{"report_id":"b7df9ef0-f042-4b99-bfe1-b2253f9b1c97","version":6,"status":"done","tags":[],"date":"2026-02-06T21:50:06Z","url":{"schema":"https","addr":"www.delvin.top/","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"172.67.157.243","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.delvin.top/","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"title":"Web","dom":{"size":1245,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"6e3142243943551788e1ada2030ecbd3","sha1":"1eeeb835d9a30481a774725e13d92d1292e3f0dd","sha256":"dae08090aac0091e50d96583a49542aafcdcf47ec944a15276e62d63b0939983","sha512":"76a46158efcd1f1864a09ee1474a672fc2d1140e6fb476259f12a6bd6466217a10cf093504876dc821e8934526a531323c69c48ca00f60f047cb091d1e1ace9b","ssdeep":"","tlshash":"e7210262ccaa844d2601465becf8f14c5849e50b465de464b1ed92698f4cf6c6483ccc","dom_hash":"domhash9a8afdbf5db0df965eedc81feb34f04a","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.delvin.top/","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"172.67.157.243","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-13T21:50:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.delvin.top","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-21","domain_rank":0,"first_seen":"2026-02-06T21:14:28.619451Z","last_seen":"2026-02-06T21:14:28.619451Z","alert_count":62,"request_count":29,"received_data":2136535,"sent_data":13219,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.delvin.top/main.ad7daceb20639047fac9.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f7d4e06593990c823aa5d13eae61ea7","sha1":"56c68e60b5703639d4c5b5bce7b76cc37599ad4c","sha256":"1c505f3756d49aec170693e165e31e63243d293c555c98ed45550a1cee175eb6","sha512":"b1ffdb361d430c91ec55f0ea9ed893657e3306835e33ca7ec5316971c38f7ee1dfb483dd922c787b32041b166c49577bc18fce8323fbce1d119e5189cefb5e84","ssdeep":"6144:ENMlkD/FR21KG8U+fpB/mcjEr7SjIpRFjodyIcAmhTCZGfnjrDPIPXvNijY0:CF0hyKLYI2U9","tlshash":"7915634672f231394207f0795a5fcd1972356a0b2a88ec593a4ca2511f8a57cebf6fcc","size":933743,"data":"","first_seen":"2026-02-06T21:14:32.523884Z","last_seen":"2026-02-06T21:50:08.787116Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/6708.3f91e6e80ce12129988d.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cb3499e04194c102a58ed4edfe17402","sha1":"a8f4fdbde9e3519ba5b6cb861bbecef064a7784a","sha256":"69d0fcea5d2dfea7462f348ce2fdb7556deb739890017b3a9d8c61e74ae50aa9","sha512":"147f233a3a236da4cb8bc7740eecf108e14d4316c01f22850a50e2ba9150395c9bab533c28bed7908d9f50c10f2d8686edd280904c37c230ad50ea43843a00bc","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ1W:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ1W","tlshash":"8312da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","size":9237,"data":"","first_seen":"2025-08-09T12:19:04.058547Z","last_seen":"2026-07-16T16:02:47.632323Z","times_seen":149,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/redirect.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec76222a8819f832db2b6118009a4a05","sha1":"a8511f24d70dbce79c13328c37978020fd965a21","sha256":"6f3959dab38e9bf746766df4a88de6b3a20f7474967eb72e42193a7d907fb888","sha512":"7f4b7b460d26a183306512c8f028947946f67e2e082a93e573de9b024c02e0660e811581c68bbe1ed03c66f194fc395f11d9d3d4999555f229734c01ddf94c54","ssdeep":"","tlshash":"cf1184a0a3b61fed4d770201ec39ec08c8f91de64bcf90efa5077d80c9a66ea17a1115","size":897,"data":"","first_seen":"2026-02-06T21:14:32.523047Z","last_seen":"2026-02-06T21:50:08.790681Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/compatTest.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc3f7d6c16c0ef2ec751a07d988adf00","sha1":"c436b5545e399e134db128c7a4c5a79ab8e0a764","sha256":"1523da3e142ca6521f32cb8ca159f99c49b7891463abecd70948b3b61d267735","sha512":"2a81050a60eefb852c7dacb05613b9e905d0f8ce72ce26589c9344393e170005e56ece07c2d2f47117dec2c9b763e4e79dc7de367d0f61a47fdc3c7ae3a2788d","ssdeep":"96:EzYIOVIrXLImCzkpRMCI1IPt2zJ4zi3I6IpzI7IPtN5q3hoWa/YKfT3jYf:mYIsIzLI9UM1I1kImI6I56Iz5q3hoW6+","tlshash":"72a15df953a15fbd8d338b04ee396d48dcf815a107cbd04ab6037d08cab9ad653a1365","size":4793,"data":"","first_seen":"2026-02-06T21:14:32.522329Z","last_seen":"2026-02-06T21:50:08.791332Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.delvin.top/notification.mp3","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /notification.mp3 HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 10880\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:56 GMT\r\npriority: u=4,i=?0\r\netag: \"68d997b8-2a80\"\r\nage: 2137\r\ncontent-range: bytes 0-10879/10880\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MAlFbVq1Hjga9JoyXGrS4%2FHZiX8C9guugvZbgn2hNIRw8ipIe5e28fezm0tkZWNZ5%2FltkEJ7kxpw2sOBg%2B6W%2BerCrGaZmT6oMsvl1Wz9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddbf0f981a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"eba09b6a457792c52fc610b5f9f974b3","sha1":"95e6e0f7648e28ea21bc434054ea59aba3a35aea","sha256":"86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6","sha512":"9dfc5ff830c9ed75c9923528c31e1361fa36500d76a209cd475984e5585a644c8aff1600bf02a658ef363436a51988ff1e63aa7606e541dc4a7b3449c5be4852","ssdeep":"192:RuQQeX7rYX/WUUIk8DLh+2BHpZqlXCYP69tuORf6tVQRa/nwNQBv5JC:RRYeUUEDLk2VClyaV0aZ5g","tlshash":"37226b18af11056ef4866bf0b3939b8dc42d26c37a26d4cdd3a5d7e369430e2a7d500d","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-07-20T07:32:01.962629Z","times_seen":16875,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9443.9a77810d7ca6ba92249a.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:47.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2137\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xXPZWsDFIIyLZcN92iTV%2FV27AVtHBJfkQuruKzRhE3vH0YW3hKTXWwp%2Bd2wa%2FOr5dupUR3pxojGSoQwqraHk8pUYvAKB0MD7QLCmPrZZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03bdf7a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/7784.2a486dcaaaf47415a095.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-5268\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2136\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5jE7F%2Bx5ERz8AqNjx0VVKHfVEmYXA80ycbeSrpfk96u4YcLnPiv9h%2FdGaNQhjPlPUASgz7DfDAHEt%2BWVz3TlVL84%2F3PMRtTU22U9Ugcq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03de17a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/5905.04b286b6eff2126d05dc.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"68d997ac-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:14:11 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2135\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OI1xCZVJJLJIgDgW0dmu6LrO02voXUL1Rpo6xXA5shtaTdvw5go5BnEW842m4YyctHtsc%2FEU0yCNoSzI7YlZ27y7oAElEGMSSxPgN2iW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc040e3aa41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/main.ad7daceb20639047fac9.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /main.ad7daceb20639047fac9.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 21 Jan 2026 03:58:53 GMT\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: \"69704efd-e3f76\"\r\nexpires: Sat, 07 Feb 2026 09:14:05 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2138\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DTQan8Je4HCO5K1AzEyyHmSKu4GWu0L2YfUa5dmbyIt7cB3MGjYY9hka%2BUDxevC4WJUOn1kVTx2body7PSNoTxKELYQdY6m7E3ADYxcl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddbef7887a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":933750,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (679)","md5":"1f7d4e06593990c823aa5d13eae61ea7","sha1":"56c68e60b5703639d4c5b5bce7b76cc37599ad4c","sha256":"1c505f3756d49aec170693e165e31e63243d293c555c98ed45550a1cee175eb6","sha512":"b1ffdb361d430c91ec55f0ea9ed893657e3306835e33ca7ec5316971c38f7ee1dfb483dd922c787b32041b166c49577bc18fce8323fbce1d119e5189cefb5e84","ssdeep":"6144:ENMlkD/FR21KG8U+fpB/mcjEr7SjIpRFjodyIcAmhTCZGfnjrDPIPXvNijY0:CF0hyKLYI2U9","tlshash":"7915634672f231394207f0795a5fcd1972356a0b2a88ec593a4ca2511f8a57cebf6fcc","first_seen":"2026-02-06T21:14:32.523884Z","last_seen":"2026-02-06T21:50:08.787116Z","times_seen":2,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/main.c2527ac16c33f0e1edc5.css","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /main.c2527ac16c33f0e1edc5.css HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-1c066\"\r\nexpires: Sat, 07 Feb 2026 09:14:05 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2138\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1cTdlSVBvClx4FNYV13diy3ICEe48SrVGvq0GU%2BX7pXEtr%2F5lcwSvlvwbaiixHJs3ySdwJeHJ7z0XpgGKtfu2Mv0bBSQlYpWT%2BGeA7HL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddbef7888a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":114790,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11610)","md5":"0caeaf459d1ed0b33c615cb5f14dca86","sha1":"40c6cd3e41d49b6b46a56acf4b241b6bec99ab52","sha256":"32851da5b1124845db6cfc9b9fddfbc554cb4568d0b86b22c4ecd46b127c6927","sha512":"d72790a9068072d03a4436f188a42a334b976fc9dff29b04762830ad889915a9e9279341ea55229d9fa8a910fdbf46975a3e488f3bd2a7e025053c1d3a77254d","ssdeep":"768:w10Q9RiIfAm3lPrChnv3XrscbqasUgkndLoo9+b6UbdWAkcI5/ydO8QtfEEV+p2z:IPRiSArscbxsUgknK7WF5oYfNT","tlshash":"fbb3d8a4e98411f9ab23c23e97c4d76c9d38e481dd210fafb617615c07ca3eb12d2b59","first_seen":"2025-10-04T18:18:13.142524Z","last_seen":"2026-07-16T16:02:47.628214Z","times_seen":121,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/7784.2a486dcaaaf47415a095.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-5268\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2136\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cI1U44BPwG0Ez9VbAJynP4MV4W2GHBqxqOdPTgHqVU6YQWGmQXWlGcMk7sr3Xrk5T4mwFPiMQFaopCN8wIKmWoUA1Xac53PFUW836nnB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03de19a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/5905.04b286b6eff2126d05dc.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"68d997ac-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:14:11 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2135\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WBPGzzJeIuxc48PEvijWVX%2BAPzxgMWDGv5U1ZcZBGrA1pbjTH4sC3BC9ilfLYCIvpL5J%2Bkz3exoFPOTZOrSKGDGLc73Rmv8WcgMlfrfl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03fe35a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:14:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BvGTmicYYyoQFYDkNQoI3B%2B9pkInqXxgMXhQB5cX9Qr1GqdCg4kneQqtTtY5F81r7OSbQc66qI3m0ZD9gIV%2FX1zp%2BrNwRq09L0ymUnQY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc042e53a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.553Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:14:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c%2BToSTqE0jC0pxHvoOVTknHzWE8MEDX8WlCswcsud31F8E8POX92K0NX1%2FfzazDYOsiHbn5m1OVr8R5x2wkT1Ad9Li5fWLAGxn3ojOVd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc043e55a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-10037\"\r\nexpires: Sat, 07 Feb 2026 09:14:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BoyUd7X1rHQ1DVZHjbeQXKEswd4zQurtEp0YQxShWM0oeEpIJzOX6%2F410DRoPJgLSEB%2Br0wQFciEsazjwXRxoh8r24UjCasQj8E9CyA7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc045e75a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-07-20T07:32:01.738233Z","times_seen":15237,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9443.9a77810d7ca6ba92249a.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:47.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2137\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5zSzMUREWtA1RmpRm0ssCblPBbzmXI2x0Vhi2xay25P%2B9oy%2B2ThJKgL8ch0DjuDdN7QbvCeBtqFQ%2FpR6oc5g313ByvYAAkIJ%2FJr1%2FK1k\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03bdfba41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/7784.2a486dcaaaf47415a095.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-5268\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2136\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R%2B2P%2B%2B4w%2B4hXrn%2F2NroHyd7y91Z7NzYeO9fVKzKwyJAd%2BZ%2BdayvWNuhLtHc9m6MG3HX8fdnrrDMJSz5FtX1i1FGnKxEYLJVzubKpr%2B1Z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03de1aa41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:14:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Psp1ukvBOwT7x6qCJG%2FCdv%2F%2FPsHFLHfsldOXqW9OAwakhgLzKCluJXuHGjdKW16wfkASpnT%2FOtsdYr3w9KFrfPOtkaXF75HxXeXEEFvT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc042e51a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T21:49:43.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Thu, 29 Jan 2026 15:01:21 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lPSc05C0A%2BB8toyj2P55qR8k9sy05VmxGfaEWr%2B2eYQQi5VknJS6TkmfXAVvPxlYtxZbsQcokB1M%2BA80gXNvqpCAaQH8qN7ge9A0pg%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=15552000; preload\r\ncontent-encoding: br\r\ncf-ray: 9c9ddbea0e865684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1200,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"4938bede0097400f5202ef2a744f231d","sha1":"6dfb4145c610e2b3d8a04a0bd6c425a5a27de039","sha256":"e68ad3e4b2fc9fb2b812c46a15caca19a3d1c142e392053c0c9aa8073126cbb3","sha512":"9140462ab39930d59007ed3815f0c359bec241b2e11b20de301c8631fb717fd167be75005c3892090461c6d31803b0f999b9506a0686ec084df17668da30f74c","ssdeep":"","tlshash":"6d2114a2cca9844d17104a4bedf8f18c584aea0f555de464b1dd82698f48f6c6483ccc","first_seen":"2026-02-06T21:14:32.521523Z","last_seen":"2026-02-06T21:50:08.789443Z","times_seen":2,"resource_available":false,"data":null}},"time_used":744,"timings":{"blocked":39,"dns":21,"connect":1,"send":0,"wait":660,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9443.9a77810d7ca6ba92249a.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:47.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2137\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8k%2BT0eiNyxTMCO6arHf0Gu8MsY8E4gEbEeHeifPiUnH%2B02Ydvv%2BaygWqM6m3T54X9B8zGTXShcmO7EUYfaniAjlcnQ86s6Xr6bpS44P6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03bdf8a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/7784.2a486dcaaaf47415a095.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-5268\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2136\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3FMhkiRBvA4ckOzlZ0fcp1pq7yMYH5qyfLHGH0MOekJQecyfqkH%2F9NtvVcgyX50OmTpISLxecI5%2BMoAsfTUZDAWjW1DS%2B2l8pr3Nvv8v\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03ee26a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/main.c2527ac16c33f0e1edc5.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11016\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\netag: \"68d997ac-2b08\"\r\naccept-ranges: bytes\r\nage: 2137\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vnSQsm6QCwZpZqsCrVGW4ZzD9KI0HZbgtbE%2FRgnR7Gzipd0pVz8rIwdjSIBFVb5OPL1FXl7s4ZCJ4Ynems2EAUiljsHixkAooHO%2FFJMc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddbf0b95ca41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11016,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-07-21T14:12:09.880412Z","times_seen":34402,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9443.9a77810d7ca6ba92249a.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:47.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9443.9a77810d7ca6ba92249a.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:14:10 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2137\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Pu080lDgTq6yGkiyNmc7OQg00r%2BnbDVDXHno0eguwxQ6I9X00uBcW928v1KVA7FVAUPGhTpR5YuVeFbuIPfxu76xLmp92zJqkbSZCuEA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03adf1a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"9c29f3f04c16101bfa13d5a5d3e3a997","sha1":"90bda938fea9303f9c4cbefc18302e614dd42af8","sha256":"76a752f6af267f22dc567f726903203fd05150564d26395e0ae019b5946b1a57","sha512":"de0ccea43468c328299e8edc1445a8e58178c943835a83a911503641055ccd8fcc7025d9535dd9bf6faa4d1984430a39aff34b03b4a10b60c923dfe25561c2f5","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBEST:oivU8g35HilXzTRd0UxwoEhZzAXCEm4Q","tlshash":"333207c12351653ee38b98d9d87a04036130da5c781985687b2e6edb3c2bdc5f1b1f71","first_seen":"2025-10-04T18:18:13.146653Z","last_seen":"2026-07-16T16:02:47.583167Z","times_seen":137,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/5905.04b286b6eff2126d05dc.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"68d997ac-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:14:11 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2135\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LFkYaRS9zLLkdCSrlPBdGN0zYs5rccs2Uo7SBCVv3UmmGqqUEQoPxJ4X12DonALOBBdZPlbtBbkeVLaICzgVrz3cBfbzB%2BLsMuVxSeEK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc03fe38a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-10037\"\r\nexpires: Sat, 07 Feb 2026 09:14:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9OPDoap7hYD%2B%2BvR0PqfgRk7wNiORPBaClRdff6MLwlQ%2BSuvMATViv2Y9YFwz1XB4EzAWidvd9ikhMbNclLqELFFtuvFiuy%2Bi2p7zPdAg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc045e76a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-07-20T07:32:01.738233Z","times_seen":15237,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/redirect.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 01 Feb 2026 07:28:42 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Sat, 07 Feb 2026 09:14:05 GMT\r\ncache-control: max-age=43200\r\nage: 2138\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fgbIHiYL95whfknDQNV9d6zWYH%2FUMlLPH3k7u0fa8%2FnbiITHIIXCuATLxU7raNnaHcmi%2FCF6kW3Pg1USlXNNEOhOuWy9hx75Qj8AAMz8\"}]}\r\netag: W/\"697f00aa-381\"\r\ncontent-encoding: br\r\ncf-ray: 9c9ddbef7886a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":897,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (896)","md5":"ec76222a8819f832db2b6118009a4a05","sha1":"a8511f24d70dbce79c13328c37978020fd965a21","sha256":"6f3959dab38e9bf746766df4a88de6b3a20f7474967eb72e42193a7d907fb888","sha512":"7f4b7b460d26a183306512c8f028947946f67e2e082a93e573de9b024c02e0660e811581c68bbe1ed03c66f194fc395f11d9d3d4999555f229734c01ddf94c54","ssdeep":"","tlshash":"cf1184a0a3b61fed4d770201ec39ec08c8f91de64bcf90efa5077d80c9a66ea17a1115","first_seen":"2026-02-06T21:14:32.523047Z","last_seen":"2026-02-06T21:50:08.790681Z","times_seen":2,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/compatTest.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /compatTest.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 01 Feb 2026 07:28:51 GMT\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: \"697f00b3-12b9\"\r\nexpires: Sat, 07 Feb 2026 09:14:05 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2138\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y5JwWNXZl97cwKL0kFESPuMh4g1rMu3SS7rNYrtSOL1pPxZfzkglF6iphFgmwJH8c6AZuEV8YeKvtcGJfD3%2B5RFk2zvsoAbqv9uiQdM7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddbef7889a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4793,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4793), with no line terminators","md5":"cc3f7d6c16c0ef2ec751a07d988adf00","sha1":"c436b5545e399e134db128c7a4c5a79ab8e0a764","sha256":"1523da3e142ca6521f32cb8ca159f99c49b7891463abecd70948b3b61d267735","sha512":"2a81050a60eefb852c7dacb05613b9e905d0f8ce72ce26589c9344393e170005e56ece07c2d2f47117dec2c9b763e4e79dc7de367d0f61a47fdc3c7ae3a2788d","ssdeep":"96:EzYIOVIrXLImCzkpRMCI1IPt2zJ4zi3I6IpzI7IPtN5q3hoWa/YKfT3jYf:mYIsIzLI9UM1I1kImI6I56Iz5q3hoW6+","tlshash":"72a15df953a15fbd8d338b04ee396d48dcf815a107cbd04ab6037d08cab9ad653a1365","first_seen":"2026-02-06T21:14:32.522329Z","last_seen":"2026-02-06T21:50:08.791332Z","times_seen":2,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/6708.3f91e6e80ce12129988d.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:47.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /6708.3f91e6e80ce12129988d.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-2415\"\r\nexpires: Sat, 07 Feb 2026 09:14:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2137\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=718FCB4MGegw1kzw%2FDbJkWvsWe1jaC446hmcAZepp3Klqs8xGOpxVghD8tbagefsYLb7MFheaOgOVis1GNj7bonitqeYEEoYDMqhs6ti\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc038de4a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9237,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9183)","md5":"2cb3499e04194c102a58ed4edfe17402","sha1":"a8f4fdbde9e3519ba5b6cb861bbecef064a7784a","sha256":"69d0fcea5d2dfea7462f348ce2fdb7556deb739890017b3a9d8c61e74ae50aa9","sha512":"147f233a3a236da4cb8bc7740eecf108e14d4316c01f22850a50e2ba9150395c9bab533c28bed7908d9f50c10f2d8686edd280904c37c230ad50ea43843a00bc","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ1W:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ1W","tlshash":"8312da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","first_seen":"2025-08-09T12:19:04.058547Z","last_seen":"2026-07-16T16:02:47.632323Z","times_seen":149,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/5905.04b286b6eff2126d05dc.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"68d997ac-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:14:11 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2135\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IEWzpY1sr4Px1xcV8WCt87vgL4kNzGdoZxJphMvRFeTEnFXJVk7BfVAGdQLW4BIiRQhI9bGIC5r6elxqrAN3DAs39NjnIyypeN2ynOjV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc040e3fa41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/9357.bcd54ffd1e0423615e1f.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /9357.bcd54ffd1e0423615e1f.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:14:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ri4NusTZxse5uZQSUDX5bQq8ohZ6CPQCRGH7DqeHGPR0mFCJ9NAuqo3qvho5N9LOW3KnMgVMjwe93EKKv2ZPA%2Bbzn7YdgFrvY6JrU2bf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc043e56a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"746dc7489995aa53513e584f8991b97d","sha1":"d39086a8a5558a6ccc48109a721e2e4235bf0c8e","sha256":"6ada3e8fc5ac04dc859300cc676e1e325f1ad0118ab36d77e5f2f95a44c51957","sha512":"15781549f71c72ec72044be6abcd4a79a204cf27d138ce5eac213cdf8ae15ea6814a8836a9c6da27765e100d16af63af0341d9531d7428f5219858627de0ed9b","ssdeep":"","tlshash":"5b51ba445a7238795cf386abb09b3b120c6513713819e5421619deaf46b728f5f13f49","first_seen":"2025-10-04T18:18:13.128991Z","last_seen":"2026-07-16T16:02:47.580992Z","times_seen":133,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-10037\"\r\nexpires: Sat, 07 Feb 2026 09:14:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U9f9Q4V9UU6%2BzGwHN%2F7nIO5jBxAW%2FShhY%2FiU%2Fy6z1OrafSgTEuZ2my7L3TGCsKqCHoQp4pIKwDH%2FX4A%2BLYIQpN5Ku3nHGg%2FvKFu0hjUa\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc045e71a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-07-20T07:32:01.738233Z","times_seen":15237,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.delvin.top/9443.9a77810d7ca6ba92249a.js","date":"2026-02-06T21:49:47.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/9443.9a77810d7ca6ba92249a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:47 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:44 GMT\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"68d997ac-10037\"\r\nexpires: Sat, 07 Feb 2026 09:14:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 2134\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qfais5L4a%2FLt%2FsVVwBWbt6T%2BQOYk%2Fc6gEpGO1zT69s%2FfHWhV8C%2BITumQqu0K651UYySIHhOvQDFAUPRwfIeDeC2xahcJraFoQ%2FX2zTH5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9ddc045e77a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-07-20T07:32:01.738233Z","times_seen":15237,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"www.delvin.top/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.delvin.top/favicon.ico","fqdn":"www.delvin.top","domain":"delvin.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.delvin.top/","date":"2026-02-06T21:49:44.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"delvin.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 04:57:51 GMT","end":"Thu, 19 Mar 2026 05:54:22 GMT"},"fingerprint":{"sha1":"BE:4C:14:D0:B7:96:3C:C7:14:24:C5:71:03:A2:1A:03:BB:AA:67:83","sha256":"8F:3D:4B:32:F3:E6:38:44:54:BF:71:25:BB:62:97:D6:51:86:BB:67:16:BB:ED:A2:1F:91:24:C1:B9:A6:FC:BD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.delvin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.delvin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:49:44 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Sun, 28 Sep 2025 20:16:56 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 2137\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bBTP%2BwF11qbBjiWsJJZHXUzo8guTghixBcxSa1HsHiyZlQez02fmiS0WYzbAOyYGQMTTyP4qcCCw5m9msjXFaOW8q3a9%2BQXuCJkmp5VX\"}]}\r\netag: W/\"68d997b8-969\"\r\ncontent-encoding: br\r\ncf-ray: 9c9ddbf0e977a41f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2409,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 48x48 with \n- PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"1635ed0e8715c40d4bed875b7494a93a","sha1":"ca2c72821b30194b9b6daf9c8c0ce1723fe54614","sha256":"504b4621e486970f8c1721d5297561c9f33296f516c83fbb33a0ff3f4f7c1357","sha512":"f710268687fcd3da9bd9ffee9cbf166d21598cab5ff1172c510fd478f57300af7112f35132ba345a2242b65ff53cde9de6ebf0f1ea8cf7f5fce17c832a5a85d8","ssdeep":"","tlshash":"9c413ae3663eb676c5f6a6660c4f01002c1f80d4759aab3c364ae0f68c4316a0ae4a23","first_seen":"2023-06-20T23:38:38Z","last_seen":"2026-07-21T12:41:58.693031Z","times_seen":2817,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.delvin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.delvin.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}