{"report_id":"c205f37b-9550-469e-8da7-64e1e7da2ae5","version":6,"status":"done","tags":[],"date":"2026-03-16T14:28:29Z","url":{"schema":"http","addr":"coinbase.wlsp.shop","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":0,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/#/","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"title":"Index - OKX","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T18:56:41.252218Z","times_seen":17841592,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"coinbase.wlsp.shop","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":0,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-20T14:28:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"coinbase.wlsp.shop","ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"domain_registered":"2025-03-29","domain_rank":0,"first_seen":"2026-03-16T14:28:33.653596Z","last_seen":"2026-03-16T14:28:33.653596Z","alert_count":56,"request_count":56,"received_data":6464453,"sent_data":39490,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Alibaba Cloud CDN","description":"Alibaba Cloud CDN is a global network of servers designed to deliver high-performance, low-latency content to users around the world. It is a cloud-based service provided by Alibaba Cloud, a subsidiary of the Alibaba Group, that enables businesses to accelerate the delivery of their web content, including images, videos, and static files, to end-users.","website":"https://www.alibabacloud.com/product/content-delivery-network","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"at.alicdn.com","ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"domain_registered":"2008-06-25","domain_rank":96084,"first_seen":"2013-11-28T05:03:29Z","last_seen":"2026-03-11T17:35:51.720288Z","alert_count":0,"request_count":3,"received_data":296371,"sent_data":1332,"comment":"","tags":null,"fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/charting_library/charting_library.min.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8cd63cddf0ab72e873d68a2d68ca336","sha1":"2d0b483c39ea41187d9fcb8200bb2819525dbd3b","sha256":"6571ad1a4bb68aacbd4c3a78fc0c26f9c1f1bb34a92164ea3fac2b4532acf88e","sha512":"f3956ab3268f27911de0789fa0858de98e26bcd2736544a6694a225aa61ab5b8ceff26774af62bad71294531d75e4faa198f44ee85a5731ffb26480940f4144d","ssdeep":"192:S4DF7XcEbRi1H0FEKyhWbviztF89xo/g81Qit+0idiiV8M5MSBj5JCWotPSXmYRB:fhoEbizXAoINoWoxSXmBEU3OHQI","tlshash":"18320054df6c2c3205c720fc8d7f288f513de276e895449e388491dc59ed44bbaaba39","size":11663,"data":"","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.273347Z","times_seen":262,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/js/chunk-vendors.794b6ccd.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f84cb9d43662c69cc0b4ffae22886d18","sha1":"5300d69f6506de9a330bad550234a8f4f9d64241","sha256":"2cfbf48f4400ab9817f1439b0a8c6280d30f3fe2276573c3b31f9e3ece44937a","sha512":"d581c8d6cd5b4bbfd7a9605c2e5893ae1ba6d7ad533075a856e5cc46502a250467cfc0e9222a19304d0a08f4dc004b374619fbaeb5090c7c4332776c118a20f2","ssdeep":"24576:jwmCaBpSMMhtMUj0h4vVBs3XX4TVEo6DvXsVgh5CHRw/ffWI:XCaBjMhtMUj0h4v0n4pZ6DvJh5CxqeI","tlshash":"84952b88b291b07543e771f4417f050be3366858b40ac5a8fa65e8da6cbd44e223bf7d","size":1898596,"data":"","first_seen":"2026-03-16T14:28:38.465119Z","last_seen":"2026-03-16T14:28:38.465119Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/js/app.76fa8aec.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"523652a5c676d7b2bd4cf2b9ce38fca4","sha1":"530f3a674316d99ed6a89a1b5fc1a045cc8eda61","sha256":"08bbf9173acdbf1070987db82f0b7792bdf9805ab0d68532293a9c6a92bd2fe8","sha512":"30547a2f836615f59d2d9a80f419c1020cb47543e0f1b09207101fe8aa35b1ed1e6e2a2b9ef2e81905a5a7a064f8479119493296d55ed0ef0a58c3e528944026","ssdeep":"12288:6H/HPjHNH5HjHZkX0JPdxt4OJ+Ho4XPapT52WNelaCgKNkU4eWoMhO7RJtsel0oW:KVJdx+ZapTNrq/3NjRmwUPJF/pF","tlshash":"6555093a52c3c5fc6a22a2e5901eb044f1ae1db9fb81e1501a7cd66421decd4e24e77b","size":1403692,"data":"","first_seen":"2026-03-16T14:28:38.466436Z","last_seen":"2026-03-16T14:28:38.466436Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2302506_dgub43s9y0e.js","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"a105d9e99b709437060af0118b7bcba2","sha1":"44202564cce8cff8c0d60a4e2e24ecc1906088fd","sha256":"bce07f6092f8a587d682ec6e3775964bd0ddfce9763610782c7e9f16bbed9595","sha512":"6c827a38879c9d1ad9e043b0e65c7812adcedc3bf443185fd426a7003a1126fe14610b3a6ccb95a2c469aad57d43a4a5323c501c7dbe30bd686b32dae07b5ee7","ssdeep":"1536:SqW4WoowMsldvaW180rk2AV9xWNL4PwjyLFbkfXhMmChIuyjoKgv2doGtmK4r496:5W4JowHa0rk2AbxuLloWvD4Lnr3zoeUm","tlshash":"9424d7a5d36493fc5c0e43ddaa36b4b0360f10fe35d1cea8916dcea066939d8d94dc8a","size":219320,"data":"","first_seen":"2023-03-11T20:38:04Z","last_seen":"2026-07-24T09:19:13.514578Z","times_seen":82,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/assets/js/jquery.min.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","size":86927,"data":"","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-08-11T18:21:41.404378Z","times_seen":142597,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/datafeeds/udf/dist/bundle.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fd3251e228d9edda60ce01ccb3046f77","sha1":"acea866435eea9c7a0564dd82435bab93c22a9db","sha256":"f016a5c57c09504aea2cca849831255353ad7e56e008fd49a45a23b114b1247d","sha512":"07db2933537e3a704befe64479130db26145597802b80cc9f9c3dcc437aff0823e896626240801ac121e06c25ec986b42580c7d240f900b160646d29c99429ad","ssdeep":"384:kpe0jAoNzmAHgWH4NRZsPA4iCA2PHDJMW:oBiWH4jZsDPA2PHyW","tlshash":"9452a6c97611312182936472e87f380ba139b515688a903c71c8e9de6efdb5dea17f3c","size":13539,"data":"","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.276844Z","times_seen":349,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/datafeeds/udf/dist/polyfills.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a24c8424ecaa94595878ee39970c7b46","sha1":"651ecfd5fa247c45b1138bdb2629399882c50384","sha256":"67396f17c514b90f31cbe905241e290c820130be7f55edc770ce81587d37040e","sha512":"6a09a1c41bb241c93b864eda4c57ac14bf91c2b0d0a5323f03d24c31ba266c53af6b9b15580a914aebfca0c825ec6e19cc73e352398fde352c188c604addfe39","ssdeep":"192:/5C5b4rmkiNL70mrZm3KosuxV6/hk3haw5UPQ0wx9B4EhN0xhOU8c:xGegVrZLO3gyP6EhN0xhD","tlshash":"29128588f7e0b472036360b4917f450fb2b53925648e41b8f260d8ea6cbd44d962bf7c","size":9647,"data":"","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.266414Z","times_seen":304,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1700323073891423.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1700323073891423.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 2300\r\nlast-modified: Sat, 18 Nov 2023 15:57:53 GMT\r\netag: \"6558df01-8fc\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2300,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"520c333ff05d61f58c093f2e32284dc6","sha1":"c60499a44ca91249f97e7b25aa39bd18c1b30ba0","sha256":"878feffbaf7756e96d790ba5cd9a087d44acf34496ae18e13b1147e48750687a","sha512":"12ceac8f836f1c14cd776cab284653c886e3cfde2f921a79881ffdd7900346bb28fd6e7afc287d3cd077e8db0b39164abb4e4e90796e6ddb0a7f2e9bd9a51d75","ssdeep":"","tlshash":"9b4119ca2567ee31c09383890d5a7b8074baff2971b0490eaaf4f55c7a3678247d9007","first_seen":"2023-05-31T10:27:17Z","last_seen":"2026-05-20T05:31:39.738186Z","times_seen":117,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=NEO%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=NEO%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IlJWYkppbWtKdjNId1lBdjJ2YWVkUlE9PSIsInZhbHVlIjoiQjJ0VVJSZXNTUTF5K08wejA3R1RDamR6Qm0xXC8zV0p2TiswOVZFMGxrR3hLSUhSY0Zhb251NHlWTWp3OExkcGVxbklyOFpUS0FkWnVOZUs3bzlIY2ltSHR1UmN2cWFwRXY0MEx4cDhLeldcL09CR1lKb2NIWDlFcUNzUHEybUw3ZiIsIm1hYyI6IjczZWE5NTk1YjM0ZDQzZTMwOTU3YzBjZDdkMGQ4NTgxYTFhNDk1MTkwMDQxZDI4YTFlM2FkNWNjNGNmZDA4YjAifQ%3D%3D; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93906,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"19aa959cf8a8b0e2e0da1cd4fb98273c","sha1":"7070122a12612215a080cb1c2591e36a8516352f","sha256":"0188fbf85d74b061b4be3e249a54cee87dc8d6a1cb9418b908f74a51abbb6a56","sha512":"9b5d08fd2198d97e3bcbc3e6fd170f1dd411ff2b8a77be60f491d8c460c80c2e369cb9591d9fc681c27eab847b35e4e63c00c09eb1934b0662be90548eecf5c0","ssdeep":"768:MzTAaneZ904IdAjfk12YloqM+pZd1IVW83F8lcyh9Wp/CeJnTZE3xrCaMjd5Qkph:mtnB2YGmdUWm8m/CeJnT58o","tlshash":"6d9337c057b90271d03964883ddb28ac46bb334b68c6cfd549ff49c66a91676b602e3f","first_seen":"2026-03-16T14:28:38.400971Z","last_seen":"2026-03-16T14:28:38.400971Z","times_seen":1,"resource_available":false,"data":null}},"time_used":389,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":389,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2302506_dgub43s9y0e.js","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tbcdn.cn","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 28 Nov 2025 03:07:13 GMT","end":"Sat, 18 Jul 2026 09:41:04 GMT"},"fingerprint":{"sha1":"01:40:62:EF:8C:E5:C1:8A:19:4C:8D:B6:F5:C2:24:7F:DC:C0:9C:8A","sha256":"60:3C:41:A0:78:62:E6:5E:82:F0:FA:CF:5C:C9:D3:22:E4:64:EE:1A:EE:C7:CC:BA:DD:25:08:90:6F:CC:C4:F2"}}},"request":{"raw":"GET /t/font_2302506_dgub43s9y0e.js HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: application/javascript\r\ndate: Fri, 19 Sep 2025 18:20:53 GMT\r\nvary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Origin\r\nx-oss-request-id: 68CD9F059A18D63835479CAA\r\netag: W/\"A105D9E99B709437060AF0118B7BCBA2\"\r\nlast-modified: Fri, 24 Dec 2021 21:20:51 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 17623803529611141035\r\nx-oss-storage-class: Standard\r\ncache-control: max-age=63072000\r\ncontent-md5: oQXZ6ZtwlDcGCvARi3vLog==\r\nx-oss-server-time: 36\r\nvia: ens-cache29.l2de4[0,0,200-0,H], ens-cache36.l2de4[1,0], ens-cache15.se2[0,0,200-0,H], ens-cache3.se2[4,0]\r\nage: 15365232\r\nali-swift-global-savetime: 1758306054\r\nx-cache: HIT TCP_MEM_HIT dirn:-2:-2\r\nx-swift-savetime: Fri, 31 Oct 2025 16:37:33 GMT\r\nx-swift-cachetime: 59449401\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\neagleid: 2ff62c9717736712868557989e\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":219320,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a105d9e99b709437060af0118b7bcba2","sha1":"44202564cce8cff8c0d60a4e2e24ecc1906088fd","sha256":"bce07f6092f8a587d682ec6e3775964bd0ddfce9763610782c7e9f16bbed9595","sha512":"6c827a38879c9d1ad9e043b0e65c7812adcedc3bf443185fd426a7003a1126fe14610b3a6ccb95a2c469aad57d43a4a5323c501c7dbe30bd686b32dae07b5ee7","ssdeep":"1536:SqW4WoowMsldvaW180rk2AV9xWNL4PwjyLFbkfXhMmChIuyjoKgv2doGtmK4r496:5W4JowHa0rk2AbxuLloWvD4Lnr3zoeUm","tlshash":"9424d7a5d36493fc5c0e43ddaa36b4b0360f10fe35d1cea8916dcea066939d8d94dc8a","first_seen":"2023-03-11T20:38:04Z","last_seen":"2026-07-24T09:19:13.514578Z","times_seen":82,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":119,"dns":53,"connect":8,"send":0,"wait":33,"receive":0,"ssl":59},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2302506_dgub43s9y0e.css","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:07.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tbcdn.cn","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 28 Nov 2025 03:07:13 GMT","end":"Sat, 18 Jul 2026 09:41:04 GMT"},"fingerprint":{"sha1":"01:40:62:EF:8C:E5:C1:8A:19:4C:8D:B6:F5:C2:24:7F:DC:C0:9C:8A","sha256":"60:3C:41:A0:78:62:E6:5E:82:F0:FA:CF:5C:C9:D3:22:E4:64:EE:1A:EE:C7:CC:BA:DD:25:08:90:6F:CC:C4:F2"}}},"request":{"raw":"GET /t/font_2302506_dgub43s9y0e.css HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: text/css\r\ndate: Mon, 19 May 2025 16:40:53 GMT\r\nvary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Origin\r\nx-oss-request-id: 682B5F1559DE0D3439819498\r\netag: W/\"4E6F92D4BE1FDA1C253F0A5734F6F0AE\"\r\nlast-modified: Fri, 24 Dec 2021 21:20:50 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4994874612090554895\r\nx-oss-storage-class: Standard\r\ncache-control: max-age=63072000\r\ncontent-md5: Tm+S1L4f2hwlPwpXNPbwrg==\r\nx-oss-server-time: 22\r\nvia: ens-cache12.l2de3[0,15,200-0,H], ens-cache17.l2de3[18,0], ens-cache8.se2[0,0,200-0,H], ens-cache3.se2[1,0]\r\nage: 25998434\r\nali-swift-global-savetime: 1747672853\r\nx-cache: HIT TCP_MEM_HIT dirn:-2:-2\r\nx-swift-savetime: Tue, 27 May 2025 15:21:42 GMT\r\nx-swift-cachetime: 62385551\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\neagleid: 2ff62c9717736712876328732e\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":41219,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (33881)","md5":"4e6f92d4be1fda1c253f0a5734f6f0ae","sha1":"b3b9732ce017982a0ae2fe9a62e129d2db289e51","sha256":"10ffbe7042a3eab36522287a0025aaeb9ca33467a92cd15c9e08afa5d7e78934","sha512":"706eefcdde988f7544c2a136a493eb23a637bf376f04d0fdbf8fdf6fa4253894714322b14bec2f179943ecfb6b43440ce2a8b97b79843cc713a07bc4a58e87ea","ssdeep":"768:chdYlZdv6td4Hl2FZmInQhUFvX3F5f5M1lji0PVLPmEwSmPOhuP4iZHhI6:Ffdv677QhUP5f5MHu2wHPOOv","tlshash":"ce033ce5887c3cb45768d5d12242b621ef15a2bc9f9b4c0bf2677d8ca7e7304a046adc","first_seen":"2023-04-11T20:32:27Z","last_seen":"2026-05-10T08:37:22.820057Z","times_seen":41,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/img/it.fdb00f9f.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:08.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/img/it.fdb00f9f.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 369508\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-5a364\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":369508,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 16-bit/color RGBA, non-interlaced","md5":"fdb00f9fb31b0e7082e56b0b620add52","sha1":"44fb5ef9afe384a232018237dafb190952a1e929","sha256":"09dae8b48cd1f78aa5ffd10ca7d9c153ecfaf792431480e4edd735056ed65456","sha512":"e2c34254907159a1f12b196379b82e3b780edae13bf99348d8d7e712c5aa6974d7c976cf95599932efd6b0d647454a0439d446735ea5d1adf453afc148f389b6","ssdeep":"6144:vE65B4B0OUsTgb4QQ+d2l6NaskrItttcUy/LT5kTQfYzfapEHHncjbZ4Ni:vJIBPTgEQI6RkrItttc9j9kTqYraphSs","tlshash":"1e7423c0b589bde82aa57d05617beabac3e5f0f21038742ed15a34f807fca0575e9724","first_seen":"2026-03-16T14:28:38.404664Z","last_seen":"2026-03-16T14:28:38.404664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/assets/js/jquery.min.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/assets/js/jquery.min.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-1538f\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86927,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-08-11T18:21:41.404378Z","times_seen":142597,"resource_available":true,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/charting_library/charting_library.min.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/tradeview/charting_library/charting_library.min.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-2d8f\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11663,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2132)","md5":"c8cd63cddf0ab72e873d68a2d68ca336","sha1":"2d0b483c39ea41187d9fcb8200bb2819525dbd3b","sha256":"6571ad1a4bb68aacbd4c3a78fc0c26f9c1f1bb34a92164ea3fac2b4532acf88e","sha512":"f3956ab3268f27911de0789fa0858de98e26bcd2736544a6694a225aa61ab5b8ceff26774af62bad71294531d75e4faa198f44ee85a5731ffb26480940f4144d","ssdeep":"192:S4DF7XcEbRi1H0FEKyhWbviztF89xo/g81Qit+0idiiV8M5MSBj5JCWotPSXmYRB:fhoEbizXAoINoWoxSXmBEU3OHQI","tlshash":"18320054df6c2c3205c720fc8d7f288f513de276e895449e388491dc59ed44bbaaba39","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.273347Z","times_seen":262,"resource_available":true,"data":null}},"time_used":673,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":673,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/fonts/roboto-latin-400.479970ff.woff2","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:07.676Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/fonts/roboto-latin-400.479970ff.woff2 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/css/chunk-vendors.cd8d6c25.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:07 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 15736\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-3d78\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15736,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15736, version 1.0","md5":"479970ffb74f2117317f9d24d9e317fe","sha1":"81c796737cbe44d4a719777f0aff14b73a3efb1e","sha256":"48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3","sha512":"13f6b2ecc2407445c1f97109ededcc8ac64fae89fc90432a28ffdaef233b373089be25731718408c32ff3cf632afb260d0035f85fbd8b1b4e068a0d7baf9f6a8","ssdeep":"384:4V2g2L6wzYU8GCyt8jJlPaIi8jGCIWzUy+k:Uk6+8UtaJlPK8jGfeDn","tlshash":"6f62bf0cc5245712f8120d37b695aa60cf1995cf1f787af71bedb822f560bc685de121","first_seen":"2023-04-05T13:27:57Z","last_seen":"2026-08-11T17:18:07.062625Z","times_seen":8970,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":625,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt310m","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:08.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt310m HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:08 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 106\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"083ca301d478719f2b5214e5f32be723","sha1":"1a893ae4faaebc8c6261a370650a477d3de47d1e","sha256":"cf7b849031b9e7aac76e53613b2306b42031831ca862e130ebeece532ad9f6c9","sha512":"568a763a939728aadbab7ca3b99682827c0f1e714228ffff79c9490fe01d8d05ca309459dd907e094006d36b493da3cb5a69b60d9303f8b83ff25bb0b73f80bd","ssdeep":"","tlshash":"98b09b44a15ab2c5f9303b4555b79b154448744d814a054c316414840585200d11151b","first_seen":"2026-03-16T14:28:38.407747Z","last_seen":"2026-03-16T14:28:38.407747Z","times_seen":1,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224391484922.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224391484922.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 2224\r\nlast-modified: Tue, 20 Dec 2022 02:07:54 GMT\r\netag: \"63a118fa-8b0\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2224,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"5da4f165b2c87ea245b8aaa35d1e8ea7","sha1":"7847596f3a53b32daac06455e6a425b31d6c27cc","sha256":"a9dd3ae9f245903c8b5f7d4ca557da480c72f00f52b9720a000060916f97793b","sha512":"0ca4f3789dbdfe0c4d78406c96ee73e33e3a24185b5621e07fbe206339f3845d583f91f6e339eb848fa24f7ce8494e93792952d00515a3c7ea100c0a82c0db72","ssdeep":"","tlshash":"70413b0157a435ddd3767a6ec741c8e9b4a316e8124e9bd52b98f662c2f1150e341fcc","first_seen":"2026-01-11T19:28:09.575846Z","last_seen":"2026-03-16T14:28:38.409123Z","times_seen":2,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/css/app.faccabb5.css","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/css/app.faccabb5.css HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-25bd0\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154576,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (58151), with CRLF line terminators","md5":"80e60f43a018a337a261ca374288c5dc","sha1":"29510c5b2ac37ab45a6a183d659023305da0abd8","sha256":"1d458fa76b5d673b47a8a73b1ccce39a9523d281db4b49e46e52fbe78ab9717c","sha512":"cc373ee05d4d9d1058311443e1a4f857e9eb462dd5304af2287f50ae25f2d615287daf0a4e5824c00c4b93338e54ca5716e1948d3d18b7c6a70f18d3103140ef","ssdeep":"1536:+3UlJuea6LG+ZPuLrQ1X1ye2IfK7I2CSf65WCXkkEy1HxJysun5Lns+4:BlJuea6LGcPnlDfT25f65WCXkLnh4","tlshash":"77e32bf0a601241ef233c61a81d0da89713ad54ffa731a9ef6056505ffca1eb1663f58","first_seen":"2026-03-16T14:28:38.410423Z","last_seen":"2026-03-16T14:28:38.410423Z","times_seen":1,"resource_available":false,"data":null}},"time_used":672,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":672,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Ew\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.804Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Ew\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 155780\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155780,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TTComp archive data, binary, 2K dictionary","md5":"9c087373500c4b0f1afbd097e8fb6067","sha1":"c39803dc2a97cb39ead1f21d418d046c75204d99","sha256":"13979b53c7e6b410665331fce293a8c3663f6ff930d80a870c79044ad131cb67","sha512":"3cced4dc7b334b91ecb9e158b981a16266a9bd2cfbff3d77283706e31481e3358f8ac1bfbc28383b8cc61afa494f80d9bd084d4bfe9272a61b720fac338ec628","ssdeep":"3072:+9JVJtA9JOtJ7YJmtKYJDYJNJpiVlg/JCJQl3AvTynTgntvxRMugeYJxJwaZ1:CJVJtUJOtJcJmtvJkJNJpiVlg/JCJQlB","tlshash":"c5e3be4d17760af4d5b163c1add22aec686a274359c349c9c39dee8c83c83a5f305e6b","first_seen":"2026-03-16T14:28:38.41159Z","last_seen":"2026-03-16T14:28:38.41159Z","times_seen":1,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Th\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:10.735Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Th\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ik1QdEtlMEcwblhia3hKWkQza1VFSGc9PSIsInZhbHVlIjoiYjJnWDUzeTk5NHlZYWUwZXRQOVRVbGZMblVoU0tYdll0S1dWU3l2dmN0ZlhyK1wvMjVSMlV1cDNpZGRMdG1hOGRFMGZuZmlrbzJqcEt3Y3Z6YUZBdG03NW1leUFQeEU4cWFhMU9rYkZXQlQzV2pOWWRTNVlYamhTNTdPUlA0UkI0IiwibWFjIjoiYTViOTExMDgyZmIyNGFmYjViYzE3OWEyMzYzYzIyNTk3OGM2ZmZkMjNjMzZiMGYyMTJhYmFmOWIwOWRjOWM5YiJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 127481\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":127481,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TTComp archive data, binary, 2K dictionary","md5":"48cf99383e5ed4c6cce58993c290a1f0","sha1":"a84381e6db3979512e73afa99db498ffe888d45d","sha256":"35849b03cfb93b297f97f108a536cefc78bba3cc532d0f413ecddc1153bb86e6","sha512":"f62dccd572f4569f9ac9310896bd7cc8f927a4787f1f72c3990c5cab786ae63f3d1942beca00d2e9b903c7af844a77ebfc36498610840e5b4e753953cc1a3aca","ssdeep":"3072:CYJdJy6YJEaJJuYJ65jYJCosCJjJATVtghJtJl0ayOGgMigLtgQVt:nJdJyfJEaJZJ6iJCWJjJATVtghJtJl0T","tlshash":"00c3bf4d17760af4d5a163c1add22bec686a274359c349c9c39dee8c83c83a5f305e6b","first_seen":"2026-03-16T14:28:38.412696Z","last_seen":"2026-03-16T14:28:38.412696Z","times_seen":1,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":231,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/fonts/roboto-latin-400.479970ff.woff2","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:10.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/fonts/roboto-latin-400.479970ff.woff2 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/css/chunk-vendors.cd8d6c25.css\r\nCookie: angela_session=eyJpdiI6Ik1QdEtlMEcwblhia3hKWkQza1VFSGc9PSIsInZhbHVlIjoiYjJnWDUzeTk5NHlZYWUwZXRQOVRVbGZMblVoU0tYdll0S1dWU3l2dmN0ZlhyK1wvMjVSMlV1cDNpZGRMdG1hOGRFMGZuZmlrbzJqcEt3Y3Z6YUZBdG03NW1leUFQeEU4cWFhMU9rYkZXQlQzV2pOWWRTNVlYamhTNTdPUlA0UkI0IiwibWFjIjoiYTViOTExMDgyZmIyNGFmYjViYzE3OWEyMzYzYzIyNTk3OGM2ZmZkMjNjMzZiMGYyMTJhYmFmOWIwOWRjOWM5YiJ9\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 15736\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-3d78\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15736,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15736, version 1.0","md5":"479970ffb74f2117317f9d24d9e317fe","sha1":"81c796737cbe44d4a719777f0aff14b73a3efb1e","sha256":"48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3","sha512":"13f6b2ecc2407445c1f97109ededcc8ac64fae89fc90432a28ffdaef233b373089be25731718408c32ff3cf632afb260d0035f85fbd8b1b4e068a0d7baf9f6a8","ssdeep":"384:4V2g2L6wzYU8GCyt8jJlPaIi8jGCIWzUy+k:Uk6+8UtaJlPK8jGfeDn","tlshash":"6f62bf0cc5245712f8120d37b695aa60cf1995cf1f787af71bedb822f560bc685de121","first_seen":"2023-04-05T13:27:57Z","last_seen":"2026-08-11T17:18:07.062625Z","times_seen":8970,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/datafeeds/udf/dist/polyfills.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/tradeview/datafeeds/udf/dist/polyfills.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-25af\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9647,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9646)","md5":"a24c8424ecaa94595878ee39970c7b46","sha1":"651ecfd5fa247c45b1138bdb2629399882c50384","sha256":"67396f17c514b90f31cbe905241e290c820130be7f55edc770ce81587d37040e","sha512":"6a09a1c41bb241c93b864eda4c57ac14bf91c2b0d0a5323f03d24c31ba266c53af6b9b15580a914aebfca0c825ec6e19cc73e352398fde352c188c604addfe39","ssdeep":"192:/5C5b4rmkiNL70mrZm3KosuxV6/hk3haw5UPQ0wx9B4EhN0xhOU8c:xGegVrZLO3gyP6EhN0xhD","tlshash":"29128588f7e0b472036360b4917f450fb2b53925648e41b8f260d8ea6cbd44d962bf7c","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.266414Z","times_seen":304,"resource_available":true,"data":null}},"time_used":673,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":673,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/quotation_new?_timespan=1773671289053","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/quotation_new?_timespan=1773671289053 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nContent-Type: application/json\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7018,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"26619c551a6d4f3318aa2ad47a1e648a","sha1":"bbae319ff375a431ffe7495bcc82773869f551a1","sha256":"93dda9e1da05da375542c3fe76b377d46d6b8da1d03970d9657b42a42f62c46d","sha512":"95653e4b703782a25f9d39b28e72405f6a6b44505c4e6dd80991c67875e8e07e388d453533ba13924d3b45e3ba1d15e5af564f5e3e8408ff4833d9dc99ae3116","ssdeep":"192:1NWemKnFgmKSNth7e0jyJpMP/vHVpIhd24I+phajywng:HWmr948fHVQuTu","tlshash":"dae1d09d311d89b8c6b7aec2df9a32ae3555750badc24f44d3dd1fcc024992be20b912","first_seen":"2026-03-16T14:28:38.415626Z","last_seen":"2026-03-16T14:28:38.415626Z","times_seen":1,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=websocket\u0026sid=3a243dde046eda4102a6af15","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket\u0026sid=3a243dde046eda4102a6af15 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://coinbase.wlsp.shop\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 2KFBnLd8A9foxbNANLqcxQ==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Mon, 16 Mar 2026 14:28:09 GMT\r\nContent-Length: 0\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: CPodhmikMn7OOc5G2qNwursFoC0=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T18:56:41.252218Z","times_seen":17841592,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":0,"dns":1,"connect":226,"send":0,"wait":226,"receive":0,"ssl":237},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-16T14:28:06.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nlocation: https://coinbase.wlsp.shop/mobile/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1470,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T18:56:41.252218Z","times_seen":17841592,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-16T14:28:06.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/ HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coinbase.wlsp.shop/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-5be\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Alibaba Cloud CDN","description":"Alibaba Cloud CDN is a global network of servers designed to deliver high-performance, low-latency content to users around the world. It is a cloud-based service provided by Alibaba Cloud, a subsidiary of the Alibaba Group, that enables businesses to accelerate the delivery of their web content, including images, videos, and static files, to end-users.","website":"https://www.alibabacloud.com/product/content-delivery-network","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1470,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (716)","md5":"118e338a171ae4e720e5f08d0dd763f2","sha1":"de10fe17abae748b0bc7257562f55b43e66caeff","sha256":"8f645c0e68a3197c9e9cd43df9aa9e7857d3dbd027b61cc9aa7f6c3a70c71471","sha512":"cca273554e93c40527b6270237d844fe3e4aa7379b9e5b5b3cb39b5425b421ce8c4956f8abec91d39214d6a55cb00a201c41370949a58509e538caf47802165c","ssdeep":"","tlshash":"71311488dd08d1ec19102e9dee70b60d459ea90f6d21cc9035fd422c8fa8fcc0951c91","first_seen":"2026-03-16T14:28:38.417881Z","last_seen":"2026-03-16T14:28:38.417881Z","times_seen":1,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224442279476.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.570Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224442279476.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 1752\r\nlast-modified: Tue, 20 Dec 2022 02:07:55 GMT\r\netag: \"63a118fb-6d8\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1752,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"fd97892a13e5beb2358394e06ba40700","sha1":"2677291a28e20494c165e3581946caf923b78981","sha256":"a5b9ff359dd201710498f55c627c0446fb471839327bac427970462cb088c437","sha512":"72a00e5e4717a3f51378004aa72bcef52c072341a3dd4a17c2a3596af60b4a1099e26f2a72e52ff84e024f9c6ea6ecbde7319568b921246be7b9afc6eaefcc27","ssdeep":"","tlshash":"9f312bf66310b3fcc4b78602961c1becea18445e585196f6c62b20d80cfc5e8f4e24d4","first_seen":"2026-01-11T19:28:09.52511Z","last_seen":"2026-03-16T14:28:38.418932Z","times_seen":2,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=BCH%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=BCH%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IlwvdHpUQW1OUUR6VkpCSHJlOUZBMFwvQT09IiwidmFsdWUiOiJkbVwvbUxxbis1VjFWbmFjZ0pGTGdKc0tSUHoraGxMSWZJZHVcL25WRFwvVGZcL2lnTHk4M1JHOVk4RDZcL21BUDJ3TGNzc2lqMEZ6YWJrTzNqWEZDQ0hWSWh4ZmRTeHFjZXFwYVdqc0VoeHk5NGdteDJaK0JBcDM3RkFkMmlFaG9tXC9ZNSIsIm1hYyI6IjZmOTI1MmZkNGEyOTk3ZGI2Mjc2MjIzNTg0NWQyMDhkZDAzY2FhOTA5OWY3MjA4MjkxYjEwNDIyYWE3OGM1NGQifQ%3D%3D; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107318,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e6e0643de8590568850e9360201d1c8f","sha1":"f892ec6b76cc603d71c644a839b445c03b67d9e8","sha256":"16337fc2ae1da663630bac61c68ab27e2467969697d5b9a64cc90c94578bb9e3","sha512":"ed6ca51395bf631f642a36a901d61f94cbcc7ddd3907b68b04496ad4a2dcc113d71daa31b9602d3ba9a2b37633ed66d46c0cae26298b854efa9be382fb227360","ssdeep":"1536:wCIXGiGFsShZGAkh5Th5hQSzNNhuJB+PYRzGk:2XGiGfhaTwENfuX","tlshash":"63a38b0057ad01f0c07925d46e931ca846ab735b65c38f9592ff0ec269e1a7af612e3f","first_seen":"2026-03-16T14:28:38.420535Z","last_seen":"2026-03-16T14:28:38.420535Z","times_seen":1,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31MJ\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:10.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31MJ\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ildoa2RlWStLZGQ3M1F2YnhUYTVWbUE9PSIsInZhbHVlIjoiNWRwUWpiTG1pRXR0T2pNdFhHK0NkeHp1MGpndElRT29uTmhxRmhoR3pOWHNqSHpJaXFIN2kzZWMwb3Z0aW9Oam12MGJwWUNoY2srU2hhSENETGpSdDJOSzRzTjI2XC9raDNTTG1WSWlzNHN1dkc3MmpQbFFSbDIyMmRNaHoyUzRQIiwibWFjIjoiN2JkZThiMzgwOWIxZWRlZThiYTc3M2VlMjM0Yzc4ZjEzZjNjNjlhNWNhNjgwNmZlNzU4YmM4NzYwNjI4MzFmYyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 101620\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":101620,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"5a7d3a463840c30182907b83e3a18572","sha1":"664122ef423b75163a392465983095008bb71682","sha256":"72b0f0c6d7a93274cb31f6a5ca8459be44e8eab959a66e429c6df4f07387270b","sha512":"3b632fbaa29c3eae06ce1296cc85f7fea2b7dc858f81bd5590f0ec8afc6281cc4ba38ac006a0737ba243da8cb8ad2fe5bd8bbdf4321891b1cd1f88193933f99a","ssdeep":"3072:QYiGTgl+ox+g5/czIoHJroj4r/odI63Qppg3l:QYiGTgl+ox+g5/czIoHJroj4r/odI63R","tlshash":"6aa37e0e97534af5d6f1a2c16cd126fca86e224799c34588c39dae8c82dc35af305d6f","first_seen":"2026-03-16T14:28:38.42163Z","last_seen":"2026-03-16T14:28:38.42163Z","times_seen":1,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":227,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-16T14:28:05.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:05 GMT\r\ncontent-type: text/html\r\ncontent-length: 646\r\nlast-modified: Thu, 16 Oct 2025 20:44:06 GMT\r\netag: \"68f15916-286\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"c70f763f9ceed025c30e19655a39ebb2","sha1":"6a537e97b81c35ea65d56993fb9019d04f0bad49","sha256":"290fdba6e5938061fca973ee5d909988cc13b48a75fa48bc47e23db63a07756b","sha512":"a7702108dc9ede2eae3a02ff5492368921ebafdee40e4ca33ed7981c4e0fb2e59206a4925b5722ae33d0e8573a7bea9ab9cc5c968692721b637192a6f50c7b09","ssdeep":"","tlshash":"ccf04c4a1e435413317145959fe1f50828b331972652dc40b5ce4152cf65b5b8b7bff8","first_seen":"2026-03-16T14:28:38.422708Z","last_seen":"2026-03-16T14:28:38.422708Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1206,"timings":{"blocked":491,"dns":32,"connect":224,"send":0,"wait":224,"receive":0,"ssl":232},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/img/german.5342473b.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:08.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/img/german.5342473b.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 253935\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-3dfef\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":253935,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2048 x 2048, 8-bit/color RGBA, non-interlaced","md5":"5342473ba2714dc65a27d1cddbbb67fd","sha1":"af575f4a552e855ffaa09dac130c76e100c16e0d","sha256":"87d79456be38480fae5d5d5ec7dee3775e55669b141ad74ab5268c68dac610d7","sha512":"755be663ed97eaace355f7ac83cadf45048a2cb6c54be5776b319d82803a47f955e41f4adb3f13fd9723636a68bcf3df92e0dbfc9a99fed1cc9bb6f7fc4e97e1","ssdeep":"6144:PpXMHBHS3V5bWmumefooAV1mJSAxAMdux:BXuFS3V94bfV2mA3r","tlshash":"df44df87269ccd6ef48bd99ea5725acbc7e07136efd54dc10900d0e48c4ba212f297da","first_seen":"2026-03-16T14:28:38.423777Z","last_seen":"2026-03-16T14:28:38.423777Z","times_seen":1,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":236,"receive":216,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1700322868225869.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1700322868225869.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 3718\r\nlast-modified: Sat, 18 Nov 2023 15:54:28 GMT\r\netag: \"6558de34-e86\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3718,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"4ff643f0293b7f44cb59d3f20fc606d5","sha1":"bef5cf79d82f4e06fbeb9c3208b1f757473bda82","sha256":"ddb700c9239a499bbfe60deb260f48793ecc91c96be8c36301cacb74848b7cdd","sha512":"5e0cb648f35b043b7b83ba7f61b1acc05b5f943d39b4d2cc247e2a96b05bb985c67d465a7f1b26f6c68fc106d6064ab85408eaf41d0c8c0452563379394ac6d4","ssdeep":"","tlshash":"6a717d6f1e4a0d15dae2614038a100dece3a228c79249ff7db105611bef70d26f713b8","first_seen":"2023-05-12T20:10:54Z","last_seen":"2026-04-19T16:01:14.712573Z","times_seen":33,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/favicon.ico","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:11.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/favicon.ico HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6IlhJMzcxcVY1TTE1R1FvWmNuV2hPZ2c9PSIsInZhbHVlIjoiMmNKa0swbzJteFBqd2NmNm5wTFdJTGRMS0Z5SVNtSHpOejZ5cTh3YldyektlenFWcHhaN3B4ZUk5T003TTNlRzVCRk5odFN0ZEhNdjBTVDcxNXpaVExyNXJyaUhhdlFPREdXWk12STgwRmg1YzdLMGk4QVE2YnZsaWNlRFp0SlUiLCJtYWMiOiI4MGE4YWJmODA2YTM2YjY2MjQ0ZDVjZWNmMTVjNDIzY2UzZjI1ZDM5YjE1MTBmMDVhOThlMzk5MzEyOTlmNDU1In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:11 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 9662\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-25be\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9662,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"069633ab34dc45ec70683d0be833104c","sha1":"ed7776184ac1b541940a3cbf3c66d79e2031da39","sha256":"8da575e214e3f494e35ac11b0f0bfdbb72204b4de48274bfb67e1abf977fcce6","sha512":"948cd9d6ce16ba661cfd23d825425c7a74b9c66bd7941f10a18f552b76f5d91b3b923890eac8cb1d940388d001535bb6612664e9881b135b5267e1a4f868655c","ssdeep":"96:9nR41yVln5UQ0eVNZIH1STnl3da/RiaNvHleBfpn9vIf4lyp5X+8mnnKe9lyFgn9:xXu1OnXa/R9vHleBfPvIglyu9/rBL","tlshash":"91122ec2e3e834d8c8085a7f8f7de95059c6ac31783397593a52b7c777322a18ce9859","first_seen":"2023-08-10T16:39:26Z","last_seen":"2026-07-17T06:02:16.676963Z","times_seen":44,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt310x","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:08.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt310x HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:08 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 106\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"8db543ffd7c7c4c85db6d85b52257a28","sha1":"259c85f1027a0da7ace4b194f9f99469857bc140","sha256":"f4533daf7dbe30bf09d0d86f124f17fa8817b821007b69ddef4472652cba8df3","sha512":"b16493eb60b6c9e5f3e1d841993c8790188099bbe1a89e41fd0749052ea9e152ab0fb3faa95c3fb891302542f35fbcf4893a8b52a02abd814ed5ce10b9414b88","ssdeep":"","tlshash":"e0b09288929ab7c6ba717b8164f35a05480cb89d868a148c326804890aca210a3a762f","first_seen":"2026-03-16T14:28:38.426659Z","last_seen":"2026-03-16T14:28:38.426659Z","times_seen":1,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/news/list?_timespan=1773671289053","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"POST /api/news/list?_timespan=1773671289053 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nlang: en\r\nContent-Length: 22\r\nOrigin: https://coinbase.wlsp.shop\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"{\"c_id\":4,\"lang\":\"en\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Im5aUVJidFFiVGMrRFlMOXhHNUJRXC93PT0iLCJ2YWx1ZSI6IkRDTTdRSkxxK2lza1pKV2FjdzF4ZWxMUVk5WGFyZTY3bVFybU9NN0dcL2YxT00ybDVreFE5WGNzQVFjeENCUW1PZ3Z3cFplNTlzYklIU3R2K3BpRVpZc0dUMjFSc09jMGZ2ZGFpYXZJaDNYMWJwQVFJb091RGJHcVBnWkZxemw2QiIsIm1hYyI6IjYyMWJiOGE2MTk0ODhlYmJlN2ViOGEzNWNiYTI1YjNiNTI4YjQ2NmY2NTI4NjNhM2FkZGMxY2ZjY2Q2MzRlYTcifQ%3D%3D; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"aeb65a80c1fcb5e6e9f7d2357db19f6b","sha1":"d1df3caa186dd55d278365f5d0d2d319b1d7e240","sha256":"3bb113c92ff96fcb9bbc456bbd44e794be049497aed4d0f7036ee7fe30b6ed55","sha512":"3ca0db76772a6e69a7cb5b7bc4639f3193fd42288139cb192b9422124b79bab2fdf8c96f9758b5e637e034f51b8871a52aa687651f9bf2202ace042fdbb27840","ssdeep":"","tlshash":"26a0222200000cba030a2223300a20028c8c00808f0383000280000cc38c08c082222b","first_seen":"2023-04-13T23:29:03Z","last_seen":"2026-08-07T11:15:24.520221Z","times_seen":176,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt314e\u0026sid=3a243dde046eda4102a6af15","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt314e\u0026sid=3a243dde046eda4102a6af15 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 55068\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55068,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"9dd56b1fced6fa00e7499d3cd746bea7","sha1":"54e0f7ea34899646256b8a4651cb7d1aa47f567a","sha256":"0877ae7d7f0a2aded8c674eea6de616fe10e11abb35c7fabc45cbf32e9b8a7b5","sha512":"0d8ff0d813d2ff9aa3eb9447602a20f715ded27d3681d8d4cc846e6021ef2569cdc2d2b114d97de0419939f74f713262218ea6da0137ef1b45f3b5a34e0b1bd7","ssdeep":"768:pfvMJqf+L2CfvVeufvGfLfvdspf+Vfv6eoCfvsBfv3B+OfRQBefvjfRf6C4fv4DI:JtqfIDWYZCpekjTogbH8N","tlshash":"c9337f0e9b534af5d6f1a2c16cd126fca86e224799c34588c39dae8c82dc35af305d5f","first_seen":"2026-03-16T14:28:38.428384Z","last_seen":"2026-03-16T14:28:38.428384Z","times_seen":1,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":298,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1700322915349912.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1700322915349912.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 7589\r\nlast-modified: Sat, 18 Nov 2023 15:55:15 GMT\r\netag: \"6558de63-1da5\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7589,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"5b334524c37271407ff9dc3a4b9033d7","sha1":"ee60302860d7e1905436bfde9a64972579eeece9","sha256":"25773fdaba00df304943661e51aabf762aa12a2931df20979e9085c2fadcd30b","sha512":"dd42e6141b6de6158843248beb89a0f4dd0685c0f51a3d096d74f652a247281f72b17c56e06222b212043bfbb4a19e5c9d70cafd5f12c87ca12dcbd4373e1f0e","ssdeep":"192:qZlwC/sKPjMB0EFq3qd+hJTvHsbN1tM8e+fb+:6lwC0KPjMB0nU+7TvHs51tM1+fb+","tlshash":"18f1b0e2fff7e532ca60c37ac3ccd664c432712049b6552a60628d6599ddaebc01116e","first_seen":"2023-05-06T18:37:16Z","last_seen":"2026-05-26T03:58:15.950649Z","times_seen":25,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=DOGE%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=DOGE%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IkJqMTJnSEtoV3dYVDlxQlIyK1BrVGc9PSIsInZhbHVlIjoib2ZYeGFvbjhDUXhoV1wvWW9yUzJLeGI4SVg3XC82XC9MQzdUaDdwRkozOUd5RUtzelJtV2xQNlZ4TWI2ZEZzeDBNVEN0ZXd6Nm9uWHlIZFl2OFNNNG5hXC9kR0oweElDQ05PR2xLSGhoeHVERkRuakZhM1BoTDVTSlBRQlIwMmhWU2J2IiwibWFjIjoiNTg3MTE1ZjFiN2E1MWViZjI3M2Q4ZjVmYTlhN2UxY2FmNzU5OTkxNDA0YTUxMmJhNDM2ODZhZTI4MTMyMWU2MSJ9; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":118367,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"013ea180b0c05c52547bd1e0882f7fb1","sha1":"2033d94cb7e2112f695211f9a52a2f64ae6b8e3b","sha256":"7087092985dddb74135da32ca3490e6a0bda8ca7b69ff86f3e4968f0fd0b38d8","sha512":"13ffc4dbfdd4cfc5e153561918369b61f49947b8ced79244cf63a0835a718057269c029a1d684c8f2022323a5614600ba4ee49901eac5f9f76f9495c516fff3a","ssdeep":"1536:g4ZaIx3fpopKyaXzC2uI8VB/2tg8Vwu5aPPAv7:XxiIe228X2g7","tlshash":"79c3800053bd02b1d07a21d47ed318a842aa755b64c38f9542ff4ec266e27bbb616d3f","first_seen":"2026-03-16T14:28:38.430539Z","last_seen":"2026-03-16T14:28:38.430539Z","times_seen":1,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=websocket\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://coinbase.wlsp.shop\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: wDFV35NvsDvkPuLewGFTRQ==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Mon, 16 Mar 2026 14:28:10 GMT\r\nContent-Length: 0\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: f2pc2L520KLhZxShigsUNvPCCtk=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T18:56:41.252218Z","times_seen":17841592,"resource_available":true,"data":null}},"time_used":681,"timings":{"blocked":-1,"dns":1,"connect":224,"send":0,"wait":224,"receive":0,"ssl":232},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/tradeview/datafeeds/udf/dist/bundle.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/tradeview/datafeeds/udf/dist/bundle.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-34e3\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13539,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13538)","md5":"fd3251e228d9edda60ce01ccb3046f77","sha1":"acea866435eea9c7a0564dd82435bab93c22a9db","sha256":"f016a5c57c09504aea2cca849831255353ad7e56e008fd49a45a23b114b1247d","sha512":"07db2933537e3a704befe64479130db26145597802b80cc9f9c3dcc437aff0823e896626240801ac121e06c25ec986b42580c7d240f900b160646d29c99429ad","ssdeep":"384:kpe0jAoNzmAHgWH4NRZsPA4iCA2PHDJMW:oBiWH4jZsDPA2PHyW","tlshash":"9452a6c97611312182936472e87f380ba139b515688a903c71c8e9de6efdb5dea17f3c","first_seen":"2023-03-07T14:46:31Z","last_seen":"2026-08-10T04:10:24.276844Z","times_seen":349,"resource_available":true,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":492,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/js/chunk-vendors.794b6ccd.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/js/chunk-vendors.794b6ccd.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-1cf864\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1898596,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2859cf62f86c4af03e0b0593c13d1708","sha1":"e46a21adbb1263b1686cfbaef02c3416a001d26f","sha256":"4fac7ac7a75aee882da3f8569f424b572ebbf0785201d95029cbd5f0c871cd45","sha512":"9960f463af8480b95b9917711abd5f4c3620a98a34ee8029fcb721e9948941870e90eae1fc975e0b90b3d627ba49736910600948d43a0923ae7ccff5332f6c83","ssdeep":"12288:jvYVERCa7ftpSXNSnMhXdqNUjhqkw4hUvUXVqiXcSoXXNJ:jwmCaBpSMMhtMUj0h4vVBs3XXr","tlshash":"17251a5db255b03143a771b4406f050be33a194cb40bc5a8fa6ae8da6cbd44a723bf7d","first_seen":"2026-03-16T14:28:38.432268Z","last_seen":"2026-03-16T14:28:38.432268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":894,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":894,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224410203424.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.568Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224410203424.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 1686\r\nlast-modified: Tue, 20 Dec 2022 02:07:55 GMT\r\netag: \"63a118fb-696\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1686,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"924e90138cf35b9806829daf797d85b7","sha1":"7c3685a60d3e7c1377f7d45b024ec4630962e16e","sha256":"d0b0cda13fb2210632fd06dfbad7ed77a6bd30123d3c0698de8d9fcdcede67f9","sha512":"64c0e7fca7e31cb65d414a304d41fa90b2f04f6c09afdcd45d730e429ea956875e0f0be5149586b77f812406d6c149fff27797eebaaa1b97ddfaac373a818bec","ssdeep":"","tlshash":"c4311a6b85dc651680a9003d8e9e08c3b8a30d414654b6b066181efeb874a2a032fbcf","first_seen":"2026-01-11T19:28:09.615593Z","last_seen":"2026-03-16T14:28:38.433355Z","times_seen":2,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=ETH%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=ETH%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Ik1QdEtlMEcwblhia3hKWkQza1VFSGc9PSIsInZhbHVlIjoiYjJnWDUzeTk5NHlZYWUwZXRQOVRVbGZMblVoU0tYdll0S1dWU3l2dmN0ZlhyK1wvMjVSMlV1cDNpZGRMdG1hOGRFMGZuZmlrbzJqcEt3Y3Z6YUZBdG03NW1leUFQeEU4cWFhMU9rYkZXQlQzV2pOWWRTNVlYamhTNTdPUlA0UkI0IiwibWFjIjoiYTViOTExMDgyZmIyNGFmYjViYzE3OWEyMzYzYzIyNTk3OGM2ZmZkMjNjMzZiMGYyMTJhYmFmOWIwOWRjOWM5YiJ9; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":117820,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"03d1bf3acc87554ab0c02d7a605ef8cf","sha1":"0f8849ad3456035269f0f14aa75070aa98d76c93","sha256":"4a33488b43f35ac360635e14d50ced5de6b357d68e1278ab9a96c336feec24e6","sha512":"b0eec692e15567fe62a41fda7f06173155fe55657505fe9a3e47ab1297d7e9dcf9f32ec8f06938ee21c28a127f144ba770cf7607bdc2fe520a43fbacff104e69","ssdeep":"1536:+xSK6PWacocAWwqkx0ixxDl++2CQOHKUZPQYjZNPRa3y/ZlI:+xpacoc74dIwHKUZPQIR//nI","tlshash":"fab3b0005ba90570d07925d47ad76cac42ab335b54c78fa542ff0ec279e1abab602d3f","first_seen":"2026-03-16T14:28:38.434569Z","last_seen":"2026-03-16T14:28:38.434569Z","times_seen":1,"resource_available":false,"data":null}},"time_used":616,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":616,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=EOS%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=EOS%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IktDS3hmN0FiMlIwYnpvcnRZWWlldkE9PSIsInZhbHVlIjoiYXhLOGdOcWUyWlhxR255azRWZFFnOFJ0am9BT255MjNIeFI4TWYzdDZrSW5kYVlwbFhBYmdKcUVTZzJqTTBPNFpCcXhtMHNoQTlVeEpYaUVlc2lPdWVSU3NvbXFvVzhZZ2d2eUVOeUVcL2Y3WUkxYlpFazZFWWg4cXVZSHErd2pZIiwibWFjIjoiMjMwOTYwMDlkNmNlNWEwYmU5YTdmNGNjMGJmYTg2N2ViMTczMTc0ZTJkNDNjZDZiZDAzOGExZDgyODg3M2ZkMSJ9; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"136b02255a623f7c44544d5266e21ee6","sha1":"d16732370a4b4c9c029637920cd26afa2d422390","sha256":"fcca40d39e392ed1fed0515a2ed890128e3a461bc12240751cf2df7506160f86","sha512":"cc52574d8ea557037eccc98a0d0831b18956f9f6dc5d9c88dcb4b5a4a5abc88ba79470d35c772cc38bd8bc28159b911093b3375b72634bc6bea5ee8bc1c8e6c2","ssdeep":"","tlshash":"ba8000a2280e2c830c0a38cc880c8b8220e8a0808a200320ce8ea238cb080acb883830","first_seen":"2023-04-07T14:59:17Z","last_seen":"2026-08-10T08:22:35.362285Z","times_seen":220,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":345,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31FY\u0026sid=3a243dde046eda4102a6af15","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31FY\u0026sid=3a243dde046eda4102a6af15 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 144787\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":144787,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TTComp archive data, binary, 2K dictionary","md5":"7f49c94e929abb959e82f64c46946710","sha1":"f59d0b45f129876b574012b5b9dce2212b1c281d","sha256":"ddabedc3fd6bc57991f1643674ac6ed52b449568ea78ce8a8a727b5723be35f2","sha512":"c8c8ee35562607a57d9e00776315eed8955284338788c094e1ab05cfa2af3e6f4c77ddca4ac87e5884167041f1daae102c1bbfefb640bcb5dd2161b6a4e3e599","ssdeep":"3072:xYJmtKYJDYJNJpiVlg/JCJQl3AvTynTgntvxRMugeYJxJwaZqYiG4:aJmtvJkJNJpiVlg/JCJQl3AvTynTgntz","tlshash":"9ce3cd4d57760af4d5a163c16dc22bfc786a278399c349c9839dee8c82c8365f305e6b","first_seen":"2026-03-16T14:28:38.437156Z","last_seen":"2026-03-16T14:28:38.437156Z","times_seen":1,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":227,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=LTC%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=LTC%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6InhTOWw5M2VSeHI3WWhHNWNtS3crZ0E9PSIsInZhbHVlIjoiZWVCRzZIWmxCQkVOdkZ2c1lqblRCSk1DamR1TnRuREF4MFwvczJNQzd2d2R3XC9RcG54am9yZVV4WWJEQXNPeG9KMWh4YTZ4VjVaZkFWZnVXbHF0ZDNLa3JBdEJaNDlrR2l4N01RZ3NVYjF6S3R5NUFwcFwveGVJU1NpSThLVklORGgiLCJtYWMiOiIyNjAzODNlZmMyNmIzYzZiZjFkZTc5ODQzMzhmZjExYWY3ZjZlYTJmNGQ2ODliN2QzM2FiNTljZTVlNTQ4ZmRkIn0%3D; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112143,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"49dd3b1682b497f57cd1b1e1bdfdae3b","sha1":"9ba5d4551ff8070ae9976c5ff1c49cfab0377ba2","sha256":"ef0043f6dd47c5af8275f7d282251726251afeeefe89e10bce43f93dcab57566","sha512":"f105c5c18b3974dddd7ae7e2e69880ef0c1fd26075a0d95c64f51187c046a4de4170b4bb1f1339abf0b280f09f47fd0e4e91c3eca74d58a80d6f8c849259dc0c","ssdeep":"1536:trXKBBhSXVTpchgYyzj8beFfHds9mbn9nAEJNzcmQhuUcZZZeS:FK+78beFffNImDZZZeS","tlshash":"86b3ae0067a901f1d07d25d46a9368a8926f335b54c38fe442ff0ed259e2677ba12e3f","first_seen":"2026-03-16T14:28:38.438351Z","last_seen":"2026-03-16T14:28:38.438351Z","times_seen":1,"resource_available":false,"data":null}},"time_used":408,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":408,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=SNT%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=SNT%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6InNDNStXXC9hbmo0U2lnZjVYQTdZTHlBPT0iLCJ2YWx1ZSI6InVMeHVSMit4SVIzN1pEN3o2NnlwQUxlRURoRTA0OFwvbDl6R0pZNjg0cVpMOUFkMzNZTmI2UnpSVkx2WlFnRXNSbmp0WVBIckFWeE1ldVZHU3hPWWJzSU5uWlB5YjNCTFVXXC9yd3lqSVpsM2VZTzhNYWplbU1EMXlPb0VKNkZYZjkiLCJtYWMiOiJiM2M1ZjUxMjNkZjdkNTM0MDk1NGQyNTU4NWZmZmNhMjc2YzI1NGFlMGNhYmQ2NGIwMjY4ODI4YTVlOWE2MjMyIn0%3D; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114558,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"11c0a796a7e9c219938260ec4d01e5db","sha1":"6938def820aefd70ab21409c1d85ba28bbab6c8f","sha256":"51fcc7cff82d008cdd81f7cdc9dfc4029dfa71b798a31f89a7e8145f9ad73bfb","sha512":"598f8e33f36d3d41fac912fdb9b84e0d83296767bb848a9ea0d67a301eb0422929a32360e8878da3ce7373b4c87e93d3bd4a0296951c342293eb351249c5a056","ssdeep":"1536:Mp/efdqgj3lNgaDlNul4Ak0lnCpxpWORxO2MY/:wDPKal4f0lnCAORxkY/","tlshash":"8fb3288053bd01f1c07931983ed359e842aa749b64c38f5542ff4d826ba16fab916e3f","first_seen":"2026-03-16T14:28:38.439525Z","last_seen":"2026-03-16T14:28:38.439525Z","times_seen":1,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31ZD\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:11.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31ZD\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6IlhJMzcxcVY1TTE1R1FvWmNuV2hPZ2c9PSIsInZhbHVlIjoiMmNKa0swbzJteFBqd2NmNm5wTFdJTGRMS0Z5SVNtSHpOejZ5cTh3YldyektlenFWcHhaN3B4ZUk5T003TTNlRzVCRk5odFN0ZEhNdjBTVDcxNXpaVExyNXJyaUhhdlFPREdXWk12STgwRmg1YzdLMGk4QVE2YnZsaWNlRFp0SlUiLCJtYWMiOiI4MGE4YWJmODA2YTM2YjY2MjQ0ZDVjZWNmMTVjNDIzY2UzZjI1ZDM5YjE1MTBmMDVhOThlMzk5MzEyOTlmNDU1In0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:11 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 112601\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":112601,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"fbde048b07b5fe114b687fd30d83ad74","sha1":"e9ede32a252e23a80f1b400c28763081942dc261","sha256":"ecd4c00d78b021104ff34a690864e9953cd5b759e1c83f3c6f856d26ba468001","sha512":"4776357bed9ac2f98223859ae386e46dae075d67c3f623800818ec562e55bf59f871a8850a502d9286a85b31fad1b8229d3337932ad7bbd0083352ef73ff6095","ssdeep":"3072:HTLrFYJfJ3NKlVTgT3dl/xyBMe0dIqw4ZggI46zBhdL:HT/+JfJ3NKlVTgT3dl/xyBMe0dIqw4Zc","tlshash":"0db37d4d57624af4d6f1a3c16cc226fc686e224799c34589c39dae8c82dc36af305d6f","first_seen":"2026-03-16T14:28:38.440542Z","last_seen":"2026-03-16T14:28:38.440542Z","times_seen":1,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/news/list?_timespan=1773671289053","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"POST /api/news/list?_timespan=1773671289053 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nlang: en\r\nContent-Length: 22\r\nOrigin: https://coinbase.wlsp.shop\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"{\"c_id\":5,\"lang\":\"en\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Imh4WG5wUEpIcHlZVEFjVjl2UlJrYlE9PSIsInZhbHVlIjoieDhvNnhjelV3bU81MTEyMGJ0UkVNOGp1M1FQNGJUSGlRTDBiQUViV2h6Q3hYSjBwWmhTeW9SaUowd1QrWmxJNU4wXC8yV2NvSzAyZEdTSFwvQjd3dFEzc1VvN2RoQnJLT0xiZys3eTFvMFJBMjZBcExjUnVvYWtrWnpIZSswSnkwVCIsIm1hYyI6ImZlZjcyOTBjN2YwYzdhNGVlNGEwZGNlZTNmODE5OWJkYjIxMTgyMDJjODJjODkyZTg0NDMyNjVmYmRjOGZkYTAifQ%3D%3D; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":240,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7b4285862a2ec6fe8f68ffeff1b60d4c","sha1":"947fe240622ff5069d3ad7340a04048d493f0e8f","sha256":"90dd1707d03323c24fd43f4b524d39ec228419650d5c64da972e819f356bcfa0","sha512":"63568d7afebba0ced84d6b35ae17d549724bce71f89928e660316f012d76a6b9f02c16110ecbbaa0895c27b1bafb5d63207cd5225e716f440411399f1a42b037","ssdeep":"","tlshash":"f2d0a72e2735dcb7d19a1283e055b6ad77cd9146e68207457bc08d8cc75d1a90817243","first_seen":"2026-03-16T14:28:38.441715Z","last_seen":"2026-03-16T14:28:38.441715Z","times_seen":1,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224423590346.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224423590346.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 1832\r\nlast-modified: Tue, 20 Dec 2022 02:07:55 GMT\r\netag: \"63a118fb-728\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1832,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"462dca013010fdba8e74fbb756b759d0","sha1":"5a9d9f48f2ab09cd77aa14a53427c30a1e95eea0","sha256":"8a15e56aecacab621e6211d22028b0e3e563eec1f1cf7c8097bb91229bd0eed5","sha512":"9c36ca4faba5368c3ccd0bcb3ac97f64bf6c80f3a5ed146206f98a1a25704ec82861ba43ed4c6bae0704b8950a3346b60506b87ffe7d5c7070136b4cc303b1f7","ssdeep":"","tlshash":"1b310973a68d9f34e0b5e8a10cc97010f213c16726d442f2e7bc184458bd8f44a85375","first_seen":"2026-01-11T19:28:09.544201Z","last_seen":"2026-03-16T14:28:38.442784Z","times_seen":2,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt315_\u0026sid=50c23dde046eda4104860289","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.248Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt315_\u0026sid=50c23dde046eda4104860289 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 63712\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63712,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"6fe48d8561e52f197c06502cf99fdd5f","sha1":"042f43a3c23c8375499966382b17cd75250538b8","sha256":"1ce54d346f3eb5b9c40af5e69efaf6e5fddd4f1c0d2365ea4d3d552cd2dbe7eb","sha512":"056fbf9207329f60b21d17db7dd765fa599d3a4d6361a563a93aea46bf294b202e92b52def16296f30ad02d260326f776015974daa17a1191ed05e769e4d9d61","ssdeep":"768:+CfvVeufvGfLfvdspf+Vfv6eoCfvsBfv3B+OfRQBefvjfRf6C4fv4DfvQSf+6thX:JfIDWYZCpekjTogbH8ursLmD","tlshash":"28538d0e9b534af5d6f1a2c16cd126fca86e224799c34588c39dae8c92cc35af305d5f","first_seen":"2026-03-16T14:28:38.443953Z","last_seen":"2026-03-16T14:28:38.443953Z","times_seen":1,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/js/about.1c1b44d5.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/js/about.1c1b44d5.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Imh4WG5wUEpIcHlZVEFjVjl2UlJrYlE9PSIsInZhbHVlIjoieDhvNnhjelV3bU81MTEyMGJ0UkVNOGp1M1FQNGJUSGlRTDBiQUViV2h6Q3hYSjBwWmhTeW9SaUowd1QrWmxJNU4wXC8yV2NvSzAyZEdTSFwvQjd3dFEzc1VvN2RoQnJLT0xiZys3eTFvMFJBMjZBcExjUnVvYWtrWnpIZSswSnkwVCIsIm1hYyI6ImZlZjcyOTBjN2YwYzdhNGVlNGEwZGNlZTNmODE5OWJkYjIxMTgyMDJjODJjODkyZTg0NDMyNjVmYmRjOGZkYTAifQ%3D%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 412\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-19c\"\r\nexpires: Tue, 17 Mar 2026 02:28:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":412,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (412), with no line terminators","md5":"c2103f345f835eba7f94c4e8da404ab6","sha1":"a79921bfa21560019e6e9e92477efc96e207d0a4","sha256":"bb188b8f25216f90a0ae72bb859aa07e27da4a36dd75413d484c06bcdbf3dbdd","sha512":"a32b658e3aec929945095941b09c9312d621f4e661752b89314a5cee7462ffb79c36e4c14e78a390a96fc1f7ef8170a94fb813791f49565e633b0f74600a52cb","ssdeep":"","tlshash":"7fe0a38c7053e9b546ff5089223617c6e315595d6b6080d075e1d2c175346c6402bd1d","first_seen":"2023-04-11T20:32:27Z","last_seen":"2026-05-10T08:37:22.809436Z","times_seen":30,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224454149130.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224454149130.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 1892\r\nlast-modified: Tue, 20 Dec 2022 02:07:56 GMT\r\netag: \"63a118fc-764\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1892,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"de5d412ac5f9e0608a33badbc53a23a1","sha1":"79a08b63b00a43dd507d4314c702ed97955e06a4","sha256":"5193e7d89076a267354421c0748ea37f3d932e62b8a579c75e35981c0235cd05","sha512":"fce5c5ec05c192f182b9e82b43c454de62084ea880a57c4ab62d7858a85bfb58fc8373c549d44701a32933196c53fc77a0a5a84b63216b2bf6f49b9bbf886030","ssdeep":"","tlshash":"8941f77babdc843b846aae1df6c432c197007c079bad34b44d6d0ca65bb6252933067b","first_seen":"2026-03-16T14:28:38.446052Z","last_seen":"2026-03-16T14:28:38.446052Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=BTC%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=BTC%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IlhJMzcxcVY1TTE1R1FvWmNuV2hPZ2c9PSIsInZhbHVlIjoiMmNKa0swbzJteFBqd2NmNm5wTFdJTGRMS0Z5SVNtSHpOejZ5cTh3YldyektlenFWcHhaN3B4ZUk5T003TTNlRzVCRk5odFN0ZEhNdjBTVDcxNXpaVExyNXJyaUhhdlFPREdXWk12STgwRmg1YzdLMGk4QVE2YnZsaWNlRFp0SlUiLCJtYWMiOiI4MGE4YWJmODA2YTM2YjY2MjQ0ZDVjZWNmMTVjNDIzY2UzZjI1ZDM5YjE1MTBmMDVhOThlMzk5MzEyOTlmNDU1In0%3D; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":120275,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"593473d939180b9d811395958ad1fed9","sha1":"930eb181f939ff1425c08eca3283692936c1c8eb","sha256":"c86f57353b699168c5b4bd03d9e09eb8097bd0ed6de206b02b8332d21f9e9ef1","sha512":"6de2a136ed05e6a1d41f693a1a2be381055ce83db68fd0ebbc9233c9b3e418621b6f28a80827434e63fbcf645ad35f7fc120fbe48d26723d7de884219c78f9c5","ssdeep":"3072:ZB1XqufT+efbj0ulrTkTHL4U0ZuNPUpSd7hXi1/ljSWwZs4yjXJiPK84oM9aHooV:31XqufT+efbj0ulkrLt0ZuNPUpSd7hXt","tlshash":"35c3dd4073a901b0d07a65d47e9319a842af735b64c38f9442ff1ec269e17b6ba12d3f","first_seen":"2026-03-16T14:28:38.447237Z","last_seen":"2026-03-16T14:28:38.447237Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1339,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=IOTA%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=IOTA%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Iko5Z0VKRFQ0Z3NZU0hwMXJZNWd6MkE9PSIsInZhbHVlIjoicGZiYlpvemxzd0huYWMxZHZJV2pBRVpVTXZHOVlpVVNCRjdIUzR4c05mMzZsUkwxdmdNWWp0djlPbXp0Uk52WjU4d3crUURpcUtDRkx0RFRDcVRqVlhKa1kxQ1B4blBLSlIwUlwvTGxMYmFlQ3NoUTY5SnJiS2puMFVaVGFvUzR2IiwibWFjIjoiYjk1OGNlOTlmMjI3ZmQzZmE5ZGE0NThiMDQzZDIxYmZmNWVlZjMxZmI1ZTUwMTQ2MGI5NDNhNDI4ZjU5ODM3NyJ9; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108058,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"994e1563df4e355bd26bf1f0d7fc8560","sha1":"0fbe23366b0b3dedc8aed5a218c707bb33c8bb3f","sha256":"96a51844f00315a5055a9ffcd3708f52fcb93c89918ba3b2c5ae2565a7fd614c","sha512":"6144dbb961961b51cad1e70fb4c6214c5b8b518958637d2a560162f320bfb6a37087ecc7a53d028f0b567829ac0a5b8b1cc82a73c0ffcb41497a0d4db9717001","ssdeep":"768:mp6g5drcvqDroc1DCE7Ins2NUrmK8t+RMPYxcjFsXNS3Vlc6pNMmATzqhRcuJJTc:E6gYXlbA8MMPYxcjFsXNS3TN3ATkCsS","tlshash":"52b35a0053bd0274c07923d43f9219a842aa745b64c38fa542ffcdc56be16bab616e7f","first_seen":"2026-03-16T14:28:38.450341Z","last_seen":"2026-03-16T14:28:38.450341Z","times_seen":1,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=XRP%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/currency/new_timeshar?_timespan=1773671289728\u0026symbol=XRP%2FUSDT\u0026from=1773066489\u0026to=1773671289\u0026period=60min HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6Ildoa2RlWStLZGQ3M1F2YnhUYTVWbUE9PSIsInZhbHVlIjoiNWRwUWpiTG1pRXR0T2pNdFhHK0NkeHp1MGpndElRT29uTmhxRmhoR3pOWHNqSHpJaXFIN2kzZWMwb3Z0aW9Oam12MGJwWUNoY2srU2hhSENETGpSdDJOSzRzTjI2XC9raDNTTG1WSWlzNHN1dkc3MmpQbFFSbDIyMmRNaHoyUzRQIiwibWFjIjoiN2JkZThiMzgwOWIxZWRlZThiYTc3M2VlMjM0Yzc4ZjEzZjNjNjlhNWNhNjgwNmZlNzU4YmM4NzYwNjI4MzFmYyJ9; expires=Mon, 16-Mar-2026 16:28:10 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":116757,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3eecc32bcaef8fc53723aac3a9946cb2","sha1":"e2f52a527900818e0e5910071dc3cbdb2dd4c875","sha256":"1e9cfb1a8c42513f0ba01bf968aa6e4c9cc80d0da8a8ed99772f7d3607b70a38","sha512":"27384139d9064bde1493d5ecd8980affb3d4e3f60348ed2b668d4639bba4e7623680521d87096f699a491febb1ca8d287d00dd14e6eeac78c629c81b1f998bdf","ssdeep":"1536:BT7wj4bSffurgS+Bkr9vJ/gHidKqHLuURxEWN8wRmz7loa25Ey85:BDWw8i7dhnRxEJTBorEz","tlshash":"16b3800253a901b0d07a25d43d931ca87e6a305b60c38fa56aff0ed55ae16b6f602d7f","first_seen":"2026-03-16T14:28:38.451546Z","last_seen":"2026-03-16T14:28:38.451546Z","times_seen":1,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/css/chunk-vendors.cd8d6c25.css","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/css/chunk-vendors.cd8d6c25.css HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-1a75f\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108383,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (48965)","md5":"9591febe38b032fdf8aa77269a885b1f","sha1":"930249ebb2ae1df605dfe08c4b9421c3b32ba66f","sha256":"1d3e7bbd677424d0ebae0eab62c0f895b1285eb2726ccf45491968f7f10c23a4","sha512":"c84d2dcedf60197bd8ef2ed8a490a05e30941229933ceb122469fe1b87510ca332e0e2591118e857398c65e30cfc99d44de551268d35f71d63be884afd16e77a","ssdeep":"768:Vb6CObhrb63if65WJ1mXAA0T8/9EBtMUfaIA6eXe1HP+m2Qiw+0QLxcj7L/zlooG:p6vASf65WCXkpEe1HxJQoeZ9LnsY","tlshash":"60b3e8a06a01211ef123cb1a45c0da49723fc94ffe73569eb6146905ffca5eb0263f99","first_seen":"2026-03-16T14:28:38.452472Z","last_seen":"2026-03-16T14:28:38.452472Z","times_seen":1,"resource_available":false,"data":null}},"time_used":896,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":896,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/js/app.76fa8aec.js","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:06.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/js/app.76fa8aec.js HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69b775c4-156b2c\"\r\nexpires: Tue, 17 Mar 2026 02:28:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1403692,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"58d0239a1c6b4d0ba483cd4f5e8182c6","sha1":"ad3de8505c302667aa4e1dfa94407ab02d686d03","sha256":"7535b18062375f5f40bb7183c38efb624903d63f88ba740504365db31b430ce7","sha512":"c3753943b8f93a852649da3d1030645c61663e16485ad15f05a2f72cfbee0d47dd8c27426dd6ff4e2fa28fa12997b5fe1ca1ec85bbd31c965c81a86c2e88ce17","ssdeep":"12288:6H/HPjHNH5HjHZkX0JPdxt4OJ+Ho4XPapT52WNelaCgKNkU4eWoMhO7RJtsel0oG:KVJdx+ZapTNrq/3NjRmwUPJF/p9","tlshash":"ee55093a53c3c1fc6a22d2a9901eb054f1ae1db9fbc1e1501a7cda6421ddcc4e64e77a","first_seen":"2026-03-16T14:28:38.453545Z","last_seen":"2026-03-16T14:28:38.453545Z","times_seen":1,"resource_available":false,"data":null}},"time_used":894,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":894,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2302506_dnypp4o56e5.css","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:07.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tbcdn.cn","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 28 Nov 2025 03:07:13 GMT","end":"Sat, 18 Jul 2026 09:41:04 GMT"},"fingerprint":{"sha1":"01:40:62:EF:8C:E5:C1:8A:19:4C:8D:B6:F5:C2:24:7F:DC:C0:9C:8A","sha256":"60:3C:41:A0:78:62:E6:5E:82:F0:FA:CF:5C:C9:D3:22:E4:64:EE:1A:EE:C7:CC:BA:DD:25:08:90:6F:CC:C4:F2"}}},"request":{"raw":"GET /t/font_2302506_dnypp4o56e5.css HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: text/css\r\ndate: Tue, 16 Sep 2025 06:11:41 GMT\r\nvary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Origin\r\nx-oss-request-id: 68C8FF9DB09677323028FF62\r\netag: W/\"DA266D30906B403389BB1C971C7B4CBC\"\r\nlast-modified: Fri, 24 Dec 2021 21:20:51 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 8281916514372716533\r\nx-oss-storage-class: Standard\r\ncache-control: max-age=63072000\r\ncontent-md5: 2iZtMJBrQDOJuxyXHHtMvA==\r\nx-oss-server-time: 21\r\nvia: ens-cache1.l2de4[0,0,200-0,H], ens-cache29.l2de4[1,0], ens-cache6.se2[0,0,200-0,H], ens-cache3.se2[2,0]\r\nage: 15668186\r\nali-swift-global-savetime: 1758003101\r\nx-cache: HIT TCP_MEM_HIT dirn:-2:-2\r\nx-swift-savetime: Fri, 31 Oct 2025 16:23:24 GMT\r\nx-swift-cachetime: 59147297\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\neagleid: 2ff62c9717736712876348734e\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":33094,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (26377)","md5":"da266d30906b403389bb1c971c7b4cbc","sha1":"7a5f12ded3a07d0b84a0aa9a425c161c7556455f","sha256":"072b3cae79ec33622136917427e7df44c9b8d8c1e59210e8e92cf66e916f16d6","sha512":"9d0b4dc7082db77f2e0ef1e5e4860867c291c2492a53921e6f089243ea5cc34d125ff2cc82d621485a5c8ef7470a62333ad1f58dcd20d83e4000dd4ed41ea41f","ssdeep":"768:gGHe/hPuLX7QHVX1jpc6Ic2lefYCG7f0tNI6:gG+ZPuLrQ1X1ye2IfK7q","tlshash":"dae21cf089bd2cb44758d1c12657a714ff18a6a98d8b5c4fe2a37d9ca7f72009093adc","first_seen":"2023-04-13T23:29:04Z","last_seen":"2026-05-31T17:49:49.190657Z","times_seen":165,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/api/cfg/kefu?_timespan=1773671289053","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /api/cfg/kefu?_timespan=1773671289053 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nContent-Type: application/json\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-credentials: true\r\nset-cookie: angela_session=eyJpdiI6IjYzK29EeVhDMEQ2MjRWZmgxelwvQmRRPT0iLCJ2YWx1ZSI6InlBK3YwMkcxYTdSc1NmVnMwcGFkZVFTTXc0ek9WUFJtQStJRGhYVzE1S3hhMGRXVkQ0U0ZqM1p4MnV6VXAyZUNtSis4UXlmcFhVR2VWQkhKR2RadFV4TVVkdlZ2M3MwWlRaYW15djRSZ3RyQlNEXC83NjZhZ3lBZmNLWUkrcHZMaiIsIm1hYyI6ImU1MmIyOTk1NmMxZmE0M2YzOWY2OTE5YTg2Zjg2Zjc5MTNmOTVjYTY4ZTZhMWUyM2YyZDI0NmY2MWMzMGZmOWMifQ%3D%3D; expires=Mon, 16-Mar-2026 16:28:09 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":275,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b5d7cf496af4bd2c699ff191e58ced25","sha1":"659135895b3a2f5daaed300f3d9b3ac167794dd6","sha256":"d5362a221ac1c9cf8893f059fb0a8c69417cc572a817fd0881d391bcb085e09e","sha512":"b1a84d549d3f080b3590346c4140ba711bd72930fdce911bb9eec38cb99af408d150851a0219984caf66d533717940e6fd7beb3d720418d79f7d2e79c8250b92","ssdeep":"","tlshash":"cad02b37c20dda26708d50c010416881d4a72147d0003c92ce58bc3cc25f7fc50ad178","first_seen":"2026-03-16T14:28:38.455012Z","last_seen":"2026-03-16T14:28:38.455012Z","times_seen":1,"resource_available":false,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1700322993781432.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.566Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1700322993781432.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 17768\r\nlast-modified: Sat, 18 Nov 2023 15:56:33 GMT\r\netag: \"6558deb1-4568\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17768,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit gray+alpha, non-interlaced","md5":"41d5dc0b397848cdfc4bdca41a600c05","sha1":"d0c4ca0182d9761e6414ea34d1d554b4f5177d47","sha256":"74f2876f444d9e710f8a7b98fd6d40c91720b9f7a09ea7356694037c0a24b3f7","sha512":"8c3e66622e40a9574bf4c24bf4c3d01049035f5c2029c02c9d72b0ee4c2a51d231f72cafaa31811731752f14ced8be630ca5802da53398ac0c44c75bf2c80d08","ssdeep":"384:/j9aWVlYsqQI9ftA8cq3LgaXqziAgWebYiGMdBc3qPzm2U:/5fqhhGqb6zBbWYiGMdBc3p2U","tlshash":"3c82d0f30e06473491191fbb33cbab248734ca648b8ec75562d127e9a8af7b8402d865","first_seen":"2024-06-21T23:30:23Z","last_seen":"2026-03-16T14:28:38.456099Z","times_seen":6,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Oe\u0026sid=3a243dde046eda4102a6af15","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:10.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Oe\u0026sid=3a243dde046eda4102a6af15 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6IktDS3hmN0FiMlIwYnpvcnRZWWlldkE9PSIsInZhbHVlIjoiYXhLOGdOcWUyWlhxR255azRWZFFnOFJ0am9BT255MjNIeFI4TWYzdDZrSW5kYVlwbFhBYmdKcUVTZzJqTTBPNFpCcXhtMHNoQTlVeEpYaUVlc2lPdWVSU3NvbXFvVzhZZ2d2eUVOeUVcL2Y3WUkxYlpFazZFWWg4cXVZSHErd2pZIiwibWFjIjoiMjMwOTYwMDlkNmNlNWEwYmU5YTdmNGNjMGJmYTg2N2ViMTczMTc0ZTJkNDNjZDZiZDAzOGExZDgyODg3M2ZkMSJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:10 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 96809\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96809,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"379f87c719068d4289bd781339a1cb61","sha1":"655253eaf23b3a12e7165dd88593616086c90844","sha256":"ca2e3dce068e664e0d99bea9ad31f9f4e4809602e4a287badc2c79a812781b32","sha512":"1a2401a759ba35bc6f9a0ec00af3d3fbc5944fcf1868e0733806827a40de512a9454659050e159729f32abd704a2f202d388c975f029ed9f29a5a76f6342b0cd","ssdeep":"1536:Kgl+ox+g5/czIoHJroj4r/odI63Qppg34YJdJHh:Kgl+ox+g5/czIoHJroj4r/odI63Qppgp","tlshash":"a9937e0d5b634af5d6f1a2c16cd126fca86e224799c34588c39dae8c82dc35af305d6f","first_seen":"2026-03-16T14:28:38.457448Z","last_seen":"2026-03-16T14:28:38.457448Z","times_seen":1,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/mobile/img/logo.ce572dd6.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:08.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /mobile/img/logo.ce572dd6.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 10246\r\nlast-modified: Mon, 16 Mar 2026 03:15:16 GMT\r\netag: \"69b775c4-2806\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10246,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 358 x 100, 8-bit/color RGBA, non-interlaced","md5":"ce572dd6ea8c271ad6ef6b66f8fd09f2","sha1":"59202396b73df735c0a08f1c602464c11af82b43","sha256":"d92267daa92029cdfd283d794317e527256d7cda95ea7e9bb6295b48ae669a21","sha512":"e95be428dcffc372c162259e5e9bcbd59ae409bd420caab3a0153e98b9bd26a02b23fe14f6a01da6e80285e67f6151d2664f545a14e48f964f656a6a890712b7","ssdeep":"192:nLwtBvvZSE+78gThuSTvNtlrM8l6XhJhTv8goARIOszDe8dqvFH9F:nLwtBZ7gThv7i8lyPN8go1HS22dF","tlshash":"cd22bfccff9c5d236a8f81b229c6ba1549a3a18cc6e9b93225194c534c0527dc56cc72","first_seen":"2026-03-16T14:28:38.458886Z","last_seen":"2026-03-16T14:28:38.458886Z","times_seen":1,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":225,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1700309266481587.jpg","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1700309266481587.jpg HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Imh4WG5wUEpIcHlZVEFjVjl2UlJrYlE9PSIsInZhbHVlIjoieDhvNnhjelV3bU81MTEyMGJ0UkVNOGp1M1FQNGJUSGlRTDBiQUViV2h6Q3hYSjBwWmhTeW9SaUowd1QrWmxJNU4wXC8yV2NvSzAyZEdTSFwvQjd3dFEzc1VvN2RoQnJLT0xiZys3eTFvMFJBMjZBcExjUnVvYWtrWnpIZSswSnkwVCIsIm1hYyI6ImZlZjcyOTBjN2YwYzdhNGVlNGEwZGNlZTNmODE5OWJkYjIxMTgyMDJjODJjODkyZTg0NDMyNjVmYmRjOGZkYTAifQ%3D%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 117230\r\nlast-modified: Sat, 18 Nov 2023 12:07:46 GMT\r\netag: \"6558a912-1c9ee\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117230,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 168x168, segment length 16, progressive, precision 8, 956x629, components 3","md5":"2c8fe6fc563f3945435c55c8e316da17","sha1":"731e0e37836bcc30e0d89cf9f2c4862eaa93d3d5","sha256":"a50c91d2a68e0a28fe90e04acc818d095333062093d91248092d40c166ead297","sha512":"3c08f953ba48d5d49768e7a85cef7b12ced02e1e8294fe60af9337a865150f98cfa1b3df0b0bb59229dd51c5a2fdea158040cd9b29f6d4507579d253774d58fd","ssdeep":"1536:WyOTPwhGPozDyDOUxDGMa/peTuxnP1+/SE/6LmH0IzuE5oc5cxB/flGbazyY/cOS:WdTPooKMaYMo/SYFHDuRlkazy+gy67Np","tlshash":"45b30299bbc05a36383cdc6879b4e3654e036ec03da32bf9a4eb82897b74d10745c5b0","first_seen":"2026-03-16T14:28:38.460086Z","last_seen":"2026-03-16T14:28:38.460086Z","times_seen":1,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Ak\u0026sid=3a243dde046eda4102a6af15","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=Ppt31Ak\u0026sid=3a243dde046eda4102a6af15 HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Imh4WG5wUEpIcHlZVEFjVjl2UlJrYlE9PSIsInZhbHVlIjoieDhvNnhjelV3bU81MTEyMGJ0UkVNOGp1M1FQNGJUSGlRTDBiQUViV2h6Q3hYSjBwWmhTeW9SaUowd1QrWmxJNU4wXC8yV2NvSzAyZEdTSFwvQjd3dFEzc1VvN2RoQnJLT0xiZys3eTFvMFJBMjZBcExjUnVvYWtrWnpIZSswSnkwVCIsIm1hYyI6ImZlZjcyOTBjN2YwYzdhNGVlNGEwZGNlZTNmODE5OWJkYjIxMTgyMDJjODJjODkyZTg0NDMyNjVmYmRjOGZkYTAifQ%3D%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 40149\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40149,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"7a6044151e66ac22d33593b28989677e","sha1":"a51a7e1c8cb42e658c915621cf0b3134612d6940","sha256":"63bea68edacd7b62b852f88998840ecccca1de2c93ff3c13271b5b1e5d0a59bf","sha512":"7ef418224bc672299455e693ea124c737a031d024841fc7d6c230309bf0bf75ac697c2366b4303c1db11823afba06161ea467ee1e02cfb757b2d27afdad646ad","ssdeep":"768:H0zfvHkfRutsfvpcfR+Vh9JHp4tGJH9DfvPVi9JvpPMfvEDztGJH9P:UrsLmK9JVJHNA9JOtJHh","tlshash":"7d03d30d57664af5d5b1a2c1acd13abc682a671399c349c4c3adaf4c83cc799f305e2b","first_seen":"2026-03-16T14:28:38.461236Z","last_seen":"2026-03-16T14:28:38.461236Z","times_seen":1,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.wlsp.shop/upload/1620224480260141.png","fqdn":"coinbase.wlsp.shop","domain":"wlsp.shop","tld":"shop"},"ip":{"addr":"116.204.186.197","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbase.wlsp.shop/mobile/","date":"2026-03-16T14:28:09.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbase.wlsp.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 02:12:01 GMT","end":"Sun, 14 Jun 2026 02:12:00 GMT"},"fingerprint":{"sha1":"A5:23:3C:7C:0A:A5:4D:2D:58:88:C4:FB:24:B9:F8:C0:55:73:DA:C4","sha256":"2C:2F:3B:DD:A6:52:62:6D:CD:AE:06:74:7F:5D:9C:7D:28:EF:66:B9:E9:72:7C:E2:48:69:2E:3E:EE:4F:C4:86"}}},"request":{"raw":"GET /upload/1620224480260141.png HTTP/1.1\r\nHost: coinbase.wlsp.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.wlsp.shop/mobile/\r\nCookie: angela_session=eyJpdiI6Ijc3WWtDcHlld1FqcFgzdW5OUXpDN0E9PSIsInZhbHVlIjoiMDkySXgxYmdibnBuVjhMZ0ZRU1dVY0tRY2pJN1kyS2VVV3BRbjgrRTRNOEdNQkt1Vll2azFUUTI5OFp5MVhtWVRTanNJazB1b3hreDQ5VjY0OGU0VWZcL3pmdHVjN1ZvV21CR2RBUGhna1NWd1VwSzRTUFF6Z3JUbElMN3FvMHRrIiwibWFjIjoiZWNmZjZiMjNkYTExZjYxZmU4ZTJhN2FiMGE1ZTdiNGQ1M2Q2MTE3ODJhMjg0ZGYxZmY3OGEwZDE5MWRkYTYzMyJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 16 Mar 2026 14:28:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 2318\r\nlast-modified: Tue, 20 Dec 2022 02:07:56 GMT\r\netag: \"63a118fc-90e\"\r\nexpires: Wed, 15 Apr 2026 14:28:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2318,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"20db8a464d9fdab8782f54cadaaa4c4f","sha1":"484ba0dc09f4e443a87e8f6efb623ace117ee914","sha256":"2cb4c1a07e809a3f5421c66b36fb098dc24c2db01dd244c5a59640d3a81d90e8","sha512":"ca280bff0b4a81cbf5b667d9d49955c62c63637be205fcde7a75e2e245e77473f2d71f4168751a67f6166fc50d8a0e891e012b738c0f274e3107fd25b09593ab","ssdeep":"","tlshash":"fa414dc942f1025ec81720fe34c85d98f9c2894c6e68da871606e306baf131933a6e75","first_seen":"2026-03-16T14:28:38.463619Z","last_seen":"2026-03-16T14:28:38.463619Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"coinbase.wlsp.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}