{"report_id":"c3c5dfb9-d00f-4faf-b604-1173035b8c89","version":0,"status":"done","tags":[],"date":"2026-09-22T20:48:07Z","url":{"schema":"http","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.197.3","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"title":"$XRPH — Intelligent Healthcare. Real-world Rewards.","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.197.3","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T20:48:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"xrphealthcare-proposal.xyz","ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":15,"request_count":5,"received_data":3164407,"sent_data":2420,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-20T22:43:34.841753Z","alert_count":0,"request_count":1,"received_data":684,"sent_data":594,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-09-22T21:45:01.511297Z","times_seen":95058,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-09-22T22:11:40.503413Z","times_seen":239750,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-09-22T23:49:00.650794Z","times_seen":759076,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/fast-stream-v2.3.min.js","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrphealthcare-proposal.xyz/","date":"2026-09-22T20:47:22.080Z","timestamp":1790110042080,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrphealthcare-proposal.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 11:41:50 GMT","end":"Thu, 10 Dec 2026 11:41:49 GMT"},"fingerprint":{"sha1":"03:C5:F5:90:F9:C7:47:D9:F7:FB:E0:3F:8A:F0:F7:68:25:F4:D5:FB","sha256":"EE:1C:D9:F1:75:F2:C6:BB:18:20:15:27:31:4C:76:F8:9D:65:25:D9:32:F4:DA:76:FA:87:3E:8D:50:5C:DF:24"}}},"request":{"raw":"GET /fast-stream-v2.3.min.js HTTP/1.1\r\nHost: xrphealthcare-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xrphealthcare-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Fri, 11 Sep 2026 10:53:28 GMT\r\netag: \"2fd519-65b32e503402f-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:47:22 GMT\r\nserver: cloudflare\r\nage: 168\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=73p7hO2KvgV3Kgmr7WlQDZ1ub4pZ%2FesB%2BKvD0GLIMH8GMKGg0qRTm0c11Ri6feLU%2B%2FUmB%2FSPrENTn7WrxU9S5cRe9NK6kaiodMVKekzCRSmrjQvAtK4f60%2BRS8EI8DBT2Yin1GM2xtJ8sjlxQg%3D%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: a3f42a1308e32efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3134745,"size_decoded":757946,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4700a1766dca3a208548ffe3b23e6d82","sha1":"6fd99942789febe74c19deb9848058ca87e9f239","sha256":"69e9efc1a4106ecd6ec526987b680224b211139cad744ae2a08ead4caaa9f6d4","sha512":"ec19997f8aa8e259cc36893e7709f7e5292fb9a0861579a7e68d0bc2d6349d9aeb73ca3491146c5ecf58cf19c11c7ae6a63c7cff4ee33b7563c01f1cc4f17cdc","ssdeep":"24576:FC0fiY6+m459FRxVdxhxZSYdFisuLILD7eSOS+6eaqDDtvvVIaIKdjWEMx2qQraY:kT+05/bF2KHeB30nl","tlshash":"e3258613a2d078d241d75eb1b62350dafc2d4bafb48c9afa998cf834fce1054e598674","first_seen":"2026-09-22T20:48:12.861955Z","last_seen":"2026-09-22T20:48:12.861955Z","times_seen":1,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/styles.css","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xrphealthcare-proposal.xyz/","date":"2026-09-22T20:47:22.083Z","timestamp":1790110042083,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrphealthcare-proposal.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 11:41:50 GMT","end":"Thu, 10 Dec 2026 11:41:49 GMT"},"fingerprint":{"sha1":"03:C5:F5:90:F9:C7:47:D9:F7:FB:E0:3F:8A:F0:F7:68:25:F4:D5:FB","sha256":"EE:1C:D9:F1:75:F2:C6:BB:18:20:15:27:31:4C:76:F8:9D:65:25:D9:32:F4:DA:76:FA:87:3E:8D:50:5C:DF:24"}}},"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: xrphealthcare-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xrphealthcare-proposal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Fri, 11 Sep 2026 17:49:54 GMT\r\netag: \"3038-65b38b63cd480-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 22 Sep 2026 20:47:22 GMT\r\nserver: cloudflare\r\nage: 168\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mQFJYQqOZcL8GucVTQQdqZHCDzdII9EN2ahGoP5dihZz4vHWAjOrmG2tIvgI0ueANGJa2kpLboWKd%2FmMz37otozWBA92Ta5Gsfo%2F6TZFUptSm1Nyh%2B9XFvV9Y4%2Ft72LYrA9198JPc9oCpyBaOA%3D%3D\"}]}\r\ncf-ray: a3f42a1308e42efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3717\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12344,"size_decoded":4493,"mime_type":"text/css","magic":"ASCII text, with very long lines (8188), with CRLF, LF line terminators","md5":"1721a5de51b22e5fc5c8f94b4b47f1c6","sha1":"b515968f643f29b952d1c15db83d805de1de8d9e","sha256":"a8dfb770eb6bd8087a6cf308f42395b711b24fd24fb768b5741aa5b9bb80362c","sha512":"7f984a366240189d40716ca70e9d813e67a0d0eebb29302e17b7c804531d27f9f69f28140d303cd9b750cc976869a50d89e2277fb7f47c3c0748563471c0f26d","ssdeep":"96:4dn7YiWecVBfdPo63UczrRywlvQsGlRUYAlJ+lV03gZ8oESMyVCwRoufLcE4BC2h:4W9zfdgKU2vQsrJ3gCnyMghYDQWpb","tlshash":"984251a2b318223cf53be966b5d0679e7014e917a2730bedec82e665c9c71b31721349","first_seen":"2026-09-22T20:48:12.863954Z","last_seen":"2026-09-22T20:48:12.863954Z","times_seen":1,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/script.js","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrphealthcare-proposal.xyz/","date":"2026-09-22T20:47:22.089Z","timestamp":1790110042089,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrphealthcare-proposal.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 11:41:50 GMT","end":"Thu, 10 Dec 2026 11:41:49 GMT"},"fingerprint":{"sha1":"03:C5:F5:90:F9:C7:47:D9:F7:FB:E0:3F:8A:F0:F7:68:25:F4:D5:FB","sha256":"EE:1C:D9:F1:75:F2:C6:BB:18:20:15:27:31:4C:76:F8:9D:65:25:D9:32:F4:DA:76:FA:87:3E:8D:50:5C:DF:24"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: xrphealthcare-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xrphealthcare-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Tue, 15 Sep 2026 17:34:42 GMT\r\netag: \"1325-65b88f73e5080-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:47:22 GMT\r\nserver: cloudflare\r\nage: 168\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fruu029pSyjpnqwveDRatvQJ5DbcqnwdmC5kNsx7L7yvaZgMKYPin5p%2FBuho787N2LtYY5RY9CYQrmvg0d4BgzvSGGnzRdEpi5A8RoYNI9QkuxYJDqYwKRtAaPuS31NQp8fXEWzLOQKTSF1Ieg%3D%3D\"}]}\r\ncf-ray: a3f42a1318e52efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1838\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4901,"size_decoded":2617,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text","md5":"2c74b2b9e0b344409773fad96bb24a21","sha1":"1d6cb6e55a34c5c7b2b17c50c3ca5b2a432c6f4c","sha256":"f64251d2885ad357d5cb5d60bad50fc02ded371d2fdbf98f80895f57a2ff385a","sha512":"f2a3efb9a266d305293e1b33f71fa6878b393cfa1446fa1cf5a35ff35cbdffd37374ce0a13536742234f3ddc4f163d0d6e983c1f97148fd78a2cf12457f36739","ssdeep":"96:GiT+Jwx90HsvOqtPcZcUR5MGEIlZoVKzMaKEdZ06lgSfE6VE6p3bww:xT+igM7tPcZcm5MG9zMaKqmCgC9pww","tlshash":"c7a184d96ab861360d3b022b72c6a28b7f3520427107fd6d959d4a043f94d6973f7ce2","first_seen":"2026-09-22T20:48:12.865651Z","last_seen":"2026-09-22T20:48:12.865651Z","times_seen":1,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/reference.jpg","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xrphealthcare-proposal.xyz/","date":"2026-09-22T20:47:22.093Z","timestamp":1790110042093,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrphealthcare-proposal.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 11:41:50 GMT","end":"Thu, 10 Dec 2026 11:41:49 GMT"},"fingerprint":{"sha1":"03:C5:F5:90:F9:C7:47:D9:F7:FB:E0:3F:8A:F0:F7:68:25:F4:D5:FB","sha256":"EE:1C:D9:F1:75:F2:C6:BB:18:20:15:27:31:4C:76:F8:9D:65:25:D9:32:F4:DA:76:FA:87:3E:8D:50:5C:DF:24"}}},"request":{"raw":"GET /reference.jpg HTTP/1.1\r\nHost: xrphealthcare-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xrphealthcare-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\npriority: u=3,i\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Tue, 22 Sep 2026 20:47:22 GMT\r\nserver: cloudflare\r\nage: 168\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2nWI4HUGr0O9a%2FHY4Ct8XdIxuhKTfy0vkJdIazeZKbS6yBZyTBFynJSkpSgFQ96iHGsMKgQF0kcmPIF17SIoR4fPFGGLveYDBn2Oi9H24Ah9tLRu12aTclQ9lybQsi6AuV668SU8g9TJsRn2NQ%3D%3D\"}]}\r\ncf-ray: a3f42a1318e62efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":273,"size_decoded":860,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"98a35aeb2f0366a8e6d426a950767844","sha1":"12bea91288d2345101c6c9cbfb9d46893b7219d2","sha256":"c53960bffdcf8bc759163f310aed9ca163a62c87ff8f6dd3fc6798d97fef16ca","sha512":"428da2212fd3dbe9b8af0e34c6392c046bda349a50c4f8574cbf6907921bde8cd860b8eff811646c7d77f4779ce348098b9951a929b27bf9c4089cbf13560788","ssdeep":"","tlshash":"60d02b9ea04323ab081125d039c511c3738c13f6b47a85a83d85e897525863dcdc919d","first_seen":"2026-09-22T20:48:12.867404Z","last_seen":"2026-09-22T20:48:12.867404Z","times_seen":1,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:wght@400;450;500;600;650;700\u0026family=Space+Grotesk:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xrphealthcare-proposal.xyz/","date":"2026-09-22T20:47:22.357Z","timestamp":1790110042357,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /css2?family=DM+Sans:wght@400;450;500;600;650;700\u0026family=Space+Grotesk:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xrphealthcare-proposal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 22 Sep 2026 20:47:22 GMT\r\ndate: Tue, 22 Sep 2026 20:47:22 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xrphealthcare-proposal.xyz/","fqdn":"xrphealthcare-proposal.xyz","domain":"xrphealthcare-proposal.xyz","tld":"xyz"},"ip":{"addr":"104.21.21.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T20:47:21.725Z","timestamp":1790110041725,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrphealthcare-proposal.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 11:41:50 GMT","end":"Thu, 10 Dec 2026 11:41:49 GMT"},"fingerprint":{"sha1":"03:C5:F5:90:F9:C7:47:D9:F7:FB:E0:3F:8A:F0:F7:68:25:F4:D5:FB","sha256":"EE:1C:D9:F1:75:F2:C6:BB:18:20:15:27:31:4C:76:F8:9D:65:25:D9:32:F4:DA:76:FA:87:3E:8D:50:5C:DF:24"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xrphealthcare-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Fri, 11 Sep 2026 17:51:56 GMT\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qEmDLEZDOiPbhWfaOXfgP%2FyeftrL9Jp6y9t8ZWJhrFnVgb5YD8KmFx1luU8nvik0ObcPpFdOUM276Q1E8gS3aGFSPB0e2H6WR3AUoJJmo6k1APKMVUpnWIx%2Bz6zbSRb9JaJJ%2FBpjkPvDP1WCpg%3D%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncontent-type: text/html\r\ndate: Tue, 22 Sep 2026 20:47:21 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a3f42a10f8802efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8521,"size_decoded":3752,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1035)","md5":"8a0ece86d3e950121f22a74b7d8c53e1","sha1":"069c29bc2bb47e19796f8f0e8b77a2d15502879a","sha256":"49762c0b0c7899ef3329af3d2b79ad0b63fe2b5394789775c2e962662d79e6d1","sha512":"94257fa6228b6a3545713c4f90514e66a58cb858782814aeb7e7fd66e3bc21cd02f4c926e1524d4eb9601df37214ecfed72d003ee39761747b7d2f36a053e418","ssdeep":"192:YmdIG6MlYvY8vKLP07JZNH3teRsN137lhNxL20Gu4DUrP:YmdI+8eYJZd3tusLLlTws44rP","tlshash":"3d0262d9f1b31077423782eb22e7a3a679f28216e1451510f2fc437c1beed99b81b45a","first_seen":"2026-09-22T20:48:12.869366Z","last_seen":"2026-09-22T20:48:12.869366Z","times_seen":1,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":3,"connect":20,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"xrphealthcare-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}