{"report_id":"c84ef3d8-39f3-49e0-9b36-d861e8dabcba","version":6,"status":"done","tags":["suspicious"],"date":"2026-02-25T21:51:43Z","url":{"schema":"http","addr":"punchinsolana.com","fqdn":"punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"title":"$PUNCH - The Sanctuary Monkey","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T19:51:56.000454Z","times_seen":17875501,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"punchinsolana.com","fqdn":"punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-01T21:51:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":8,"urlquery":2,"analyzer":9}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":43224,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.245725+0000\",\"flow_id\":310929574760615,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":43224,\"dest_ip\":\"104.18.54.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.54.45\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":43224},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2026-02-25T21:51:22.233639+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":43234,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.245805+0000\",\"flow_id\":1683214575508832,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":43234,\"dest_ip\":\"104.18.54.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.54.45\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":43234},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2673,\"start\":\"2026-02-25T21:51:22.236896+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45802,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.246452+0000\",\"flow_id\":718841946221174,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45802,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45802},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2674,\"start\":\"2026-02-25T21:51:22.240246+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45812,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.249427+0000\",\"flow_id\":544801281456355,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45812,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45812},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-02-25T21:51:22.243939+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45830,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.264861+0000\",\"flow_id\":1573759481465075,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45830,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45830},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2599,\"start\":\"2026-02-25T21:51:22.248051+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45818,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.270811+0000\",\"flow_id\":779220596475984,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45818,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45818},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2599,\"start\":\"2026-02-25T21:51:22.247888+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45844,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.432313+0000\",\"flow_id\":82031440197840,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45844,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45844},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2674,\"start\":\"2026-02-25T21:51:22.424144+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-25T21:51:22Z","timestamp":1772056282,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45846,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-02-25T21:51:22.487391+0000\",\"flow_id\":446882469525078,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.35\",\"src_port\":45846,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.35\",\"port\":45846},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2673,\"start\":\"2026-02-25T21:51:22.472662+0000\"}}"}],"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-25","alert":"Hunting_JS_WebAssembly","trigger":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"uygft-a78s.vercel.app","ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2026-02-25T18:10:52.490414Z","last_seen":"2026-02-25T18:10:52.490414Z","alert_count":0,"request_count":4,"received_data":2851647,"sent_data":2268,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-02-22T22:14:59.650342Z","alert_count":0,"request_count":6,"received_data":196654,"sent_data":3298,"comment":"","tags":null,"fingerprints":null},{"fqdn":"connect.sol.ms","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-10","domain_rank":0,"first_seen":"2026-01-18T23:46:03.161332Z","last_seen":"2026-02-18T20:55:08.956048Z","alert_count":0,"request_count":1,"received_data":2847709,"sent_data":591,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"punchinsolana.com","ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":46472,"sent_data":486,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"www.punchinsolana.com","ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":10,"received_data":515331,"sent_data":4627,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ext.same-assets.com","ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-13","domain_rank":0,"first_seen":"2025-03-18T08:10:55.085553Z","last_seen":"2026-02-25T03:38:02.076976Z","alert_count":0,"request_count":5,"received_data":2985311,"sent_data":2371,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-08-23","domain_rank":0,"first_seen":"2026-02-25T03:05:04.781981Z","last_seen":"2026-02-25T03:05:04.781981Z","alert_count":8,"request_count":8,"received_data":5883400,"sent_data":3848,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4f58df8ef556437633bb90cc31469c4","sha1":"c1c713bb5046a54cb79a8e7537b6d7fca624fd45","sha256":"2dcb2e50c883929aebb7a64a7a22cfe2260d856a3c36a6926c082da19c552b7b","sha512":"54c8a79f5897cd198db689700c24f950ad7fe19eed815f8bfa0e47428701d8c84a1fd8f677a6f1b2a4f1443f35f2dbd19e6f456ceeebfb1c59275bb356e1a5e9","ssdeep":"","tlshash":"bfc02b041427c47b421c6f4dc02243d4e4b020bcdc492480801d181800d0c313b40cd6","size":130,"data":"","first_seen":"2025-03-25T18:26:20.414558Z","last_seen":"2026-08-13T19:49:18.146879Z","times_seen":53076,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1a6e1178e4bbf5730bd664a49dd3bc24","sha1":"17c3ae3273f9de6afbbdedf2e413dbb3a6722792","sha256":"3814cddd18b2095e01abb745a99e5ada90178e709c09879324c3b623f2d829ea","sha512":"cfb1aab0bf589e33fd12906f448ddbbf7163420a088de513b174304c9ba3a7abcd9b41c98bc4dd51edd0206c1fe4660db9857e3c6163d1bf50c670cefddee509","ssdeep":"","tlshash":"de9002b090c39c5890264186687100160b6c040c01080141132184d810115048e40d8e","size":43,"data":"","first_seen":"2023-03-13T01:07:12Z","last_seen":"2026-08-13T19:51:23.65414Z","times_seen":223657,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/4bd1b696-52a6696c08e3276c.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6d42e7f9902a9f33e9cceed41588d1cf","sha1":"a7e8b01024ffe1ebec05596e32ea1a2554e9e5ee","sha256":"37241cd3183b7a3ec7a36b795f3a121f42e2a60e00c86668668e9451f2a43775","sha512":"c190a5621c42ed97a6a11e850a5aacd86f2e478d517e46317080ab9b3101ec30b94bc1727abbf913514cb2a6b59945a173efe7712c9d2cf891a0ee77f7257e0e","ssdeep":"3072:5tfjLiM+NFCC4YQbCCAaI/02UHCgwLRE4:5tfj2ld4Y40fUHQRE4","tlshash":"c6f3f7e83d99e2116eb342a7109f2803737c262b240d4c60a615fd9db5b845bb17bfde","size":168413,"data":"","first_seen":"2025-04-16T12:15:04.509987Z","last_seen":"2026-08-13T17:06:18.571577Z","times_seen":1900,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/684-b92696d82da15d4e.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a49c90461505e1f5be9c56ef2aa5a9c","sha1":"c1ca960954422f80ae2f05c549068289af3e9e82","sha256":"e72e9abfb50e5d4d1abc380d273c0f12bb02db898ec7390ccc5c5a07c5cda327","sha512":"25ba24e13db9316c275dc32a62055349ee319408a44f0a14b8a9c5fa790bad5de4de7a2ad2c7918d0ad78c162ee9a83ea6dfa9899465bd903734285e47b1d821","ssdeep":"1536:hZkRavHHx1XNnEAj2hTn4dJF/OX36Z7+25UlXnxraZeXELiZXEoFUNn6g/e0cZ3N:DkIHCRn4dJ1OHMerLUNn/e3Zd","tlshash":"1804b8b676d0f8d107a780d5843b400af3295c3b146f74a0a3e6cce975645dea1b3faa","size":175461,"data":"","first_seen":"2026-02-25T21:51:53.487341Z","last_seen":"2026-08-12T20:47:18.697225Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"00580f478f61c2ea573b353fcaae7963","sha1":"fd6c5f5c1d6c39a34dddaf8d8ff83602025cb363","sha256":"fc3adaaaa791c589e2145a7f83bbfd01df6810cff91ef7c856e15f40af09f48c","sha512":"65ff65d510be45e104c5577cca859810e17aa4eb079092124ade176ebdbd2ba89619b8d1379e857cb9a00d03b5c86578f84cbce566da489de053fa8030d49fa9","ssdeep":"","tlshash":"b53162497304d9a138a9ef9e20332e36894add3a5534b94de65cde3a5312e7d537cc10","size":1817,"data":"","first_seen":"2026-02-25T21:51:53.52501Z","last_seen":"2026-02-25T22:18:12.154421Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d2af61abf3c1e1b6f42393800edfaa90","sha1":"2c3a88f89b791ce134242a14b991285cdcd215f7","sha256":"51a9885dcfa5999d9f46c120f4dffcfbf8b0f17b8b486133a573d2cac82c7e9b","sha512":"f9c8acff45b2fa05c6bbd03b43a265009da3cea489fa92d421800f322e4b5c835fb867babc066c9a42036ad3c5e139c796d88410895236ef080270e746f5ae8f","ssdeep":"","tlshash":"6c5197792009dd5afc6e7d680a7eac3b10cd866b07d1deb8c7d8de101a8247e6396dc1","size":3068,"data":"","first_seen":"2026-02-25T21:51:53.526513Z","last_seen":"2026-02-25T22:18:12.155011Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"770e877cb8d47ec4e8be411197b2e51c","sha1":"d58fa92bbc74d9d57c3aa8bbad46d486ff6da775","sha256":"387399cf7747a7fd0c758524df33c41cedba9b23d64ca3d4c6e2a54b0fd7be63","sha512":"d883f9048ce2bf3e0573434b5dd44f4e308b7a585c389f572a4e7696e4d0b96e02fd633608b49b9b6a07e3326a7bf98fdd85366002f81b4eaaaeb51dba162c4d","ssdeep":"","tlshash":"99d05e399108dd66ec1ab6861c3dbe3e208e40cf40549ea962c4ce0899c6a3e3702dc6","size":248,"data":"","first_seen":"2025-09-05T12:35:32.149116Z","last_seen":"2026-06-29T16:12:07.168288Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/790-0086b2c81cee5ed9.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad305db83d3b02458aca6a5926ce2816","sha1":"07fa5d2c3e6456b5d14431c1e87379162107779e","sha256":"c82660da99a85b758272d70fa5ada29179398312029cac9d408f9b76db24b872","sha512":"3473bac0dda9af9743a47408b068d1c74d0f4fd5f27ed04e018538bc61be03cf6a6d306d0ba82c38e4782711e790226dc141712488ab6b0bc14e609c483f1223","ssdeep":"384:Y8bwS2eMZ38KX4JNT5NMB0QfVyqVjkX36XByXhE/yKwwrGIx:l2tsKIJNMBJfVyW2XhE/L1rZ","tlshash":"69c21af675e1fcd2439b4095843b000af2791c71652e6188b3e59ceab9a0598e1f3f7b","size":25995,"data":"","first_seen":"2026-02-25T21:51:53.511234Z","last_seen":"2026-02-25T22:18:12.145485Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/main-app-d9794b1200c643e4.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d4b0a614cf7429b3653fb2801c5e4b40","sha1":"a672914a0d4d0d7d63ca53e08e2672279c5ea2bd","sha256":"5f2187cd5c9aaa42aff99b17ab666e59d13b47fc65d161d54983608c895dbfc1","sha512":"19fb9a6ecd4166aa4912bde58f67a8c52e399b08ef59f604b2346f68870907b023f54c210f3780b5443e9ec188df0662581cd7f5b7682d7c77ffc167e5eeea59","ssdeep":"","tlshash":"cdf0f4965f0cf42f1c266d74fd97ace21c1f4175302b4e607901ed612c67b6ce664519","size":518,"data":"","first_seen":"2025-04-18T05:16:56.165023Z","last_seen":"2026-08-13T00:40:13.486699Z","times_seen":706,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"21b7769f3549bfa0f4616b496d8ca59e","sha1":"7024d2834366f087279e8dd90a778c6812027f4d","sha256":"31eea5f82a7a4178d802f4db5cd37468b0f661b1d1f4dfc214543a8efce72ce1","sha512":"de5116d51d25e13004d9e2599edc7cfb9432824145993d39f0e9e67b7554dcb98ce92113f50cfc1bbcfe8ceeb7febf5539aa656b98fba8a613b7653cb78a1142","ssdeep":"","tlshash":"c5c0c0a0cc02cc1cc2674f221c3e0c3921cdc16583054157ddc4cd285981b3005b0dca","size":187,"data":"","first_seen":"2025-05-16T11:18:56.075262Z","last_seen":"2026-07-12T21:57:01.095033Z","times_seen":118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/app/layout-ddd2623eec960ae9.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"448391a51fcb56f0818f3063e9ad56b9","sha1":"3b66a6947cd4a46b74232cbb06b0353443b72fec","sha256":"9d58607e270218fee75830e63d3722a607ecdad7d4a07c3efa052b86a912638a","sha512":"947874310256030c6a70c231275333ea80818a90381f588dcde440f7c5876a6287c82bcf8f88c41ce543aed9bbe6d55d314a3425a4c9e09d83356bfc8d8a487c","ssdeep":"96:2sY89GCvQ2TeV9GCgwfupz3q6UFyuG9Qb0n5GXhVEr7VQPFhrUBTZUBTVv9GC76:239SQ2TeC6fupz3CguGqjX8mPFhrU/U6","tlshash":"0ac1b5f677c6fd72465588d098378107b9503e37205fb480a7facce92169eca85a1f8b","size":5647,"data":"","first_seen":"2025-07-10T06:48:15.155415Z","last_seen":"2026-02-25T22:18:12.148477Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/app/page-c0858d01bd912818.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bee34d07dc4e58b991c6788e0a28ccf7","sha1":"cfd525a7a40e5ad1ce6d3a99da5bd9602a2e7c03","sha256":"1ef2a58ed7f4f41433402b0dde6176da3e892fb442ff3f5c8cb66b01b2ccf07c","sha512":"8d1cd3a4d64c72a8a39fa10f48525d1aa17968c9c8f62544a0492aef93236d571597ac5388dc60ad8c3568f84fd3efafe492511e413dc7a51305c2693112bd37","ssdeep":"768:yX8kTfuUoVnWPYdz+nsz9iZmfFgLpQXJVGyPW3Ij1nby:yXJ5oQPYdz+2iSzXI2n+","tlshash":"18f26389d398ff8cb55702d5625db038b22b1f9cdb1e8c78b1b9a8112a409d4b71b7cd","size":37597,"data":"","first_seen":"2026-02-25T21:51:53.500234Z","last_seen":"2026-02-25T22:18:12.131138Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"eval","is_inline":false,"md5":"4897fd9b8b7ac83aa407a82482d958a6","sha1":"eacaa0ca3b7fe6ded4224bc9541c98de60301ba0","sha256":"e676fd606db4fbd1bdc948c42dc74c798f5f3f984cde4f17406a7f976766426d","sha512":"ab8c1141830c65bd36415baedbe6359ed613c0d6ee7d89c88a3fd3aeed350dd982d40e0f65198bccb1e336c80a88477d3557f2660480dd485923f1e56cee6267","ssdeep":"192:x1GhXu16Zbi4wP6tQDVRQsu6s8sC32pfTrq+ZXsp6FdZztDT4tsG9UcSaGI/QC+J:ZSZ6kkwEc5p4GGucP+YW","tlshash":"1e721b4affa21376a5b7715f266f625d71761013040acd24bafd83402f80aa612b7ff9","size":16554,"data":"","first_seen":"2026-02-25T21:51:53.529716Z","last_seen":"2026-02-25T22:18:12.15256Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/tst.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8bde0304b7ecdca4a3050ab4f1f468f","sha1":"464264307af20d2e5959b5ad47aa16eb2a8b83d5","sha256":"f461832305c9df6d38d03de921cc3c4680f5d0b57b1780b540aeed9b2787736f","sha512":"56735dcc52b6ceeaa2ecbe4fed5786f60df25b7130b757ed2e793d95b753d2caf548e830441c1332890e507f729404f87b6831c6aab1b9474cd9fe463f206fd7","ssdeep":"384:OZSmPon1B4lHPlJ7ByBmp+ThLot2SculWpEaNABF/2:OZ/Po4HPlJFyFoQSculWpZN+I","tlshash":"2ba21b67cf8f2e51cb640a0856de18c90a1e5b9ea8e2448c960f77c9829f56745cc9fc","size":22179,"data":"","first_seen":"2026-02-25T21:51:53.489669Z","last_seen":"2026-02-25T22:18:12.136447Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3f9305bfe231b46f46f6aa4f9601f2a2","sha1":"8d69cdd50045daa452152815e21bc2affd617503","sha256":"8bd4b9b1946d5eeeb34ec58e7a74084486a14275555be285f9f000a66be65dad","sha512":"09b1ca85d25a7310e780af028459e9a82c4f0e7724e51d2df745acbe0becfd442c2fd31a336fc36f8d3467a29d265db1c4cbbfef732ecdf67b0d980e0890901a","ssdeep":"","tlshash":"cd21d01be5a36471f866306e67cbf60531375847810eda047e0c9d017fa5116873e6da","size":1378,"data":"","first_seen":"2026-02-25T03:05:09.99146Z","last_seen":"2026-03-05T13:47:43.068318Z","times_seen":49,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"650f4a3293c073b13e2c2b4fd28b80fd","sha1":"f6391ab1f26d0052133fefae5f0e333eafe5199b","sha256":"104c70df3e54e923ccc51bdc4d483fc47b95761011f9f901e71f041aa5a6a72b","sha512":"3863c535299cd78ff269687a9f3f2ed27a99176147413e515d010c0b621685c59aecca808d0f02817b330e98d0278861a6c3d50d6e60771b4b7d3741b3fa20d3","ssdeep":"","tlshash":"16c0809f14450d720519d5056736330a7a03717a2951d15c9e3cb2aa3f10dcbf0fc79d","size":183,"data":"","first_seen":"2026-02-25T21:51:53.532389Z","last_seen":"2026-02-25T21:51:53.532389Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/webpack-9edee2920554d0a5.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7578932ba7ab06efb923a96b91feb19d","sha1":"428f8ee5fd6e16253b94cbd3bbee79cd7b55f7af","sha256":"8ab11204289aac6e3bc2199fdb9c640e18333e158c5b71c65e702c669fd5ea9c","sha512":"765782b4c05639a842ea7ed98d79a8fcf8e2b74849cbad3882218b17794e1a1d6305aecbff99d9db4d01f090bd0508201f9a89f5921846178b70d3603282ca13","ssdeep":"","tlshash":"7781b5b93625e6b116f104c5983fc142fa192137151afca0e71bdcb9a468ee14561ff3","size":3842,"data":"","first_seen":"2026-02-25T21:51:53.509505Z","last_seen":"2026-02-25T22:18:12.134806Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"13758f551b5acb8b050582d6a8cf6b99","sha1":"3c7f09acb1ec893cf0657a33988e4830a1f7b479","sha256":"b890f018a7aa0b854232d73cd7e5f1af59c782bca1080dd88080234e23f23d53","sha512":"6b5439c7270a463358fb6a417be417c09d1010cade442040bad3c55c4b31969680c4d19e0f3ac88209d8984e28157bb02bbccfed82eb36130df306edbb0f8a46","ssdeep":"","tlshash":"5df0c9815d01ee03863e4922087e9cb520c8022fc3c01aa65b84cd2816429f1aeb1a21","size":519,"data":"","first_seen":"2026-02-25T21:51:53.533953Z","last_seen":"2026-02-25T22:18:12.15826Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"748339214ac7c99ba83ffa571219f187","sha1":"9880ac24607a948ce85da9f5ce1549984e0c64ee","sha256":"c02ab470cb34cbd924d469a0265ac162c4f7e602c62fdd537b6ea02399cbdf67","sha512":"5f5ac16cb28b21687aaaf9bae72f96a197d9d9124c55e49e4a0da99e1fc7db93547fa04c35e811f8e37f87bb6b8c555499b0d4d073a3a4ce4deb98df5a18f9fb","ssdeep":"49152:F4+xtaUFAYp8Su3ilTYDMsvpXrdVCiG/NdUgmS9UT9bCWCawOJGSH17129hBpWL2:JxuitgJCWCawOJq","tlshash":"01d57cb073b1707907e792d454a71100f234a44a700984bcfbec95e7af9aaca957bf78","size":2843020,"data":"","first_seen":"2026-02-25T21:51:53.535846Z","last_seen":"2026-02-25T22:18:12.15643Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-25","alert":"Hunting_JS_WebAssembly","trigger":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/css/2e9ddc8fbb6dcc4f.css","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/css/2e9ddc8fbb6dcc4f.css HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"2e9ddc8fbb6dcc4f.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"e7b8fe08dff51652f19239a0936fdcbe\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:07 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/css/2e9ddc8fbb6dcc4f.css\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::wzwc7-1772056278845-67d5fd163577\r\ncontent-length: 5455\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23253,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (20960)","md5":"f15b0a0b9a0250ae1bcd409fbc31d56a","sha1":"bebbf66183da9c345f7b8487fb47d0f7e7fe1836","sha256":"b17e5d00cfafe07a8579f7c78f7753e11351720ca90a0eb5a953a1c1d6389d91","sha512":"ca67556d02683a580a33cbce74aa61f98d70fec4f53711fdde466c6ebdb469ee33f2cdb51f039740383abfc5ca6e9fd9b18ddd8770306c9ebd00223e1c09efd1","ssdeep":"192:Y7JXYS7JXYzFwLr0bfD+Qtqsf0rsfgsfH1xgQYBjNQM/0/orxdGAlCqSrLrsfPs5:GnUwcbBtuIsh/0/orXsVVl","tlshash":"4aa2b6595b15083b7c5384f6e2d8aa9db01a70c1ee3a56bafe530500abd32f72ed7704","first_seen":"2026-02-25T21:51:53.483163Z","last_seen":"2026-02-25T22:18:12.147484Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/4bd1b696-52a6696c08e3276c.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/4bd1b696-52a6696c08e3276c.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"4bd1b696-52a6696c08e3276c.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"34bf3a63870b68c4bb495b58c957679e\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/4bd1b696-52a6696c08e3276c.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::7d4p4-1772056278846-4fd916499579\r\ncontent-length: 54561\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":168413,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6d42e7f9902a9f33e9cceed41588d1cf","sha1":"a7e8b01024ffe1ebec05596e32ea1a2554e9e5ee","sha256":"37241cd3183b7a3ec7a36b795f3a121f42e2a60e00c86668668e9451f2a43775","sha512":"c190a5621c42ed97a6a11e850a5aacd86f2e478d517e46317080ab9b3101ec30b94bc1727abbf913514cb2a6b59945a173efe7712c9d2cf891a0ee77f7257e0e","ssdeep":"3072:5tfjLiM+NFCC4YQbCCAaI/02UHCgwLRE4:5tfj2ld4Y40fUHQRE4","tlshash":"c6f3f7e83d99e2116eb342a7109f2803737c262b240d4c60a615fd9db5b845bb17bfde","first_seen":"2025-04-16T12:15:04.509987Z","last_seen":"2026-08-13T17:06:18.571577Z","times_seen":1900,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/684-b92696d82da15d4e.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/684-b92696d82da15d4e.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 203488\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"684-b92696d82da15d4e.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"79f075a4c8e0726f9d9bd78525a6ca48\"\r\nlast-modified: Mon, 23 Feb 2026 13:19:50 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/684-b92696d82da15d4e.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::b9p2p-1772056278847-cb72627d41c9\r\ncontent-length: 46369\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":175461,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6a49c90461505e1f5be9c56ef2aa5a9c","sha1":"c1ca960954422f80ae2f05c549068289af3e9e82","sha256":"e72e9abfb50e5d4d1abc380d273c0f12bb02db898ec7390ccc5c5a07c5cda327","sha512":"25ba24e13db9316c275dc32a62055349ee319408a44f0a14b8a9c5fa790bad5de4de7a2ad2c7918d0ad78c162ee9a83ea6dfa9899465bd903734285e47b1d821","ssdeep":"1536:hZkRavHHx1XNnEAj2hTn4dJF/OX36Z7+25UlXnxraZeXELiZXEoFUNn6g/e0cZ3N:DkIHCRn4dJ1OHMerLUNn/e3Zd","tlshash":"1804b8b676d0f8d107a780d5843b400af3295c3b146f74a0a3e6cce975645dea1b3faa","first_seen":"2026-02-25T21:51:53.487341Z","last_seen":"2026-08-12T20:47:18.697225Z","times_seen":9,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/tst.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /tst.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"tst.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"edfb44de838d23b9d41a9a84baff923a\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:07 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /tst.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vjz99-1772056278853-59a4f6fd49f2\r\ncontent-length: 9314\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22179,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (22179), with no line terminators","md5":"c8bde0304b7ecdca4a3050ab4f1f468f","sha1":"464264307af20d2e5959b5ad47aa16eb2a8b83d5","sha256":"f461832305c9df6d38d03de921cc3c4680f5d0b57b1780b540aeed9b2787736f","sha512":"56735dcc52b6ceeaa2ecbe4fed5786f60df25b7130b757ed2e793d95b753d2caf548e830441c1332890e507f729404f87b6831c6aab1b9474cd9fe463f206fd7","ssdeep":"384:OZSmPon1B4lHPlJ7ByBmp+ThLot2SculWpEaNABF/2:OZ/Po4HPlJFyFoQSculWpZN+I","tlshash":"2ba21b67cf8f2e51cb640a0856de18c90a1e5b9ea8e2448c960f77c9829f56745cc9fc","first_seen":"2026-02-25T21:51:53.489669Z","last_seen":"2026-02-25T22:18:12.136447Z","times_seen":2,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ext.same-assets.com/3587148283/2811797957.png","fqdn":"ext.same-assets.com","domain":"same-assets.com","tld":"com"},"ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"86f3a1bf.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 02 Jan 2026 03:34:16 GMT","end":"Thu, 02 Apr 2026 04:34:11 GMT"},"fingerprint":{"sha1":"CC:30:3F:32:8B:22:C2:13:6C:E5:E0:11:2B:D0:2B:2B:0E:06:23:22","sha256":"32:0A:6B:1B:FB:A7:00:B3:87:43:57:7D:3A:04:13:B8:83:E9:06:92:BB:17:53:19:05:19:F5:D8:09:E9:0C:37"}}},"request":{"raw":"GET /3587148283/2811797957.png HTTP/1.1\r\nHost: ext.same-assets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 925786\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ao3O9c3EXv8jCfmLljvlnIZOE4C%2FJHExOsBPqnS75Lk3eM%2FajwOKD%2F4rm1tQgABNwGZ76nKPhKrPKuIWT%2F034fZzJbVki2Hix37Bu7DiWh%2FMJOs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"1b6d87a1d7187b75190b6a886065f20f\"\r\nlast-modified: Sat, 21 Feb 2026 21:14:26 GMT\r\nvary: Accept-Encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 9d3a6c61bbd579a6-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":925786,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1184 x 864, 8-bit/color RGBA, non-interlaced","md5":"1b6d87a1d7187b75190b6a886065f20f","sha1":"4b939ceff15ac4564debb54655e965a88f28bc3d","sha256":"cba14be5b543d63106d289b4a81555c80a8df17ea6a0a61eb63db96b5240172f","sha512":"44ae99135a4b08c56e36357a2fc2f3bd84f97405c953a78190e6eb5099463e3d78a8d60b9246be802d2bab6a0eb1a0826418d673f42aa73fc6a6e307bfb360ea","ssdeep":"24576:mFiPnUrZ9lkkD9QxWV/2B3FpdGeoa+8tf1SII6nk6Pa5YV6Pl42M:HfUrOv6/yEeoa/3I6koh6G2M","tlshash":"991533e46b375c88c03e040a8da44bc57ce4f8d1bed96a76331d999031daf54f8aeb49","first_seen":"2026-02-17T14:21:32.246667Z","last_seen":"2026-03-07T02:08:56.707785Z","times_seen":30,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.250Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:06:40 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c757c0823eb-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":602112,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"53d741534e2c16a0a45c14c76ffd6b7f","sha1":"95843f52c28374db07145cd6144c99f1e298dfad","sha256":"1ddb36252181889be68b802cfdc44a7511ae69e1e58799871e747b4662356919","sha512":"9cd61f3fcac1dfc5cb097cb9a66831fb80ef1389c0f4b758ca4d613cea81a2649ef3459de9f25aed1fffe81d05a23d7662e5bd3fe86400dfb80017605367cd13","ssdeep":"12288:bw+YEyoNI/qVAQPiktG7xzVnTRZQ7UarysToF0O4aNwT5T:bDYQNB1s7x5nT9wysI0jlT","tlshash":"06d423ade02c175795ea2034245927c47eb7e03d9cbe7d336388c8298f975bd2d8894e","first_seen":"2026-02-25T21:51:53.493795Z","last_seen":"2026-02-25T21:51:53.493795Z","times_seen":1,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":171,"dns":4,"connect":4,"send":0,"wait":179,"receive":10,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/api/v2/binary","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:21.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Feb 2026 09:22:01 GMT","end":"Tue, 26 May 2026 09:22:00 GMT"},"fingerprint":{"sha1":"43:A7:0E:2A:17:34:DC:42:83:88:AE:D6:95:95:09:58:26:71:E6:C5","sha256":"ED:6F:3E:CA:2F:60:5F:3F:0D:72:55:8C:78:B7:4E:0A:E1:37:CD:EE:4D:72:9D:FC:CE:FE:66:8B:2E:C3:13:95"}}},"request":{"raw":"POST /api/v2/binary HTTP/1.1\r\nHost: uygft-a78s.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nX-Session-Id: eb437a8cfd8270c320981c86f0ac9b6c\r\nX-Config-Id: 699b60d044e2554e27be7384\r\nContent-Length: 99\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Wed, 25 Feb 2026 21:51:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CzWzDmPlSn9dIIEDOWOTlaoZNb%2BhgGZaGE8tCozJ%2BToOYC91nRQ7AAPOiK9twB4QAtOvZtU6U9UTTwnoGo64JRwM1HvdOk8%2F1YYvXDrcN%2FMzL9ZFhuw6hcxp%2BlJWn%2FPk5pEW0Q%3D%3D\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin,Accept-Encoding\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::5rvp8-1772056281905-dca183301299\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":995,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"943b6007ea2dd7b444c098cc4cde112c","sha1":"b38068a2c46252785424f1e15838c942b4d4ef70","sha256":"048942715219fe4356280f76eee0aac21e91994a6e5055546ef7863343582f69","sha512":"c99bd9b1c80a89fecae3508d96962f8675daa1da7ab67d59007dc41bc07ecd21aaa92e8d4e40824ca4a4c8f98bdd37ab6b48b9e18a857c68e385aa931d874378","ssdeep":"","tlshash":"3c11a18f3245f0cff6aac97495e200a219a8df5487ac908b780292ce045b06ec22965e","first_seen":"2026-02-25T21:51:53.496122Z","last_seen":"2026-02-25T21:51:53.496122Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-25T21:51:18.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 265616\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: W/\"56f315e3f6ab63b1090720138b9ecd0b\"\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nvary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch\r\nx-matched-path: /\r\nx-nextjs-prerender: 1\r\nx-nextjs-stale-time: 300\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::2b2nq-1772056278649-0b8cf10d9338\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":46150,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (46105), with no line terminators","md5":"23a2002071498be22e580d243b2a431f","sha1":"849f4227c6bb1f34d626d4b5b6a3e26dc307bf32","sha256":"0c21c55ca98da411a1a466d43bcf2be58eea773132588aaf54eb19137d57697e","sha512":"8cae9c1a1b3324aa4d4bf9d1cb0b3dfcdeb87554683a4ca4e754e0c7d8d7c88ccd0743c011a58dfc156b9bb168f3a95fcd34ca38c6a8dc45d17b477a07f1780f","ssdeep":"768:VvOXgzOfWsqibqtWml1IK1FuFJXoInDQh7fHHosUHEDG:cgzOesV2pgDQhLHH5y","tlshash":"2123d9713208ea5f524b4ad8b336af7d605fd35dce1b891cf3ac8550ab82cf6ad51128","first_seen":"2026-02-25T21:51:53.498191Z","last_seen":"2026-02-25T22:18:12.150532Z","times_seen":2,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":110,"dns":79,"connect":1,"send":0,"wait":10,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/app/page-c0858d01bd912818.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/app/page-c0858d01bd912818.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"page-c0858d01bd912818.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"9f36347c250ce909d169d2012153eaf2\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/app/page-c0858d01bd912818.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::wkwrr-1772056278857-21bc80a254e9\r\ncontent-length: 8451\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37597,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (37571), with no line terminators","md5":"bee34d07dc4e58b991c6788e0a28ccf7","sha1":"cfd525a7a40e5ad1ce6d3a99da5bd9602a2e7c03","sha256":"1ef2a58ed7f4f41433402b0dde6176da3e892fb442ff3f5c8cb66b01b2ccf07c","sha512":"8d1cd3a4d64c72a8a39fa10f48525d1aa17968c9c8f62544a0492aef93236d571597ac5388dc60ad8c3568f84fd3efafe492511e413dc7a51305c2693112bd37","ssdeep":"768:yX8kTfuUoVnWPYdz+nsz9iZmfFgLpQXJVGyPW3Ij1nby:yXJ5oQPYdz+2iSzXI2n+","tlshash":"18f26389d398ff8cb55702d5625db038b22b1f9cdb1e8c78b1b9a8112a409d4b71b7cd","first_seen":"2026-02-25T21:51:53.500234Z","last_seen":"2026-02-25T22:18:12.131138Z","times_seen":2,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28336\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Feb 2026 17:56:30 GMT\r\nexpires: Thu, 25 Feb 2027 17:56:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 27 Aug 2025 19:19:05 GMT\r\ncontent-type: font/woff2\r\nage: 14089\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28336,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28336, version 1.0","md5":"068c503647ace91cce6adc5b017dabaa","sha1":"f82805e27e919f768d4b09795f8ce830378a7a6b","sha256":"1b092c711df1c7ad200c2bc73305c792315ff882adbac925d79fb432bc0673c3","sha512":"6dd0f29b9958189bafae2c1c435921bfd7981cfbb3e539498dc6885ee13b6b57dd2c24a48e5f240341cdda59b1a9e40999d0f2d45ae1b9930e8061cae91bd1b3","ssdeep":"768:G1GVHDpdLWI8N0tdmdk8yb2BNadHc7Qv8uzk58iF0s+:TdLlw2dmdk8y+aNOuY58M0t","tlshash":"f3d2f2bf22665b83cb87506f0d8da181df4fa99cd703886e0957157d5ad4193ce0392d","first_seen":"2025-09-05T09:07:09.035131Z","last_seen":"2026-08-13T19:51:03.736847Z","times_seen":848,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":87,"dns":1,"connect":8,"send":0,"wait":16,"receive":3,"ssl":75},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ext.same-assets.com/3587148283/2901108258.webp","fqdn":"ext.same-assets.com","domain":"same-assets.com","tld":"com"},"ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"86f3a1bf.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 02 Jan 2026 03:34:16 GMT","end":"Thu, 02 Apr 2026 04:34:11 GMT"},"fingerprint":{"sha1":"CC:30:3F:32:8B:22:C2:13:6C:E5:E0:11:2B:D0:2B:2B:0E:06:23:22","sha256":"32:0A:6B:1B:FB:A7:00:B3:87:43:57:7D:3A:04:13:B8:83:E9:06:92:BB:17:53:19:05:19:F5:D8:09:E9:0C:37"}}},"request":{"raw":"GET /3587148283/2901108258.webp HTTP/1.1\r\nHost: ext.same-assets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-type: image/webp\r\ncontent-length: 179500\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G3BltbF66ADYBadVMpGSslvmySZI8vWsy2R73Yk7ZcioY5d3fdB1UCFapCraffZozJSi1taunNA7mWAIxIoD8Y3K7qNx4rLDqwmi8Si9LobVzas%3D\"}]}\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"654f5434fcdadc41b5b9bd7f1edf86d3\"\r\nlast-modified: Sat, 21 Feb 2026 21:14:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: max-age=14400\r\ncf-ray: 9d3a6c613abb79a6-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":179500,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1066x766, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"654f5434fcdadc41b5b9bd7f1edf86d3","sha1":"bca4d7b913e991b3648b1abe32e4071b66b9016e","sha256":"75c73305c80bc17dda83a1ee8a05ba7d3201c1ccd66ab440367a14a65c25c71d","sha512":"b1c54f3b8a081bf6ddbf518b3fdaf2bacb1c1460ad61d50b1069be94c37b20e8c50b8823c77342dcf527015b41488a69525650e61cb106aef20cf3c2d1ba71e1","ssdeep":"3072:+k8qbuhkubk8lGFRHr90SROR8msLSUkA8IpGHlU7kc1BjQmXlmiWYJVQvzq5i4B:MqbuX/8p0SROR8msLSUkNPa7kMBMmXll","tlshash":"11041266df1605578368fcb18a864224edbd810eff0921dad495af00dc309af4ab72fd","first_seen":"2026-02-17T14:21:32.249139Z","last_seen":"2026-03-07T02:08:56.71208Z","times_seen":23,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:05:42 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c744f184e4c-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"77c8cf44927733853063e12a9c919838","sha1":"e753f4fab619a4ad9c7e362f7dbca7d28c6af569","sha256":"0a412e42c896359759d6f578d9439fdfa66c8387c55de84440861ea71f463e59","sha512":"23e51c246c2f5f89fb1e53fad2bbba306a23f2a5d708b1b58dd8b8a60a382c9e38d475a7b57e90d617d2f87524659ca3c63da65c0248367925c1f5ab8bb570c6","ssdeep":"12288:VEznytgluvfiMoSnqYsA4Xp8fvndMMr95Hl42YSbZQxiVUSmj3+SSB9WV:avufiMHLszpYKMLHl4XSjC3h+s","tlshash":"8ff423e9846d4c8222510261295a753c2053b03eddf7bc39b1acdf9dc69ee3e8ce91e5","first_seen":"2026-02-25T03:05:09.958112Z","last_seen":"2026-03-07T02:01:37.50279Z","times_seen":62,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":37,"dns":3,"connect":1,"send":0,"wait":112,"receive":27,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:15 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c745ac575ab-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"13ec753f0f7ac3f2e09cd8fb3d159fd6","sha1":"fb7c640e5ea1b3eb5af719aec31fe04a971c27db","sha256":"69c12f796a581c42a4dfedd57a615fdc0407867c0ab2577507c6afe5320d5b26","sha512":"79c55e8cc4ba19d93751be035f34ffea46704d06b08da0ee65a013c3bb40a7f3295156bc659db38df831457a65d53ed01bb79812b5903f66de13108d99c85e9a","ssdeep":"12288:WKLOlpdbVhOBbi61VlVP30w5qYO8DgLhC9bxl0zY6+wqzta5YpqXl5M0k+3uJH:WKS1/OBbi61/Vvx5qYONFC9VGM60S15M","tlshash":"b4f433f9941e38c2eb42b5617c2f12219dffb09b487f5fe24b40ba6a23dad4443d9458","first_seen":"2026-02-25T03:05:09.960469Z","last_seen":"2026-03-07T02:01:37.469286Z","times_seen":59,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":37,"dns":1,"connect":10,"send":0,"wait":171,"receive":117,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"ext.same-assets.com/3587148283/3341130481.webp","fqdn":"ext.same-assets.com","domain":"same-assets.com","tld":"com"},"ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"86f3a1bf.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 02 Jan 2026 03:34:16 GMT","end":"Thu, 02 Apr 2026 04:34:11 GMT"},"fingerprint":{"sha1":"CC:30:3F:32:8B:22:C2:13:6C:E5:E0:11:2B:D0:2B:2B:0E:06:23:22","sha256":"32:0A:6B:1B:FB:A7:00:B3:87:43:57:7D:3A:04:13:B8:83:E9:06:92:BB:17:53:19:05:19:F5:D8:09:E9:0C:37"}}},"request":{"raw":"GET /3587148283/3341130481.webp HTTP/1.1\r\nHost: ext.same-assets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-type: image/webp\r\ncontent-length: 81426\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=27mEcDLOYTqCOW6XBm%2BluvL%2FXcovfQRlbqeK%2BkTpd5YMqcKKA%2FcBY2wsNXeGeNAoGFHcxD%2Fryt4TI0av0Z69W5z4bFQCGO4yH8mpQMkbl1hlklk%3D\"}]}\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"80067ae3e5f51ef1b78614943136973c\"\r\nlast-modified: Sat, 21 Feb 2026 21:14:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: max-age=14400\r\ncf-ray: 9d3a6c5f2e6679a6-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81426,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1280x459, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"80067ae3e5f51ef1b78614943136973c","sha1":"4066cbdfde0ed7bcbb920646000eec76dcfb2c48","sha256":"78902d2270e4f2ea8bf370a453952d084904bf943edfe506cfb217b9e29de148","sha512":"1d21edf7379727c214676fb73578c6814792358d69ef1d14c864dc1cd349ae3a1f212ace945044a7e3d3c109f5b6c28c5b08db171c0c717bc63470def291e7cd","ssdeep":"1536:RW21bgv9DGhrg5EJx5tf0w6DSj/nfaf3xJz4T/dP3DG6ui8XwaoejpIDIl39yUdh:Rz1bJrsEJxj0w0Sj/CfhJz8/935Za7pN","tlshash":"008302887112dcb2eee9333d55640e8bdc4012bfe9e2e20b9e535762b6600d0c96d7f6","first_seen":"2026-02-17T14:21:32.247881Z","last_seen":"2026-03-07T02:08:56.714559Z","times_seen":23,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":53,"dns":28,"connect":8,"send":0,"wait":175,"receive":11,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ext.same-assets.com/3587148283/2103798551.woff2","fqdn":"ext.same-assets.com","domain":"same-assets.com","tld":"com"},"ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"86f3a1bf.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 02 Jan 2026 03:34:16 GMT","end":"Thu, 02 Apr 2026 04:34:11 GMT"},"fingerprint":{"sha1":"CC:30:3F:32:8B:22:C2:13:6C:E5:E0:11:2B:D0:2B:2B:0E:06:23:22","sha256":"32:0A:6B:1B:FB:A7:00:B3:87:43:57:7D:3A:04:13:B8:83:E9:06:92:BB:17:53:19:05:19:F5:D8:09:E9:0C:37"}}},"request":{"raw":"GET /3587148283/2103798551.woff2 HTTP/1.1\r\nHost: ext.same-assets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 133760\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\netag: \"c48bd2439e2921fc4d3aaef0e57446be\"\r\nlast-modified: Sat, 21 Feb 2026 21:14:23 GMT\r\nvary: Origin, Accept-Encoding\r\naccess-control-expose-headers: *\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=J2QpP9RGwa0LpY4nZ94USflorR7jYnQ0uz4OOTtg7BJC%2BtRvFy2oyTPJnUXTcWb0dbrKnPk9Qqvc%2FxGq0cOv3JUVDJklibDYyIGiCMmPNnV%2FgfjDcg5FvAdFsaFhQRindFFQPcpx\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9d3a6c5f989ab9db-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":133760,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 133760, version 2.0","md5":"c48bd2439e2921fc4d3aaef0e57446be","sha1":"396596764aebbe25ba1c45f19091f48a7e17a9e5","sha256":"0f4491b0f9f6b9c3e6054a9f0036583e3978fd3a8d8f49ba5da05d63cf875cbb","sha512":"cb9ff1ede5ea280e8586c3e6e84c68685b3749fa492fb1babef3d0bb72ab1b095b1c00531554ead12e31139f226c7aa96399b11fd6ae256ea134639d98d95b64","ssdeep":"3072:OWSP0iIzCkvibLej77I/9GRBm7Xy2TJ46tNP7HlgXffTp/CGZ7YpV/z:OdYGkviXe7l87C2XtBC1/CGin/z","tlshash":"d9d3123e2ad0e463aba505b13a7f65808a2e5f11e3c773c145b274cfd5302a8236da7d","first_seen":"2025-04-23T20:37:12.507957Z","last_seen":"2026-08-13T18:32:36.79261Z","times_seen":1895,"resource_available":false,"data":null}},"time_used":281,"timings":{"blocked":40,"dns":1,"connect":8,"send":0,"wait":182,"receive":19,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunito/v32/XRXV3I6Li01BKofINeaBTMnFcQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/nunito/v32/XRXV3I6Li01BKofINeaBTMnFcQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 39152\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 19 Feb 2026 16:33:18 GMT\r\nexpires: Fri, 19 Feb 2027 16:33:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 537481\r\nlast-modified: Mon, 15 Sep 2025 17:03:48 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":39152,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39152, version 1.0","md5":"acfce21e9f6eaf62a1058b502b920e06","sha1":"c67f96573543ec91b416b0da07f979f80b89b6b6","sha256":"20fc9b6fc618e7c3c68d3ac750a2a5dfbceb8521675458d2cea580b5693e4798","sha512":"213daf669f64b3d1c2e86311afdb173873ee379bccd1e7c2a891bb17cd5f0c01e485bbed331b34aeb8cf0ff7b8962fefa136533e9b9218174eb6a72cf3c5eb00","ssdeep":"768:8oje8HA6B+ldUVqnpuc8oq8OlKJZejd5sSuSbccIeC8MQ:8oy8Hf+DcqpWo3OWZc/sscccQ","tlshash":"a603f13825463274fa888f297b2485859d2c3cd68d25e9339cefa35d2302d7915bbdec","first_seen":"2025-09-17T21:27:48.949651Z","last_seen":"2026-08-13T19:51:03.749931Z","times_seen":3351,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":219,"dns":3,"connect":22,"send":0,"wait":8,"receive":3,"ssl":181},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28336\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Feb 2026 17:56:30 GMT\r\nexpires: Thu, 25 Feb 2027 17:56:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 27 Aug 2025 19:19:05 GMT\r\ncontent-type: font/woff2\r\nage: 14089\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28336,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28336, version 1.0","md5":"068c503647ace91cce6adc5b017dabaa","sha1":"f82805e27e919f768d4b09795f8ce830378a7a6b","sha256":"1b092c711df1c7ad200c2bc73305c792315ff882adbac925d79fb432bc0673c3","sha512":"6dd0f29b9958189bafae2c1c435921bfd7981cfbb3e539498dc6885ee13b6b57dd2c24a48e5f240341cdda59b1a9e40999d0f2d45ae1b9930e8061cae91bd1b3","ssdeep":"768:G1GVHDpdLWI8N0tdmdk8yb2BNadHc7Qv8uzk58iF0s+:TdLlw2dmdk8y+aNOuY58M0t","tlshash":"f3d2f2bf22665b83cb87506f0d8da181df4fa99cd703886e0957157d5ad4193ce0392d","first_seen":"2025-09-05T09:07:09.035131Z","last_seen":"2026-08-13T19:51:03.736847Z","times_seen":848,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":98,"dns":0,"connect":0,"send":0,"wait":9,"receive":8,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ext.same-assets.com/3587148283/1687623281.png","fqdn":"ext.same-assets.com","domain":"same-assets.com","tld":"com"},"ip":{"addr":"172.67.180.112","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"86f3a1bf.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 02 Jan 2026 03:34:16 GMT","end":"Thu, 02 Apr 2026 04:34:11 GMT"},"fingerprint":{"sha1":"CC:30:3F:32:8B:22:C2:13:6C:E5:E0:11:2B:D0:2B:2B:0E:06:23:22","sha256":"32:0A:6B:1B:FB:A7:00:B3:87:43:57:7D:3A:04:13:B8:83:E9:06:92:BB:17:53:19:05:19:F5:D8:09:E9:0C:37"}}},"request":{"raw":"GET /3587148283/1687623281.png HTTP/1.1\r\nHost: ext.same-assets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 1661401\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Km6lApq2PiSw6OshvuvVUib2N5gPYwkQJjNv1tQC7EJh6kSnoipTDMD9wsam7v6kESsqeJ2NZPu%2FkW%2FzeN0smPl6dAq9mKXklHzhNRyr6Rt0%2FX8%3D\"}]}\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"2a6e620f2dcd10f7ea58b829b492ccec\"\r\nlast-modified: Sat, 21 Feb 2026 17:12:04 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: max-age=14400\r\ncf-ray: 9d3a6c631eb979a6-ARN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1661401,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"eff526a069ca8d9ae8bcb424e369cd5a","sha1":"1bf25380b4a3826d753a71e1356d328134237c58","sha256":"7e38c898082469e9fd51c8844c125e6f7a64459c592e8cd5d8095bd33ee68324","sha512":"59c67501beeb9641f4d93063f85dff6581b6168ce940f840709976c91d1d385e566ee5c9b8fa68766bd09bf2e41ff9391182f678624e3b5fe7bc988268a7794d","ssdeep":"24576:r/8yIRjHvrkWPpAi0B/82Yx3EAlweTyBVUWOv:Lp+jHvrkoAi0BdYx3E0TjWOv","tlshash":"a1253367bbe47b61c375346692d25a73b3c4f823363a06020c5ca964fb297ec22587d7","first_seen":"2026-02-17T14:21:32.251647Z","last_seen":"2026-03-07T02:08:56.713728Z","times_seen":31,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":174,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:18 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c744dbd23eb-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"eeebcd74061a9dcd7dfad338ebe1d46a","sha1":"23148fe8cd0cfe6b4379103d03dabde517e9bfd9","sha256":"631978ce1c77fdc8360949130dc08a761d8a5cbf0b87875b7b1556706cabc068","sha512":"e151fd7805ccbf649173ed454739604bbb31cbd0daa1dbf057454363c74532c9a5c2310e516f087f21ef09e5cd7de46e91d67e01815274b82573caae494eff45","ssdeep":"12288:/2TA4vVLmF/WbRkFOppRWsWNbGSQHJAUOUsLOsWZssG5bxVWhseThDII57tSKnXb:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVr","tlshash":"41f4233ac26c0681a9a500112e6526604c337cbc54feea3383eddf3adb5b92d6da5295","first_seen":"2026-02-25T03:05:09.955526Z","last_seen":"2026-03-07T02:01:37.494267Z","times_seen":63,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":42,"dns":1,"connect":1,"send":0,"wait":152,"receive":123,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:26 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c744daea0f0-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"eeebcd74061a9dcd7dfad338ebe1d46a","sha1":"23148fe8cd0cfe6b4379103d03dabde517e9bfd9","sha256":"631978ce1c77fdc8360949130dc08a761d8a5cbf0b87875b7b1556706cabc068","sha512":"e151fd7805ccbf649173ed454739604bbb31cbd0daa1dbf057454363c74532c9a5c2310e516f087f21ef09e5cd7de46e91d67e01815274b82573caae494eff45","ssdeep":"12288:/2TA4vVLmF/WbRkFOppRWsWNbGSQHJAUOUsLOsWZssG5bxVWhseThDII57tSKnXb:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVr","tlshash":"41f4233ac26c0681a9a500112e6526604c337cbc54feea3383eddf3adb5b92d6da5295","first_seen":"2026-02-25T03:05:09.955526Z","last_seen":"2026-03-07T02:01:37.494267Z","times_seen":63,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":40,"dns":0,"connect":1,"send":0,"wait":171,"receive":116,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/webpack-9edee2920554d0a5.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/webpack-9edee2920554d0a5.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50411\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"webpack-9edee2920554d0a5.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"9bae13aa60543ee45866359b08595dd8\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:07 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/webpack-9edee2920554d0a5.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::jm8lj-1772056278846-cec811ae19f6\r\ncontent-length: 1990\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":3842,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3403)","md5":"7578932ba7ab06efb923a96b91feb19d","sha1":"428f8ee5fd6e16253b94cbd3bbee79cd7b55f7af","sha256":"8ab11204289aac6e3bc2199fdb9c640e18333e158c5b71c65e702c669fd5ea9c","sha512":"765782b4c05639a842ea7ed98d79a8fcf8e2b74849cbad3882218b17794e1a1d6305aecbff99d9db4d01f090bd0508201f9a89f5921846178b70d3603282ca13","ssdeep":"","tlshash":"7781b5b93625e6b116f104c5983fc142fa192137151afca0e71bdcb9a468ee14561ff3","first_seen":"2026-02-25T21:51:53.509505Z","last_seen":"2026-02-25T22:18:12.134806Z","times_seen":2,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/790-0086b2c81cee5ed9.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/790-0086b2c81cee5ed9.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"790-0086b2c81cee5ed9.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"1aa709ba0c35578a31cb4fd7a9afe524\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/790-0086b2c81cee5ed9.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::2b2nq-1772056278852-55044ef211b7\r\ncontent-length: 9841\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25995,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (25995), with no line terminators","md5":"ad305db83d3b02458aca6a5926ce2816","sha1":"07fa5d2c3e6456b5d14431c1e87379162107779e","sha256":"c82660da99a85b758272d70fa5ada29179398312029cac9d408f9b76db24b872","sha512":"3473bac0dda9af9743a47408b068d1c74d0f4fd5f27ed04e018538bc61be03cf6a6d306d0ba82c38e4782711e790226dc141712488ab6b0bc14e609c483f1223","ssdeep":"384:Y8bwS2eMZ38KX4JNT5NMB0QfVyqVjkX36XByXhE/yKwwrGIx:l2tsKIJNMBJfVyW2XhE/L1rZ","tlshash":"69c21af675e1fcd2439b4095843b000af2791c71652e6188b3e59ceab9a0598e1f3f7b","first_seen":"2026-02-25T21:51:53.511234Z","last_seen":"2026-02-25T22:18:12.145485Z","times_seen":2,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:30 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c745ec73181-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"13ec753f0f7ac3f2e09cd8fb3d159fd6","sha1":"fb7c640e5ea1b3eb5af719aec31fe04a971c27db","sha256":"69c12f796a581c42a4dfedd57a615fdc0407867c0ab2577507c6afe5320d5b26","sha512":"79c55e8cc4ba19d93751be035f34ffea46704d06b08da0ee65a013c3bb40a7f3295156bc659db38df831457a65d53ed01bb79812b5903f66de13108d99c85e9a","ssdeep":"12288:WKLOlpdbVhOBbi61VlVP30w5qYO8DgLhC9bxl0zY6+wqzta5YpqXl5M0k+3uJH:WKS1/OBbi61/Vvx5qYONFC9VGM60S15M","tlshash":"b4f433f9941e38c2eb42b5617c2f12219dffb09b487f5fe24b40ba6a23dad4443d9458","first_seen":"2026-02-25T03:05:09.960469Z","last_seen":"2026-03-07T02:01:37.469286Z","times_seen":59,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":37,"dns":1,"connect":10,"send":0,"wait":119,"receive":96,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:07:07 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c75a9885a0f-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":560192,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"05d01c6d2c2b1b2cc67e5d133b1ace7b","sha1":"91f667dc06e1e9e14c1ab7baff338c8a26199677","sha256":"bee1ea8991460bd2ee7b91f9fca1e6213b80b3b3138c2ced821f5ccaca580f34","sha512":"7b17cb83893bad8921d62f3e5cff6af4fb4888f9366790f44916154d5c765cdc3db9de7d2e129a7cb5af4cc1a07408a8caf2ce2ad69894dbe7ed7e8ad90d4706","ssdeep":"12288:bw+YEyoNI/qVAQPiktG7xzVnTRZQ7UarysToF0O4x:bDYQNB1s7x5nT9wysI0jx","tlshash":"52c423b9e02c271796e62025245927d43ea3f03a5dbe7d336388c82dcf975bc1e8894d","first_seen":"2026-02-25T21:51:53.513027Z","last_seen":"2026-02-25T21:51:53.513027Z","times_seen":1,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":221,"dns":0,"connect":6,"send":0,"wait":150,"receive":29,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"connect.sol.ms/modal?id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F","fqdn":"connect.sol.ms","domain":"sol.ms","tld":"ms"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.312Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sol.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 10 Jan 2026 13:14:54 GMT","end":"Fri, 10 Apr 2026 14:13:18 GMT"},"fingerprint":{"sha1":"23:13:25:E8:BB:B1:A7:64:03:A6:FA:74:FE:64:83:16:36:18:78:2F","sha256":"09:BC:C7:26:D6:B6:3E:5F:F6:A0:08:0F:2E:59:DE:F1:93:17:47:57:05:FE:C4:42:22:CD:D7:A4:86:1B:45:B7"}}},"request":{"raw":"GET /modal?id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F HTTP/1.1\r\nHost: connect.sol.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Wed, 25 Feb 2026 21:51:19 GMT\r\ncontent-length: 0\r\nlocation: https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe\r\nvary: Origin\r\nx-ratelimit-limit: 50\r\nx-ratelimit-remaining: 49\r\nx-ratelimit-reset: 600\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xjR4q3x83zY6RP5wCojihNXM%2Fdslk6JT7paDaRMrszYWNd3F7ZLeT%2FbeA6aRJFyiCt26XLrbMbBxPesqzvg%2BCipsSxe%2BDR0T6GS%2B69WN\"}]}\r\nserver: cloudflare\r\ncf-ray: 9d3a6c623c3cb000-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2846973,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T19:51:56.000454Z","times_seen":17875501,"resource_available":true,"data":null}},"time_used":324,"timings":{"blocked":74,"dns":48,"connect":11,"send":0,"wait":159,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28336\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Feb 2026 17:56:30 GMT\r\nexpires: Thu, 25 Feb 2027 17:56:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 27 Aug 2025 19:19:05 GMT\r\ncontent-type: font/woff2\r\nage: 14089\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28336,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28336, version 1.0","md5":"068c503647ace91cce6adc5b017dabaa","sha1":"f82805e27e919f768d4b09795f8ce830378a7a6b","sha256":"1b092c711df1c7ad200c2bc73305c792315ff882adbac925d79fb432bc0673c3","sha512":"6dd0f29b9958189bafae2c1c435921bfd7981cfbb3e539498dc6885ee13b6b57dd2c24a48e5f240341cdda59b1a9e40999d0f2d45ae1b9930e8061cae91bd1b3","ssdeep":"768:G1GVHDpdLWI8N0tdmdk8yb2BNadHc7Qv8uzk58iF0s+:TdLlw2dmdk8y+aNOuY58M0t","tlshash":"f3d2f2bf22665b83cb87506f0d8da181df4fa99cd703886e0957157d5ad4193ce0392d","first_seen":"2025-09-05T09:07:09.035131Z","last_seen":"2026-08-13T19:51:03.736847Z","times_seen":848,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/api/v2/handshake","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:21.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Feb 2026 09:22:01 GMT","end":"Tue, 26 May 2026 09:22:00 GMT"},"fingerprint":{"sha1":"43:A7:0E:2A:17:34:DC:42:83:88:AE:D6:95:95:09:58:26:71:E6:C5","sha256":"ED:6F:3E:CA:2F:60:5F:3F:0D:72:55:8C:78:B7:4E:0A:E1:37:CD:EE:4D:72:9D:FC:CE:FE:66:8B:2E:C3:13:95"}}},"request":{"raw":"POST /api/v2/handshake HTTP/1.1\r\nHost: uygft-a78s.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nContent-Length: 71\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Wed, 25 Feb 2026 21:51:21 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K9AxtC6NY9YKT8gazn79Dxy7pMx%2FIRXF6l3pGE%2FLC0cCzT0jLcwjWtCDxtGQxLYxE4FUt0lIv3lAZkS95f%2BA2JvL%2BHf05Y0QNvCoOo349S%2Fo6Q5%2Fqr4TCDfbf2CMjnQAoboSCw%3D%3D\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin\r\nx-session-id: eb437a8cfd8270c320981c86f0ac9b6c\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::k6v95-1772056281615-6c419bd141a2\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":80,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"491a69337f5fa2d72fce93918704332d","sha1":"26d926f56bc00fc073a0345c13f5941b039bad35","sha256":"cd0633b61aa3c582b7e9c50201ddec2e50ccf0136f9ad38020923af12db5ad7e","sha512":"bd15de3d757fe2c78de6d813ec9577c32749450474ebb31f899eb733cf2e96e1b352d811d4ba53cc2c20a3828d56fd52cac1a4780619e40d2b5d8f717b17f083","ssdeep":"","tlshash":"eba0222380a83338e0ce002ea300ee0c0083b03a0bf00280b0cff2033c002c302b8e82","first_seen":"2026-02-25T21:51:53.515389Z","last_seen":"2026-02-25T21:51:53.515389Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/api/v2/binary","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Feb 2026 09:22:01 GMT","end":"Tue, 26 May 2026 09:22:00 GMT"},"fingerprint":{"sha1":"43:A7:0E:2A:17:34:DC:42:83:88:AE:D6:95:95:09:58:26:71:E6:C5","sha256":"ED:6F:3E:CA:2F:60:5F:3F:0D:72:55:8C:78:B7:4E:0A:E1:37:CD:EE:4D:72:9D:FC:CE:FE:66:8B:2E:C3:13:95"}}},"request":{"raw":"POST /api/v2/binary HTTP/1.1\r\nHost: uygft-a78s.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nX-Session-Id: eb437a8cfd8270c320981c86f0ac9b6c\r\nX-Config-Id: 699b60d044e2554e27be7384\r\nContent-Length: 99\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Wed, 25 Feb 2026 21:51:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FjD7zUCBCkIRKFvX0%2ByCkH%2FXvjFv6iw9cePQow1J%2B%2FrZ%2FGmRtDkIifIm8qiEu0JqlQvHrrNBjk93Ce9xVibWJWUM5g18JDjvUw2gOSCtE6VXj6ByGUQJ3yh%2F%2B9JxeTVH3gIB%2Bg%3D%3D\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::5rvp8-1772056282220-eaf1f2e71c7b\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":99,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"3a60e043ac0cd0c78c1cfc97817cd1e3","sha1":"977beea865aeb1459f98b1a8de783110c52b329c","sha256":"2415833644062c7e99e38fd384f4552c14989013a49c00ad01159222ece61254","sha512":"5cf9043499fdb6f5765554c39c178236fd89bb859d59ecca78243c56061c3a51c63e1d97a587df208cdf20747f960b15d283974625cc7a5eebe22eef6778810c","ssdeep":"","tlshash":"59b0126343243e2ed211663043040d0c8a7308045043228b4340457f1c9c0c0280302c","first_seen":"2026-02-25T21:51:53.516924Z","last_seen":"2026-02-25T21:51:53.516924Z","times_seen":1,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"punchinsolana.com/","fqdn":"punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-25T21:51:18.444Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:51 GMT","end":"Sat, 23 May 2026 18:58:50 GMT"},"fingerprint":{"sha1":"7F:A0:AA:8D:F1:8F:0D:41:BA:81:57:E3:46:36:0C:A8:96:45:EF:F4","sha256":"48:00:4D:D4:73:37:D7:67:87:80:55:F7:18:30:8E:08:AF:30:A2:7E:F5:EB:5A:6B:BF:8D:C0:3B:0C:CE:0A:98"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\nlocation: https://www.punchinsolana.com/\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-id: arn1::dhgnm-1772056278517-4bbdc21aecbb\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":46150,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T19:51:56.000454Z","times_seen":17875501,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":64,"dns":34,"connect":1,"send":0,"wait":10,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/main-app-d9794b1200c643e4.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/main-app-d9794b1200c643e4.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 50410\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"main-app-d9794b1200c643e4.js\"\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"d4b0a614cf7429b3653fb2801c5e4b40\"\r\nlast-modified: Wed, 25 Feb 2026 07:51:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/main-app-d9794b1200c643e4.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::bdgm9-1772056278850-75770cb021aa\r\ncontent-length: 518\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":518,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (518), with no line terminators","md5":"d4b0a614cf7429b3653fb2801c5e4b40","sha1":"a672914a0d4d0d7d63ca53e08e2672279c5ea2bd","sha256":"5f2187cd5c9aaa42aff99b17ab666e59d13b47fc65d161d54983608c895dbfc1","sha512":"19fb9a6ecd4166aa4912bde58f67a8c52e399b08ef59f604b2346f68870907b023f54c210f3780b5443e9ec188df0662581cd7f5b7682d7c77ffc167e5eeea59","ssdeep":"","tlshash":"cdf0f4965f0cf42f1c266d74fd97ace21c1f4175302b4e607901ed612c67b6ce664519","first_seen":"2025-04-18T05:16:56.165023Z","last_seen":"2026-08-13T00:40:13.486699Z","times_seen":706,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.punchinsolana.com/_next/static/chunks/app/layout-ddd2623eec960ae9.js","fqdn":"www.punchinsolana.com","domain":"punchinsolana.com","tld":"com"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.punchinsolana.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Feb 2026 18:58:52 GMT","end":"Sat, 23 May 2026 18:58:51 GMT"},"fingerprint":{"sha1":"8D:AF:39:85:4D:65:AC:EE:90:02:AF:57:29:7B:4A:3F:03:41:28:9A","sha256":"0B:8A:71:66:84:15:FE:89:DF:56:09:AE:D4:32:18:B9:44:13:2A:A6:CF:21:C2:FF:54:EB:5B:B3:88:DC:74:F3"}}},"request":{"raw":"GET /_next/static/chunks/app/layout-ddd2623eec960ae9.js HTTP/1.1\r\nHost: www.punchinsolana.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48944\r\ncache-control: public,max-age=31536000,immutable\r\ncontent-disposition: inline; filename=\"layout-ddd2623eec960ae9.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:18 GMT\r\netag: \"4acc80056b290bc7a6e773ab3af77f9e\"\r\nlast-modified: Wed, 25 Feb 2026 08:15:34 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/chunks/app/layout-ddd2623eec960ae9.js\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::srqqz-1772056278851-c9d69355a308\r\ncontent-length: 2119\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5647,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5647), with no line terminators","md5":"448391a51fcb56f0818f3063e9ad56b9","sha1":"3b66a6947cd4a46b74232cbb06b0353443b72fec","sha256":"9d58607e270218fee75830e63d3722a607ecdad7d4a07c3efa052b86a912638a","sha512":"947874310256030c6a70c231275333ea80818a90381f588dcde440f7c5876a6287c82bcf8f88c41ce543aed9bbe6d55d314a3425a4c9e09d83356bfc8d8a487c","ssdeep":"96:2sY89GCvQ2TeV9GCgwfupz3q6UFyuG9Qb0n5GXhVEr7VQPFhrUBTZUBTVv9GC76:239SQ2TeC6fupz3CguGqjX8mPFhrU/U6","tlshash":"0ac1b5f677c6fd72465588d098378107b9503e37205fb480a7facce92169eca85a1f8b","first_seen":"2025-07-10T06:48:15.155415Z","last_seen":"2026-02-25T22:18:12.148477Z","times_seen":4,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunito/v32/XRXV3I6Li01BKofINeaBTMnFcQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/nunito/v32/XRXV3I6Li01BKofINeaBTMnFcQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 39152\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 19 Feb 2026 16:33:18 GMT\r\nexpires: Fri, 19 Feb 2027 16:33:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 537481\r\nlast-modified: Mon, 15 Sep 2025 17:03:48 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":39152,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39152, version 1.0","md5":"acfce21e9f6eaf62a1058b502b920e06","sha1":"c67f96573543ec91b416b0da07f979f80b89b6b6","sha256":"20fc9b6fc618e7c3c68d3ac750a2a5dfbceb8521675458d2cea580b5693e4798","sha512":"213daf669f64b3d1c2e86311afdb173873ee379bccd1e7c2a891bb17cd5f0c01e485bbed331b34aeb8cf0ff7b8962fefa136533e9b9218174eb6a72cf3c5eb00","ssdeep":"768:8oje8HA6B+ldUVqnpuc8oq8OlKJZejd5sSuSbccIeC8MQ:8oy8Hf+DcqpWo3OWZc/sscccQ","tlshash":"a603f13825463274fa888f297b2485859d2c3cd68d25e9339cefa35d2302d7915bbdec","first_seen":"2025-09-17T21:27:48.949651Z","last_seen":"2026-08-13T19:51:03.749931Z","times_seen":3351,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":164,"dns":3,"connect":21,"send":0,"wait":9,"receive":2,"ssl":135},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","fqdn":"uygft-a78s.vercel.app","domain":"uygft-a78s.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:19.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Feb 2026 09:22:01 GMT","end":"Tue, 26 May 2026 09:22:00 GMT"},"fingerprint":{"sha1":"43:A7:0E:2A:17:34:DC:42:83:88:AE:D6:95:95:09:58:26:71:E6:C5","sha256":"ED:6F:3E:CA:2F:60:5F:3F:0D:72:55:8C:78:B7:4E:0A:E1:37:CD:EE:4D:72:9D:FC:CE:FE:66:8B:2E:C3:13:95"}}},"request":{"raw":"GET /demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe HTTP/1.1\r\nHost: uygft-a78s.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.punchinsolana.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 25 Feb 2026 21:51:20 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pooBlWm6CpHx5AXbm%2Fu1jw8y%2FPdNLEoh3GUb%2B4dfVOSCNM3JyURTk%2FQ4AMoJpW1JpdQbRfZ8Pg8TLRVAJ8uAvVWqLrX2lv767UiB6%2BjEz78eLhsmIffetDfxVBSwODxKNJkW1g%3D%3D\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin,Accept-Encoding\r\nx-ratelimit-limit: 50\r\nx-ratelimit-remaining: 48\r\nx-ratelimit-reset: 314\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::xmlzb-1772056279588-c5ff860d8a11\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":2846973,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (33714)","md5":"dd59c3544eb0d518c3da4dbce0cfa063","sha1":"236f2b78f0fd6783f3e24332d056a4a6a2e38c6b","sha256":"1e3267bb6ee3b2c22de93b198db811612ba6883f487b9fffe91c63da88406434","sha512":"11e822f3575d14979a5152add715e1176df50f97ee1fbf33c0c5c61cb70edf307c8ff1849ab1f2c0a90e135036821a5fc857a947ec8a0e94946f44835276a0c6","ssdeep":"12288:E44LZxNuaZYNUIFPfLUlKY4Ue+jFy1rq6c5249AZQmYN8Ge5CK3i/R0u4gpJ0:E4cZxtaUFBE1r5c52aAZSu3iZ0uTJ0","tlshash":"6a256cb073a1b07a03eb92d594661100f334941a700d84acfbaca9eb6f959cf957bf35","first_seen":"2026-02-25T21:51:53.521907Z","last_seen":"2026-02-25T21:51:53.521907Z","times_seen":1,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":28,"dns":1,"connect":1,"send":0,"wait":10,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://uygft-a78s.vercel.app/demo.php?antibot=false\u0026id=699b60d044e2554e27be7384\u0026parent_url=www.punchinsolana.com%2F\u0026source=solana-iframe","date":"2026-02-25T21:51:22.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://uygft-a78s.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 25 Feb 2026 21:51:22 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:28:10 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d3a6c744f1b4e4c-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"77c8cf44927733853063e12a9c919838","sha1":"e753f4fab619a4ad9c7e362f7dbca7d28c6af569","sha256":"0a412e42c896359759d6f578d9439fdfa66c8387c55de84440861ea71f463e59","sha512":"23e51c246c2f5f89fb1e53fad2bbba306a23f2a5d708b1b58dd8b8a60a382c9e38d475a7b57e90d617d2f87524659ca3c63da65c0248367925c1f5ab8bb570c6","ssdeep":"12288:VEznytgluvfiMoSnqYsA4Xp8fvndMMr95Hl42YSbZQxiVUSmj3+SSB9WV:avufiMHLszpYKMLHl4XSjC3h+s","tlshash":"8ff423e9846d4c8222510261295a753c2053b03eddf7bc39b1acdf9dc69ee3e8ce91e5","first_seen":"2026-02-25T03:05:09.958112Z","last_seen":"2026-03-07T02:01:37.50279Z","times_seen":62,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":36,"dns":1,"connect":1,"send":0,"wait":121,"receive":69,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-25","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.punchinsolana.com/","date":"2026-02-25T21:51:18.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/quicksand/v37/6xKtdSZaM9iE8KbpRA_hK1QNYuDyPw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.punchinsolana.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.punchinsolana.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28336\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Feb 2026 17:56:30 GMT\r\nexpires: Thu, 25 Feb 2027 17:56:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 27 Aug 2025 19:19:05 GMT\r\ncontent-type: font/woff2\r\nage: 14089\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28336,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28336, version 1.0","md5":"068c503647ace91cce6adc5b017dabaa","sha1":"f82805e27e919f768d4b09795f8ce830378a7a6b","sha256":"1b092c711df1c7ad200c2bc73305c792315ff882adbac925d79fb432bc0673c3","sha512":"6dd0f29b9958189bafae2c1c435921bfd7981cfbb3e539498dc6885ee13b6b57dd2c24a48e5f240341cdda59b1a9e40999d0f2d45ae1b9930e8061cae91bd1b3","ssdeep":"768:G1GVHDpdLWI8N0tdmdk8yb2BNadHc7Qv8uzk58iF0s+:TdLlw2dmdk8y+aNOuY58M0t","tlshash":"f3d2f2bf22665b83cb87506f0d8da181df4fa99cd703886e0957157d5ad4193ce0392d","first_seen":"2025-09-05T09:07:09.035131Z","last_seen":"2026-08-13T19:51:03.736847Z","times_seen":848,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":107,"dns":0,"connect":22,"send":0,"wait":18,"receive":4,"ssl":81},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}