67f351ee2d52c99850bf9c","sha1":"294cd26f4c0198841057707ed0b44b3cf616e5a8","sha256":"efe3b5e2a041edfb73e010d9c7b8321b7c075c78f0b5d972fe7783da8844f87b","sha512":"d46f4edc8d511404ba6bb32a1a375a1a1c66b24a11f072dbe332243df7b1489af0816a8506fb648a97dd28b0c5ceac714915bc46221ef78d12e9a8a5f1d51d45","ssdeep":"24:YUtXa257vaoWH3eGZsthXvUzZ5+hdex1qx1xxNU6xvQaNBtXX60jv:YKam3QytxvU15+doY1jNNTt9jv","tlshash":"52d108f098c98e50f19baa81b798bc9400213caf7fdf8f40415cf8b6a0f54a176a448f","first_seen":"2025-04-07T11:53:19.749574Z","last_seen":"2026-06-18T09:20:21.245055Z","times_seen":5257,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/preview-draw.f3138e3f.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /preview-draw.f3138e3f.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"453da-63e38798d0830\"\r\naccept-ranges: bytes\r\ncontent-length: 283610\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YFInHDKsh17rYPdTVZokvRTp84K1XyFfP9oxXRSeXo2OJ79Rm4jMJVse5ifLuvcOBDgItGuFcOPI0058JA%2B7s4CGkUPqBmVVVXwu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a3f7021fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":283610,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1416 x 1634, 8-bit/color RGBA, non-interlaced","md5":"ce8bcf55d8fd48775341f7a0dedd1851","sha1":"cbea95dbbe5f2a84d5da593ebdfe7625b4d1786e","sha256":"dabafc0add92fb6ff909c00778c64d12e3d2e0754dd469179f5c86e39cd0b84e","sha512":"c1d189dc8d8799b0aad4b8e31f8fc5c43abf0f033bb7e5f82f4ec0ee42b6c50aa2e77258e9f84c40b50b34046a9f50df2cc964e93b621896c7862e6a423ef45e","ssdeep":"6144:pOjJeF+VoutyhfxYN5kovp0nyvQOvfgDhb5QvrVlz8L:pm+utQmNqq+dOHgD7qplz8L","tlshash":"3354121d4ab8f05cce5f05f18d2ccfab84a725e6a1d5a4b9c7326aec149bd93c5480ca","first_seen":"2025-07-03T01:46:45.686409Z","last_seen":"2026-03-27T19:24:36.9899Z","times_seen":8,"resource_available":false,"data":null}},"time_used":386,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/vip-active-cover.df4d15e4.png","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:12.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /vip-active-cover.df4d15e4.png HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:12 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"545a-63e38798d5268\"\r\naccept-ranges: bytes\r\ncontent-length: 21594\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OPH5GyoybGfLQmcqD%2Fb0Of030UrY65m%2BMYFcq5Q9OWrpGQKBv%2BvlnD9xXWhjNsSO5wsCyBSWXZHeT44Nfo7Ln6yoGXplLjB3BVVK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nage: 93\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1e9a4f7e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21594,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 372, 8-bit/color RGBA, non-interlaced","md5":"1c4e5a4cbc980ce835c9671e6158a06f","sha1":"8dd848eb9229ed461ce36c10b97eb9552907d031","sha256":"be3e0299b7b7dc08d013ce8833cb6f972ff4ca77bda11a28dd1d9fca1ae570cc","sha512":"5abe219d94fba663c46beaefe45006b403a377fbf6633a7ce6b30c8b65b2de9f5a8cd4e8e8772c0ba79bd19b547d5472448dbd33514f80f004f1ae562aa420f1","ssdeep":"384:zPNG4fWIlP0AdjJ/6+x61U++YdKK2b25kQ09GguIcPzEwG2:zPNbLPDV6+x6H+5K+257htdPzEx2","tlshash":"2aa2e1d88e883132dca93ef8e27e45c09567ac043c2e20a15dd709da5d6c0dfb7711ba","first_seen":"2025-07-03T01:46:45.70589Z","last_seen":"2026-03-27T19:24:37.001281Z","times_seen":8,"resource_available":false,"data":null}},"time_used":459,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/S6uyw4BMUTPHjx4wXg.65e877e5.woff2","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:17.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /S6uyw4BMUTPHjx4wXg.65e877e5.woff2 HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://de-bank.run/610.368ff984.chunk.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:17 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"5bbc-63e38798c5c50\"\r\naccept-ranges: bytes\r\ncontent-length: 23484\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=01N%2FgIRn9WM45ySs9AiJOVasIj3qyksWaR0m1BMd%2F0euvbfnoOuyWPMBemaZNBhJD%2FWxzaLNNOmOjGRE0yiqFRrWQIIcmShD9fjA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: font/woff2\r\nage: 92\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 97bf1eb8ab8e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23484,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23484, version 1.0","md5":"b4d2c4c39853ee244272c04999b230ba","sha1":"c82e22dde9716c40ba20e6c7ed03a1b66556de15","sha256":"c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1","sha512":"d315d6a4e28bb125128d3a4d99fe120e383061d367341f06c4b74a589b4ca29c516cbc8d23ddd37267a1e4497c74fd58b1dffd39cb70348b8a3ea3d48237f8ef","ssdeep":"384:iXFbv7T+soFz7IbR/aBa639y2FNedPuzHQ1eGcYe3mkGtapwx/vX5htghzvcjvm:iXFzP+soFP8RQty2FNedmzocYe3DqapT","tlshash":"40b2e1778269aa70d6d01bb5ffc112a73a79589245d5e3a34e409b02442c73f7eadf40","first_seen":"2023-04-07T01:34:48Z","last_seen":"2026-07-24T15:39:38.687301Z","times_seen":3885,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"de-bank.run/secureproxy.php?e=ping_proxy","fqdn":"de-bank.run","domain":"de-bank.run","tld":"run"},"ip":{"addr":"104.21.112.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"de-bank.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Sep 2025 15:31:36 GMT","end":"Sat, 06 Dec 2025 16:31:22 GMT"},"fingerprint":{"sha1":"6E:F8:74:52:0C:78:23:13:59:EF:85:96:1E:41:1A:06:95:3C:C7:96","sha256":"1C:90:FD:D4:7B:B9:41:26:2B:95:59:43:11:E9:83:6D:59:7C:FE:AD:AD:66:86:1B:D8:A1:4A:23:85:86:A0:B8"}}},"request":{"raw":"GET /secureproxy.php?e=ping_proxy HTTP/1.1\r\nHost: de-bank.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://de-bank.run/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Sep 2025 14:26:18 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 07 Sep 2025 16:22:18 GMT\r\netag: \"1e34-63e38798d8918\"\r\naccept-ranges: bytes\r\ncontent-length: 7732\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8nL9qkxqQvQ1Zam2wNrFDEmg4YYsWe16GkmSSDWoeMcEiKdJrG16kjR7Xjah9YMJZv8bbT4PabpstWyVKiYXzI3JyPolMaoiNR6Z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 97bf1ec1dc7e21fe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7732,"size_decoded":0,"mime_type":"text/html","magic":"PHP script, ASCII text","md5":"266ba4231e44862da9e32e4f9b6a8012","sha1":"eb2b688e2b06e66a65aa7446809b35e10aba6d7b","sha256":"a568132ebe184290adad1a5970f34e9191d3f38894c640ba6d4d0acd9237cc4d","sha512":"59fd83eb968a9342a72a2214e6c9718e02f558f7abf9cb4938b8b7eb01e5645e140b4b92a656ba78cd9a31d244fb0fcde96a4e313739cd9496ca3d81b777fb65","ssdeep":"192:q6vgpPDNF6iTypG/+WA4yAXg9bDI6C4VCRnw0Zy5q:epLeit2WBwRhVmX","tlshash":"b8f1611079e37a80a177e0bda74fb8086609a80b441ed909be5c23931fc033cebf169d","first_seen":"2025-07-12T22:38:09.124273Z","last_seen":"2026-04-09T02:34:42.258638Z","times_seen":964,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-09-08","alert":"Sinkholed","trigger":"de-bank.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"binance.nodereal.io/","fqdn":"binance.nodereal.io","domain":"nodereal.io","tld":"io"},"ip":{"addr":"54.155.105.176","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://de-bank.run/","date":"2025-09-08T14:26:18.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.nodereal.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:91:90:0D:EE:3C:8C:8F:95:A6:0A:58:6A:D8:9E:F9:06:B3:FD:A5","sha256":"CD:EE:48:FB:10:6F:A2:00:C1:73:D1:C9:53:62:65:8E:93:C6:CF:DC:73:96:A6:33:D8:E9:26:3D:88:32:2B:E9"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: binance.nodereal.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://de-bank.run/\r\nOrigin: https://de-bank.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Mon, 08 Sep 2025 14:26:19 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T15:50:58.365581Z","times_seen":17506136,"resource_available":true,"data":null}},"time_used":414,"timings":{"blocked":190,"dns":85,"connect":32,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}