{"report_id":"b48c9f48-548c-41e5-b75e-783104fa1b3b","version":0,"status":"done","tags":["malicious","clickfix"],"date":"2026-07-12T17:06:14Z","url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"title":"Just a moment...","dom":{"size":343135,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (56075)","md5":"2f68437eb9b1e4bcb34ebee5ccf420c7","sha1":"ca8dace27213083a7a5b8348552565a38ab2c578","sha256":"77974921bd085a62b4d25a5c5287afb763e2facace2f02b14480839fa22dd0b7","sha512":"593776230cfc16e3f7b081cb488ac29b5b268727ce2eb2e000d8afbdfe826b78afe15a92d39276399d72745cc4de6cd522a51f0760fa5393e5b6130f84ead0d8","ssdeep":"6144:AOt8uGgr23Ot8uGgr2FOt8uGgr2hOt8uGgr2a:hi/grZi/gr1i/grfi/grx","tlshash":"1674e033921f2d8a76170d90e41427082de9bc9fba24da98fdcc0596d7fd620cd9d8b6","dom_hash":"domhasha9700eff9b0f637727d57c79da26fc41","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T17:06:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":9}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null},{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"summary":[{"fqdn":"gateway.tenderly.co","ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-05-11","domain_rank":1960624,"first_seen":"2022-05-12T13:13:46Z","last_seen":"2026-07-10T21:58:14.251072Z","alert_count":0,"request_count":1,"received_data":514,"sent_data":499,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}]},{"fqdn":"www.cloudflare.com","ip":{"addr":"104.16.123.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":26817,"first_seen":"2012-05-22T13:19:15Z","last_seen":"2026-07-07T06:24:10.764601Z","alert_count":0,"request_count":1,"received_data":4548,"sent_data":538,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"abrmot.pro","ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-09T00:38:51.948343Z","last_seen":"2026-07-09T00:38:51.948343Z","alert_count":16,"request_count":3,"received_data":22484,"sent_data":1516,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"polygon.lava.build","ip":{"addr":"104.18.25.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-09-14","domain_rank":7157037,"first_seen":"2025-08-27T09:05:44.919474Z","last_seen":"2026-07-05T19:32:09.368489Z","alert_count":0,"request_count":1,"received_data":1422,"sent_data":484,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2026-07-06T15:13:52.241954Z","alert_count":0,"request_count":1,"received_data":65380,"sent_data":571,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"polygon.drpc.org","ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":0,"first_seen":"2023-12-16T03:46:28Z","last_seen":"2026-07-12T11:00:22.499648Z","alert_count":0,"request_count":1,"received_data":775,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rpc.ankr.com","ip":{"addr":"152.236.9.75","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"domain_registered":"2007-04-23","domain_rank":541361,"first_seen":"2021-10-24T12:41:06Z","last_seen":"2026-07-07T14:16:14.753648Z","alert_count":0,"request_count":1,"received_data":859,"sent_data":485,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"kaleda.pro","ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-12T11:00:21.852531Z","last_seen":"2026-07-12T11:00:21.852531Z","alert_count":21,"request_count":5,"received_data":430137,"sent_data":2465,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"polygon-bor-rpc.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":2163006,"first_seen":"2024-04-26T08:35:48Z","last_seen":"2026-07-11T09:02:11.852478Z","alert_count":0,"request_count":1,"received_data":764,"sent_data":496,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"polygon.gateway.tenderly.co","ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-05-11","domain_rank":0,"first_seen":"2025-08-03T10:23:07.273214Z","last_seen":"2026-07-07T05:23:09.651656Z","alert_count":0,"request_count":1,"received_data":514,"sent_data":493,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"814368230b134e5641a54e81d8d83c52","sha1":"d8fbbba47cd5f16177b93835bd503791eb6ca133","sha256":"3813ba3ce3c7300f0f0ed45afe9883d38075260c18097123aa6ef12dc52080db","sha512":"a3985cb7a49b09c355e52e690a975144e09243a4cbce41d75e0d20590ca1ef5b9110305fd9241b09a9c13eced21793d3353058512649dd2b0fb23b8f6192b45f","ssdeep":"384:b45tiRQMiewAaMdBDaWg5/cM54tLShlXz6xRnX/GehQu74adkz6lfLYKTyBUK4lp:bwtTeX9g5/uGy+emu0vm9LYKUAhqO3a2","tlshash":"dd924c45c6b488e14daf63c79d7abb9b8e4193306653f5c578442b428d21b62b3bce0f","size":19660,"data":"","first_seen":"2026-06-08T23:28:53.88929Z","last_seen":"2026-07-17T05:17:47.599652Z","times_seen":128,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0fb8e9bfeacfd29716f1c32d2d0f687f","sha1":"b6487fa94fd9a68eb771f7d5d871a48b62de3993","sha256":"4d9d3b33d127b748ecc95b5b89bffc85075dfe83947b25759b0d7824433892c4","sha512":"003af815281f59e150635040ffe9de7aad0cd6e9ae5e383ad087e416680267f4bf0e825e4c96f8d916f151424d30ad1dd0e1887f7b6ff78ab041d32106386227","ssdeep":"","tlshash":"b1f0e90d34157d228bfab9b3810f9643b03764129d975dca1bae5be05830e8c9b53a60","size":523,"data":"","first_seen":"2026-06-25T03:13:38.190989Z","last_seen":"2026-07-17T05:17:47.601427Z","times_seen":110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3e09bb7c05732697c10c998af4324353","sha1":"49ca91255ae207b5e311d6a1e9688a8594f60189","sha256":"e23d7ab5508f4b537708ff089d945fc33b44f5460415da9161132d5519b6e488","sha512":"18df0234cc7f277a0937ea6491a6ba5bcdce4b103abc2ba612e0c9b56b961ae1e927b352e9a5f742fff0bebfe4eb915f74ae960765073257d5f2a424f2a1aee4","ssdeep":"192:USSHiqaK5bb58NuXQKkw90mt74W8S7fcT9A7bFJ4B7dWkTC2qgMLdUeTlqcs34ws:hlcr90W84bn4B7dWk+2qgMC34RNYzdo","tlshash":"8852c794356791b543e70ee0002e5544fd3bea023d8cc4a0b2ab4ec7179f6b6a1b7a7d","size":14420,"data":"","first_seen":"2026-06-08T23:28:53.890862Z","last_seen":"2026-07-17T05:17:47.781288Z","times_seen":128,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kaleda.pro/cf.js?v=2","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"329c73a0ee715e911a82001960c41d33","sha1":"70641931f9fc6d28aaf0d908855cdae21ed36f8e","sha256":"e0039cca62601cae2334cf31e188549a50c79eabb3f99361edd3c0132de05b8a","sha512":"e6c921e71b62751a55bd7495bb76a9801d7b84e5acbfa7031fbbccce32b9297a35215dfdc68940b93217ee722e688bda7e1edabfd8bd8ce982f9b67b0a107ae3","ssdeep":"6144:yXOt8uGgr25Ot8uGgr2QOt8uGgr2HOt8uGgr2pknHco3qD:y+i/grRi/grGi/grXi/grIknHco+","tlshash":"0094d077596f2e1425175c9590092b143cf938abfa00cae4bcdd48a66fe8630dd3eaf4","size":426171,"data":"","first_seen":"2026-06-25T03:13:38.179327Z","last_seen":"2026-07-17T05:17:47.361703Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"polygon.drpc.org/","fqdn":"polygon.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.178Z","timestamp":1783875946178,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 23:01:08 GMT","end":"Sun, 13 Sep 2026 00:00:59 GMT"},"fingerprint":{"sha1":"7F:E5:3C:EC:15:AC:2B:17:FE:8B:3B:16:E4:25:9A:40:37:43:63:45","sha256":"DF:D3:75:05:E3:1C:E5:C2:B8:D6:2A:66:75:39:9A:D3:91:D6:86:E7:7B:11:D6:84:3E:A1:0F:FF:79:47:06:19"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding\r\nx-drpc-owner-id: cb501251-31a8-4028-8b0a-54679f15c385\r\nx-drpc-owner-tier: free\r\nx-drpc-provider-id: drpc-core-free\r\nx-drpc-trace-id: 90df21fbb6d8d20192d4b47cfa004e51\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\ncontent-encoding: zstd\r\nserver: cloudflare\r\ncf-ray: a1a1a277dd9d0b55-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":230,"size_decoded":628,"mime_type":"application/json","magic":"JSON text data","md5":"3cc6261d3c28c3bbcef1946d19f832fc","sha1":"c410f211f0f77bb1385025cb8330f4652c2d3f0e","sha256":"92bdac6903e08f19308e1b72c24a85feca95ac6008a7dcfbe07f75f8e5109ab3","sha512":"560e3347fdca6649e2e283591550b2bf7b7eaae49f0721e66eeae17d57d933401d135a71af4fac7987c034c8b82a166ff2ba21231567751ed17e6287b5c7b142","ssdeep":"","tlshash":"16d022c8820e8332cc0c0c0ce00838002288330a0bc00f02820e020003c822b020a202","first_seen":"2026-07-12T11:00:26.655026Z","last_seen":"2026-07-13T18:48:06.745435Z","times_seen":10,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":6,"connect":23,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/polygon","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"152.236.9.75","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.191Z","timestamp":1783875946191,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"shark.multi-rpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 11:08:04 GMT","end":"Sun, 16 Aug 2026 11:08:03 GMT"},"fingerprint":{"sha1":"75:83:7C:84:77:DB:95:45:36:E5:E8:67:BD:D3:E5:85:52:4F:E8:FD","sha256":"B1:12:8E:9C:C2:F1:B2:5A:70:44:5F:46:ED:1F:40:D2:99:24:1D:0C:C1:85:19:9D:E3:34:0B:15:6B:DA:C9:B3"}}},"request":{"raw":"POST /polygon HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-type: application/json\r\ncontent-length: 229\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version,x-client-name,x-client-version\r\naccess-control-max-age: 1728000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":229,"size_decoded":859,"mime_type":"application/json","magic":"JSON text data","md5":"42e136a22281d105bd21fa496816706c","sha1":"bc02950079004b0d4f4bea3888dfd4517cddeeff","sha256":"ede226c79ae326ce9e4b099e9f4dbb4e3d7807da2b793bdfadfafeeb84d7175a","sha512":"a41403da8b9e698eb2823bbe0925160b68682c55d4c64e5c8b27193f8fd8bf4fd118179d26eadb446ed41c2c9c12d46523b6f5094caadaae8a03ba3c1d6bade5","ssdeep":"","tlshash":"33d02313c6470537e34f4633371567c4f559705071105f1b4e1c0315024f97b0255351","first_seen":"2025-04-07T11:34:31.00119Z","last_seen":"2026-07-17T05:17:47.503265Z","times_seen":2974,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":4,"connect":25,"send":0,"wait":22,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kaleda.pro/api/index.php?q=jgSqX4p4IpX39zXqfg","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.703Z","timestamp":1783875946703,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kaleda.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 13:13:49 GMT","end":"Fri, 09 Oct 2026 14:12:35 GMT"},"fingerprint":{"sha1":"10:BE:4C:0F:C5:FB:A5:90:EC:BA:ED:CF:8A:BA:6F:FE:5C:62:F8:95","sha256":"A9:7B:9A:C4:CA:F0:61:EE:92:A6:AF:69:B9:E1:CF:78:8F:C2:02:0C:D6:2D:16:76:44:2F:16:E2:5F:63:46:37"}}},"request":{"raw":"POST /api/index.php?q=jgSqX4p4IpX39zXqfg HTTP/1.1\r\nHost: kaleda.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 177\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":177,"data":"{\"eventType\":\"view\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"screen\":\"1280x1024\",\"domain\":\"abrmot.pro\"}"}},"response":{"raw":"HTTP/3 204 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FdKLvGMkVTIbuq77lvYiMJY95HcG9fMB5tOucXVwuAlXee8e%2BfFO21q0G%2FQl4rxadBG%2F63VJyoD%2BJJci93fpste94jlrHg4i1AoZYuDwEU0SNj5ne66FEWmgdIzQ\"}]}\r\ncf-ray: a1a1a27b2b8f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1366,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T06:40:21.376073Z","times_seen":17307926,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kaleda.pro/api/index.php?q=jgSqX4p4IpX39zXqfg","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.704Z","timestamp":1783875946704,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kaleda.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 13:13:49 GMT","end":"Fri, 09 Oct 2026 14:12:35 GMT"},"fingerprint":{"sha1":"10:BE:4C:0F:C5:FB:A5:90:EC:BA:ED:CF:8A:BA:6F:FE:5C:62:F8:95","sha256":"A9:7B:9A:C4:CA:F0:61:EE:92:A6:AF:69:B9:E1:CF:78:8F:C2:02:0C:D6:2D:16:76:44:2F:16:E2:5F:63:46:37"}}},"request":{"raw":"OPTIONS /api/index.php?q=jgSqX4p4IpX39zXqfg HTTP/1.1\r\nHost: kaleda.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://abrmot.pro/\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uJzpfndnpE79KKn%2FPLoB8RC6yW2HJx1Z0FWP6rWn0ac%2BCGWx9XdH5Gc37yd3Nq1tFtoJr6vQ9mQLhXU%2B%2FSlc2yV%2Boc4JtyuxYLyuADiOxtqhuSW0ubvJpIrbsT%2BN\"}]}\r\ncf-ray: a1a1a27aeb8a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":675,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T06:40:21.376073Z","times_seen":17307926,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"abrmot.pro/","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T17:05:45.459Z","timestamp":1783875945459,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"abrmot.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Jul 2026 18:37:58 GMT","end":"Tue, 06 Oct 2026 19:35:43 GMT"},"fingerprint":{"sha1":"C5:4B:74:23:46:B9:71:EB:53:82:4C:F6:2B:67:46:26:20:D6:C8:4D","sha256":"7C:7B:14:37:E6:A2:D8:29:BD:2E:CE:E3:F9:F3:AA:D5:DC:66:78:CB:07:AA:7F:A6:08:1F:14:82:15:42:CB:66"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: abrmot.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:45 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yh0syhiozQe0%2FQviA3Z6ZMSmPO1WsluGgHfZiHsLjTp22EmJttT7YTopyTtu%2FzT44RWKzrq5BmUuYTOxBNw3DZavuiUDtbIMNm747E%2B8dKzn6hTkQyD%2BaIiWZDHC\"}]}\r\npriority: u=0,i\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1a1a2748a6e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20343,"size_decoded":9216,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (19660)","md5":"62bf0e118b66295843fef4b1789fd2ea","sha1":"c2cc54ebdcac3934ddc7f4e1b5c9a76ed9276309","sha256":"34e85a89c4a01bf0689d53a5681db509dbe03b6a39f23dc8414dd3a1dfff8d74","sha512":"11db66f707c58a1878c247e35936f4c6f80a7d54a0aab0ca3ad2a54edc43f98d1dc44753a5b0b1fdc32a38154196abaff5778466ba65244ce6746ef1fe7d5faa","ssdeep":"384:g45tiRQMiewAaMdBDaWg5/cM54tLShlXz6xRnX/GehQu74adkz6lfLYKTyBUK4lp:gwtTeX9g5/uGy+emu0vm9LYKUAhqO3aW","tlshash":"3e925d45c6b488e14daf63c79d7abb9b9e4193306693f5c478442b418d21b62b37ce0f","first_seen":"2026-06-25T03:13:38.187934Z","last_seen":"2026-07-17T05:17:47.395039Z","times_seen":110,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":212,"connect":13,"send":0,"wait":69,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}},{"url":{"schema":"https","addr":"polygon.lava.build/","fqdn":"polygon.lava.build","domain":"lava.build","tld":"build"},"ip":{"addr":"104.18.25.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.183Z","timestamp":1783875946183,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"lava.build","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 24 Jun 2026 14:42:06 GMT","end":"Tue, 22 Sep 2026 14:42:05 GMT"},"fingerprint":{"sha1":"8A:8E:7D:2C:B5:2A:05:E2:FB:54:48:81:D1:E6:9D:D5:10:54:BB:33","sha256":"10:AB:85:27:B2:25:A4:3D:F5:D8:AA:92:2D:A8:9B:2D:24:4C:64:27:F8:7E:69:6E:D3:CF:32:E9:9C:0C:7F:A1"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.lava.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 91\r\nserver: cloudflare\r\ncontent-encoding: gzip\r\nlava-provider-load-rate: 0.001\r\nlava-provider-address: lava@1vuavgpa0cpufrq60zdggm8rusxann8ys76taf4\r\nprovider-latest-block: 90113967\r\nlava-guid: 11273840488734807838\r\nlava-user-request-type: eth_call\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nlava-origin: mainnet-iprpc-eu-2\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=MGYGyLmYFWUlzqBZGj3FY8WMZSL_XUdqzBwzfq9X7FM-1783875946.2220833-1.0.1.1-zMJ6WpOeVkf0CjNE1KwnkL0ZfFYS0AUxEr3CZWyL_MGfbmzYq_fJX3IashxlpAtCdm99z7XzqpchZLu2Fl6_qbKXUhmVh5qx_hpdQ9B5q.irjULejRr8yUlVB2Znq5Bh; HttpOnly; SameSite=None; Secure; Path=/; Domain=lava.build; Expires=Sun, 12 Jul 2026 17:35:46 GMT\n_cfuvid=ImstKv__9LubfP8X6.9.tVI1eiMW7icl9bJO1Cl3Xiw-1783875946.2220833-1.0.1.1-boipCIItGsTrdVziKgp1j.QcfNigJ0cnxLH7gtxwIG4; HttpOnly; SameSite=None; Secure; Path=/; Domain=lava.build\r\npriority: u=3,i=?0\r\ncf-ray: a1a1a277ec17b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":230,"size_decoded":1283,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0632abbda30114e67501e1eeb12269c1","sha1":"59985c156fa2fc70f6497028e0021dc67067d410","sha256":"d7eae8152439bb9f3bd9933f271f786d03b89d08d2312ec612a1d10fb7e95b37","sha512":"12b8635cc41f01e2a7f316c17d462d90ef436a4bf600bb061294f900927c97d409207cf2bf5745d4c723f15805b795694e934b3b771d1207492fbd8d5f68e18d","ssdeep":"","tlshash":"83d00299964e8732dc4d5c1de058784123957a9a4bc41f82558e1a5413c926b561a222","first_seen":"2026-07-12T11:00:26.658731Z","last_seen":"2026-07-13T18:48:06.809262Z","times_seen":10,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":10,"connect":24,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"abrmot.pro/log.php?t=pageview\u0026src=\u0026dv=desktop\u0026r=\u0026_=1783875945967","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.198Z","timestamp":1783875946198,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"abrmot.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Jul 2026 18:37:58 GMT","end":"Tue, 06 Oct 2026 19:35:43 GMT"},"fingerprint":{"sha1":"C5:4B:74:23:46:B9:71:EB:53:82:4C:F6:2B:67:46:26:20:D6:C8:4D","sha256":"7C:7B:14:37:E6:A2:D8:29:BD:2E:CE:E3:F9:F3:AA:D5:DC:66:78:CB:07:AA:7F:A6:08:1F:14:82:15:42:CB:66"}}},"request":{"raw":"GET /log.php?t=pageview\u0026src=\u0026dv=desktop\u0026r=\u0026_=1783875945967 HTTP/1.1\r\nHost: abrmot.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\npriority: u=5,i\r\nserver-timing: cfExtPri\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u6YhEEPVx%2FsSW6GPv4xllh%2FHMB2XZjfUZJdVQyOe5QGRaqOFh1QqPqVDlruafnhOOSeHt%2Fpg62He0MzacTwMsQFWQ1Sgi5rzJHsg8TkGgvO2%2F3h6PmUgTAKSRAwU\"}]}\r\ncontent-type: image/gif\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a1a277caed5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42,"size_decoded":684,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-07-17T06:40:20.266532Z","times_seen":992881,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kaleda.pro/api/index.php?q=USMKBFVXrosEOeV5wg","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.279Z","timestamp":1783875946279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kaleda.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 13:13:49 GMT","end":"Fri, 09 Oct 2026 14:12:35 GMT"},"fingerprint":{"sha1":"10:BE:4C:0F:C5:FB:A5:90:EC:BA:ED:CF:8A:BA:6F:FE:5C:62:F8:95","sha256":"A9:7B:9A:C4:CA:F0:61:EE:92:A6:AF:69:B9:E1:CF:78:8F:C2:02:0C:D6:2D:16:76:44:2F:16:E2:5F:63:46:37"}}},"request":{"raw":"GET /api/index.php?q=USMKBFVXrosEOeV5wg HTTP/1.1\r\nHost: kaleda.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lr5RIm7AWh%2BO0JfOCajGSgX9TMCbLUcLGNbjuQchHg3JY5LS%2Ff%2Ff%2BUo1f1%2FalHG%2FUkoPx8%2BlDkyub166n2wN32KHooTw9257n83KjR0TJnZmJoN7GeXkJHtEsOzR\"}]}\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1a1a278db6a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":154,"size_decoded":896,"mime_type":"application/json","magic":"JSON text data","md5":"7c485e51b318f53748c75c865a3a61ca","sha1":"dcd874451ce268e1e7164ec9cebdfaf528969404","sha256":"b3371838279b64b304b80f5773b2a71579bd9caefde9b9f37a991bdc9811e9c2","sha512":"0e7f648b419ee24ab48a3fe96ea5de4ed253567418afc8908b48b4e2a47b4ded3ddf34c21fcd573d34b6dce189d6f8ee7cd43fa4e2dd5e3c873139d5959c8dc1","ssdeep":"","tlshash":"07c08ca6bb1aa1d0268b487295ca7100f5b0a1e6359c64a863a5c60a0ecb1a085146a2","first_seen":"2026-07-12T17:06:16.081808Z","last_seen":"2026-07-12T17:06:16.081808Z","times_seen":1,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":0,"dns":82,"connect":15,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kaleda.pro/cf.js?v=2","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.479Z","timestamp":1783875946479,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kaleda.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 13:13:49 GMT","end":"Fri, 09 Oct 2026 14:12:35 GMT"},"fingerprint":{"sha1":"10:BE:4C:0F:C5:FB:A5:90:EC:BA:ED:CF:8A:BA:6F:FE:5C:62:F8:95","sha256":"A9:7B:9A:C4:CA:F0:61:EE:92:A6:AF:69:B9:E1:CF:78:8F:C2:02:0C:D6:2D:16:76:44:2F:16:E2:5F:63:46:37"}}},"request":{"raw":"GET /cf.js?v=2 HTTP/1.1\r\nHost: kaleda.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 23 Jun 2026 17:51:08 GMT\r\netag: \"680bd-654ef6764dabf-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=81HsDk2NFslVbgcunCK8WrB5Fqy4ptb5kMxlUQRs8j5GMaPRKfedllV%2BqycQAdBvI7EE4N1CR8SwzK%2BJEc11J%2Fo2c6wL3cVrBv9my4VMyyc0TeawitQuU%2FKg1txF\"}]}\r\npriority: u=3,i=?0\r\ncontent-type: text/javascript\r\ncf-cache-status: BYPASS\r\ncf-ray: a1a1a2799f8b75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":426173,"size_decoded":265847,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (51534)","md5":"329c73a0ee715e911a82001960c41d33","sha1":"70641931f9fc6d28aaf0d908855cdae21ed36f8e","sha256":"e0039cca62601cae2334cf31e188549a50c79eabb3f99361edd3c0132de05b8a","sha512":"e6c921e71b62751a55bd7495bb76a9801d7b84e5acbfa7031fbbccce32b9297a35215dfdc68940b93217ee722e688bda7e1edabfd8bd8ce982f9b67b0a107ae3","ssdeep":"6144:yXOt8uGgr25Ot8uGgr2QOt8uGgr2HOt8uGgr2pknHco3qD:y+i/grRi/grGi/grXi/grIknHco+","tlshash":"0094d077596f2e1425175c9590092b143cf938abfa00cae4bcdd48a66fe8630dd3eaf4","first_seen":"2026-06-25T03:13:38.179327Z","last_seen":"2026-07-17T05:17:47.361703Z","times_seen":111,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":0,"dns":0,"connect":12,"send":0,"wait":76,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}},{"url":{"schema":"https","addr":"kaleda.pro/api/index.php?q=udm2Beh-3FSikY0M7TA\u0026src=abrmot.pro","fqdn":"kaleda.pro","domain":"kaleda.pro","tld":"pro"},"ip":{"addr":"104.21.55.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.705Z","timestamp":1783875946705,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kaleda.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 13:13:49 GMT","end":"Fri, 09 Oct 2026 14:12:35 GMT"},"fingerprint":{"sha1":"10:BE:4C:0F:C5:FB:A5:90:EC:BA:ED:CF:8A:BA:6F:FE:5C:62:F8:95","sha256":"A9:7B:9A:C4:CA:F0:61:EE:92:A6:AF:69:B9:E1:CF:78:8F:C2:02:0C:D6:2D:16:76:44:2F:16:E2:5F:63:46:37"}}},"request":{"raw":"GET /api/index.php?q=udm2Beh-3FSikY0M7TA\u0026src=abrmot.pro HTTP/1.1\r\nHost: kaleda.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\nx-captcha-mode: 2\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TBB1%2FsJG4Q5sJxgaXrssYoiMtKQUF1GGvWBOMY17VBuEykF%2BFfyC4BNPvb8HMQKZFF5NCyeYhtZpPFiGjk%2FqnMBPWyxAWNnPXxtiJoToq%2FzVJlOdcH6T5T%2BIn0zA\"}]}\r\ncontent-type: text/plain;charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1a1a27aeb8b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194,"size_decoded":944,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"a646f201da698ef8bf5a91bf7a0acfc3","sha1":"7761cd4172f4def34848f7a27a38754807079e49","sha256":"cd7a3e2e4eff38888f06b8c6dc4e4ff2efe473b1a2d3af145e257b3c7fada745","sha512":"fc447fc8066d4422a3eb2cb17ff7851a02c03d51b98023351ed2c2a700426c6e30e5cdc4dc3a46872b31e20fbb02cf239be2a964bf0b9137535675e35068c32e","ssdeep":"","tlshash":"08c022024414a32c67f580429cc18a8140a2969c53892eb0bba9a28a36222fb2124824","first_seen":"2026-07-12T17:06:16.083135Z","last_seen":"2026-07-12T17:06:16.083135Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"kaleda.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"polygon-bor-rpc.publicnode.com/","fqdn":"polygon-bor-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.181Z","timestamp":1783875946181,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon-bor-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\ncontent-type: application/json\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\npriority: u=3,i=?0\r\nx-envoy-upstream-service-time: 3\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: a1a1a277dae932fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":231,"size_decoded":604,"mime_type":"application/json","magic":"JSON text data","md5":"6d4d5c1da6e419a0d3cde4d920ecc5f8","sha1":"36600405768e8f26896739b41bb66d2e85f314f9","sha256":"2e8d72508c65f4df281212a496ceb8c9ccc7c1a120c7a1e07be4e4c2564a9e72","sha512":"8e2cf8b1b63fed81d8990ae0dfabfdff38fe75771eba2dd847ed5904da083fee3359e31690865940dff8fa790a0fe8b7e97f9cd9d45a9a9ba39976c08c152260","ssdeep":"","tlshash":"3bd00299964e8732dc4d5c1de05878412395ba9a4fc41f82558e1a5413c926b571a222","first_seen":"2026-07-12T11:00:26.663864Z","last_seen":"2026-07-13T18:48:06.800243Z","times_seen":10,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":8,"connect":19,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"polygon.gateway.tenderly.co/","fqdn":"polygon.gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.186Z","timestamp":1783875946186,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 15 Jun 2026 18:01:31 GMT","end":"Sun, 13 Sep 2026 18:01:30 GMT"},"fingerprint":{"sha1":"9A:41:E5:34:79:91:EC:A6:18:2C:A5:9B:64:A2:94:81:A0:74:A3:57","sha256":"DD:73:B2:F2:0C:93:E6:AC:22:8B:33:E7:18:12:2F:78:95:14:EF:D9:E1:B3:D5:59:5A:73:0E:1B:07:B3:90:E9"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\ncontent-type: application/json; charset=utf-8\r\nvary: Origin\r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-length: 230\r\nx-envoy-upstream-service-time: 4\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":230,"size_decoded":514,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3cc6261d3c28c3bbcef1946d19f832fc","sha1":"c410f211f0f77bb1385025cb8330f4652c2d3f0e","sha256":"92bdac6903e08f19308e1b72c24a85feca95ac6008a7dcfbe07f75f8e5109ab3","sha512":"560e3347fdca6649e2e283591550b2bf7b7eaae49f0721e66eeae17d57d933401d135a71af4fac7987c034c8b82a166ff2ba21231567751ed17e6287b5c7b142","ssdeep":"","tlshash":"16d022c8820e8332cc0c0c0ce00838002288330a0bc00f02820e020003c822b020a202","first_seen":"2026-07-12T11:00:26.655026Z","last_seen":"2026-07-13T18:48:06.745435Z","times_seen":10,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":56,"connect":14,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gateway.tenderly.co/public/polygon","fqdn":"gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.189Z","timestamp":1783875946189,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 15 Jun 2026 18:01:31 GMT","end":"Sun, 13 Sep 2026 18:01:30 GMT"},"fingerprint":{"sha1":"9A:41:E5:34:79:91:EC:A6:18:2C:A5:9B:64:A2:94:81:A0:74:A3:57","sha256":"DD:73:B2:F2:0C:93:E6:AC:22:8B:33:E7:18:12:2F:78:95:14:EF:D9:E1:B3:D5:59:5A:73:0E:1B:07:B3:90:E9"}}},"request":{"raw":"POST /public/polygon HTTP/1.1\r\nHost: gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://abrmot.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\ncontent-type: application/json; charset=utf-8\r\nvary: Origin\r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-length: 230\r\nx-envoy-upstream-service-time: 4\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":230,"size_decoded":514,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3cc6261d3c28c3bbcef1946d19f832fc","sha1":"c410f211f0f77bb1385025cb8330f4652c2d3f0e","sha256":"92bdac6903e08f19308e1b72c24a85feca95ac6008a7dcfbe07f75f8e5109ab3","sha512":"560e3347fdca6649e2e283591550b2bf7b7eaae49f0721e66eeae17d57d933401d135a71af4fac7987c034c8b82a166ff2ba21231567751ed17e6287b5c7b142","ssdeep":"","tlshash":"16d022c8820e8332cc0c0c0ce00838002288330a0bc00f02820e020003c822b020a202","first_seen":"2026-07-12T11:00:26.655026Z","last_seen":"2026-07-13T18:48:06.745435Z","times_seen":10,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":17,"connect":14,"send":0,"wait":50,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"abrmot.pro/favicon.ico","fqdn":"abrmot.pro","domain":"abrmot.pro","tld":"pro"},"ip":{"addr":"172.67.216.87","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.475Z","timestamp":1783875946475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"abrmot.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Jul 2026 18:37:58 GMT","end":"Tue, 06 Oct 2026 19:35:43 GMT"},"fingerprint":{"sha1":"C5:4B:74:23:46:B9:71:EB:53:82:4C:F6:2B:67:46:26:20:D6:C8:4D","sha256":"7C:7B:14:37:E6:A2:D8:29:BD:2E:CE:E3:F9:F3:AA:D5:DC:66:78:CB:07:AA:7F:A6:08:1F:14:82:15:42:CB:66"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: abrmot.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ecfbdPfNYXwk5QM6mMSEu0yVm8Se8mVuKqszuGiDgyQViy1zwjqq2aAYCbmhL5L9gyb8EtG2MThZW3Kk2ipEFTlKVdQ8LptGCIuuZLnS6uq4gjjhIHyRDI43d4Xe\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\ncf-ray: a1a1a2797b435a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":272,"size_decoded":825,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"943bba2e73ac502ad6a676298f633dfc","sha1":"4767ed9913f54e5346d5b389226aeda46ec7eeeb","sha256":"1474c682d53ed9b658bf87ee90589bbcf5c323e17a860be9e1f796cfe46eaf57","sha512":"4d4a388e7e7fe687bbff253d913b52774ef80781c2b9870f9b6cf498a4b6b0c64a127528e617fed7f5d4a03d1a168fcff0decd470b2c0c8df9207a21ed478b54","ssdeep":"","tlshash":"4cd02bee90536387481224a039c515c2264d13faa47a51e82dc6d48752a853ecd9a98c","first_seen":"2026-07-09T12:20:01.451251Z","last_seen":"2026-07-12T17:06:16.084523Z","times_seen":3,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"abrmot.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/9/94/Cloudflare_Logo.png","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.707Z","timestamp":1783875946707,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Jun 2026 05:24:58 GMT","end":"Thu, 10 Sep 2026 05:24:57 GMT"},"fingerprint":{"sha1":"5B:35:4A:25:C6:4D:17:23:8B:63:A3:F7:CE:52:1B:B7:22:06:BF:1B","sha256":"FE:D1:85:EF:B6:D0:7E:42:4F:F4:62:C9:8C:A3:BA:2C:88:5E:47:EB:9A:03:3D:30:4B:E3:63:FF:11:AD:F6:0D"}}},"request":{"raw":"GET /wikipedia/commons/9/94/Cloudflare_Logo.png HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/png\r\nx-object-meta-sha1base36: tqzc3404i3b6qqllzyx20sg0c8awofx\r\nlast-modified: Thu, 25 Nov 2021 22:52:08 GMT\r\ncontent-length: 63290\r\ndate: Sun, 12 Jul 2026 00:01:29 GMT\r\nx-ratelimit-limit: 10000, 10000;w=1\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1\r\nserver: envoy\r\netag: 05982e81981f0f4d317c59d3008727fc\r\nage: 61457\r\naccept-ranges: bytes\r\nx-cache: cp3077 hit, cp3077 hit/93\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3077\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 195.64.118.152\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\ncontent-security-policy-report-only: default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1\u0026source=image\u0026action=cspreport\u0026format=json\u0026\r\nx-content-security-policy-report-only: default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1\u0026source=image\u0026action=cspreport\u0026format=json\u0026\r\nset-cookie: WMF-Uniq=WXw5od3Iwv-Oi7K7sO6GWQObAAAAAFvdNQMlqRTgE8of1S-eHlaW2djNTieCpZpS;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Mon, 12 Jul 2027 00:00:00 GMT\r\nx-request-id: a29a0d5b-fa2e-4c17-8ed9-d7c6bf54a7c1\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":63290,"size_decoded":65380,"mime_type":"image/png","magic":"PNG image data, 1368 x 1368, 8-bit/color RGBA, non-interlaced","md5":"05982e81981f0f4d317c59d3008727fc","sha1":"feae211bf6d65d064a33c7a87d46ee0b7c616dbd","sha256":"c3916862cfead3af678d0fe7cfcc90cdf69713c1d95bdb988320ffba20a57f0e","sha512":"3c7372405356ad6835968c2c227614a45cc3bc2f7296ff7dd8db5b979babb119aded114cb97a3a55774e05754ae22c7a2df03ce1eb71b65cb6261059388dced1","ssdeep":"768:k2L/oWPZzSgt4YwA0GUHz+sCoFEjzPQYclFK0flKkVFHoJfs/Ryo:km/LPc0wA07HZFEHPQYCFK14HoJq","tlshash":"9353be4acb59227bb5510019b7a3689398b12c733001de1e5bc7b46f5b07fb0ee72d92","first_seen":"2025-03-07T13:54:30.635821Z","last_seen":"2026-07-17T05:17:47.312345Z","times_seen":611,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":2,"connect":18,"send":0,"wait":24,"receive":34,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.cloudflare.com/favicon.ico","fqdn":"www.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.16.123.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://abrmot.pro/","date":"2026-07-12T17:05:46.714Z","timestamp":1783875946714,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cloudflare.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 07:46:57 GMT","end":"Sun, 04 Oct 2026 07:46:56 GMT"},"fingerprint":{"sha1":"A4:E2:5F:9E:E3:C0:F8:76:AB:24:8B:CC:AB:DA:1F:89:73:C5:6D:49","sha256":"93:FE:26:76:DB:80:14:0A:65:60:25:2D:85:7E:E9:E9:55:80:9D:DC:A3:84:E9:14:66:4F:E5:58:93:2C:F2:63"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://abrmot.pro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 17:05:46 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nlink: \u003c/.well-known/agents.json\u003e; rel=\"api-catalog\", \u003c/.well-known/webmcp.json\u003e; rel=\"service-desc\", \u003c/openapi.json\u003e; rel=\"service-desc\", \u003c/llms.txt\u003e; rel=\"service-doc\", \u003c/sitemap.xml\u003e; rel=\"sitemap\"\r\ncf-cache-status: HIT\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-placement: local-OSL\r\nx-served-by: marketing-site\r\ncontent-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://challenges.cloudflare.com https://*.onetrust.com https://cdn.cookielaw.org https://ot.www.cloudflare.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://adservice.google.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://platform.twitter.com https://static.ads-twitter.com https://scripts.demandbase.com https://tag.demandbase.com https://*.6sc.co https://*.qualified.com https://snap.licdn.com https://bat.bing.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.doubleclick.net https://www.googleadservices.com https://translate.googleapis.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://ads-twitter.com https://analytics.twitter.com https://*.twimg.com https://api.demandbase.com https://scripts.demandbase.com https://tag.demandbase.com https://tag-logger.demandbase.com https://api.company-target.com https://*.6sc.co https://epsilon.6sense.com https://*.qualified.com wss://*.qualified.com https://*.ads.linkedin.com https://www.linkedin.com https://bat.bing.com https:; frame-src https://*.adsrvr.org https://*.cloudflare.com https://*.videodelivery.net https://*.cloudflarestream.com https://www.googletagmanager.com https://*.qualified.com https://td.doubleclick.net https://bid.g.doubleclick.net https://9309168.fls.doubleclick.net https://9973066.fls.doubleclick.net https://s.company-target.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; worker-src 'self' blob:; child-src 'self' blob:; upgrade-insecure-requests\r\ncross-origin-opener-policy: unsafe-none\r\ncross-origin-resource-policy: cross-origin\r\npermissions-policy: geolocation=(), camera=(), microphone=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nset-cookie: __cf_bm=p5f74KYwgIapXNuowr.LSYREOK8YfkninUwLSeHbE0M-1783875946.8632631-1.0.1.1-rZxF1oTXIqMKHsFoDuSgw.nm7ibY5X90sAZ86zT4SebSQq6EUQLRJfsx4peT0iINuj5Ffo85fiCNFf6_XLKOyv.J3CmgHaXFNu.S609kZ0AZ1IVARZTd0f1XVnzqf7XfLoSOojy.qpNgxUoHqZudYA; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.cloudflare.com; Expires=Sun, 12 Jul 2026 17:35:46 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N%2BBCEPjrEce8Aiv6LecVfBWam007SH2CBkUbISndMfT8curAY3me5tyc502e2FZxs16WRlfeVfR12tCGS5AyIxtBNtT2%2BzbJ55%2FpZmpDOpdr%2BYJ3SUhjR9o7X%2FPFxm3be88S1A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"d8b839e4b38223847e40cfad151520d4\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a1a1a27bee1c56c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":908,"size_decoded":4552,"mime_type":"image/png","magic":"PNG image data, 99 x 96, 8-bit colormap, non-interlaced","md5":"f4d4f7e79fd34e08e729580664e75720","sha1":"f11081ef88c0de4ed6b5cc52e54ca12ac6eb1ad9","sha256":"5414bc6e4b3f6e10f99b5d37abf4420da4dcaece66f8f2c08e090e87267adbc5","sha512":"e4be9eee8a947f6cf111bfaa0e60a901a9e2469632b030faa4bbbac835f0cc5de133f934d954335cb9c9919c6bda30c7bd6e2df5532d840b34a4be597bd69145","ssdeep":"","tlshash":"0511b73a70aefde52bef791a56e32e8a6d1b003454840330e3425736c1468594299362","first_seen":"2025-10-16T21:46:37.126967Z","last_seen":"2026-07-17T06:00:36.24504Z","times_seen":11695,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":24,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}