{"report_id":"c8ec017f-708b-4d0a-8286-4018863598f2","version":0,"status":"done","tags":[],"date":"2026-10-09T16:22:31Z","url":{"schema":"http","addr":"phantom.larpshop.cloud/","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":0,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"phantom.larpshop.cloud/","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"title":"Phantom Wallet — Installer l'application","dom":{"size":51977,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (45806)","md5":"1bd6d5150c6de80b7947029f5849c607","sha1":"e493280e06c5d17608a603aea7653c1c3182d906","sha256":"2db5ec3ba004611b7b0cfb78aaef824949983617fa399515fecf6ac9a0879ced","sha512":"d59d7c1124d62089d7ce1068ba322c68808cf2ac34b8e2efe4d34c23987c4c7d3ea00e0fd73bbb4ea3f4ff3ae117963abc56c3913f6bacfe2193b9672c444c9d","ssdeep":"1536:y6m0Dnc8RvtnC/FFh0Dnc8RvtnC/FFUmgmETlqEr0:y6m0D80DnmgB0","tlshash":"a2330b3c4262977f761b8699f7657399b060634fca83824cf3fd12152bc9ce9f415a88","dom_hash":"domhash79f56346fece289c751ed9b9bad43011","first_seen":"2026-10-09T16:22:41.169935Z","last_seen":"2026-10-09T16:22:41.169935Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"phantom.larpshop.cloud/","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":0,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-13T16:22:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"phantom.larpshop.cloud","ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"domain_registered":"2026-09-21","domain_rank":0,"first_seen":"2026-10-09T15:50:58.351997Z","last_seen":"2026-10-09T15:50:58.351997Z","alert_count":24,"request_count":12,"received_data":690201,"sent_data":6118,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"api.coingecko.com","ip":{"addr":"104.20.41.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-03-26","domain_rank":442226,"first_seen":"2018-05-18T12:16:11Z","last_seen":"2026-10-08T15:41:00.475373Z","alert_count":0,"request_count":1,"received_data":1094,"sent_data":546,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/index-public-simulation-0b63222351ce.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"b66e577f53c68f15d6313568739ed337","sha1":"542f5a44455acad37334fa8a9ba3f862fcf535b2","sha256":"fd5dc0aeb3eb2ede0e3d6454cd0f1465732809f24ce292298f05fa8aa99598e9","sha512":"0bfe1bcf9ca7af660c24f543985f9d0a31d77606e9bb951c91923db4da4fc7696522bc462608a9a808d8eb059fbb52b43746e1b58a01849fd77b1f0523b31753","ssdeep":"6144:QcqBUBsIdSfLNHLug/ZoknljbZpFWzB8NGK5XFlEf:Qcq3I4/ZHjr4B8bX4","tlshash":"56745c156240f69ff42988c5212fd00b700e3d9ef50aaaeddbf9745a1b823697d836cd","size":348769,"data":"","first_seen":"2026-10-09T15:51:04.260597Z","last_seen":"2026-10-09T16:22:41.186352Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/vendor-DEHDCODn.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"7731402502c6fc923aa67fb364ffe055","sha1":"c102735ae2b57d53284b96bcaea14f8302d8ad11","sha256":"88415a85fe05c74a4e253d3bc2f9909e3b1e296866283c64e4819a0270b62f11","sha512":"fb94753a6b2e0ed0ffd03bd182c184b26c3ba135781891078e2d39df9455c4449a798b9b4e0317b20394ea9d232f6cd0c35e4e08eac28d40dd8704af01c3b9fa","ssdeep":"3072:eST5bOQwl6/A847ZvlNQYjKdm59CbQMRpFEfztkTSIH8:l1bV/A847Z4wzWLT/8","tlshash":"45042be831aab566aba316b6006f1507b37d1c172c0c4860b111fd9b7af580991bbffd","size":189478,"data":"","first_seen":"2026-10-09T15:51:04.213622Z","last_seen":"2026-10-09T16:22:41.21581Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/workbox-window.prod.es5-BqEJf4Xk.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"introduction_type":"importedModule","is_inline":false,"md5":"71ae66381176eb6f97cbca8d8c3b9e20","sha1":"5d2ed764dc9c544aa8591cdd9a28c54cd1013087","sha256":"a5e753498adaeaf5aa2aeb6aa33cc8b477f6dae8621f1960ab8e12d4cebf9c70","sha512":"8024097bd2e61f9ad22db8b1416bd167864db51f346c611582ae42aff8c47ab152aa26bfe54bd22995445450fdde28b33f5006e61b9f73b4c970c4ae17763194","ssdeep":"96:rkVG6ZVECTBVFejrwRtKgZsTqyLfZCARdf9ZXPLUR1BSMHJm/5GPBn:rkVG5CTFcrktKg4qSC0dVRU1hJm/5GP9","tlshash":"c3c153c8ba96f47b43a3e270f16f950ab17f6980845c5064e116fce06cb6649c23bf69","size":5706,"data":"","first_seen":"2026-05-19T20:35:54.787695Z","last_seen":"2026-10-12T01:46:57.342216Z","times_seen":373,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/vendor-ClSxivZm.css","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.105Z","timestamp":1791562649105,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/vendor-ClSxivZm.css HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dlyld7x4f7y8i4-zstd\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 223\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":652,"size_decoded":1131,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (651)","md5":"09e165e0cc09a0c34f9f14c96910ff27","sha1":"9519b37d0ae7341325bd7b7659dbae8eaaf32afd","sha256":"511508dfa3183e1fed015cff104001ba2470458d94665b86fd5c3c986c7848f4","sha512":"93b6861abf55b19db3eb976641e2178b55bb93deba1dbadfd17a5c479b9afe6d468c27f608c348c0d92d370cf506869dc41dad591d545bb36d9e85a8e2d5a300","ssdeep":"","tlshash":"bef04901206b4a01d0236f4133ce6b022e2b6656a0784237ca3e8d148dfbc3783baf3d","first_seen":"2026-10-09T15:51:04.198422Z","last_seen":"2026-10-09T16:22:41.17626Z","times_seen":2,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/favicon.svg","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.432Z","timestamp":1791562649432,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: image/svg+xml\r\netag: \"dlk0ocdgxs001g2-zstd\"\r\nlast-modified: Sun, 20 Sep 2026 08:56:24 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 962\r\ndate: Fri, 09 Oct 2026 16:17:30 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1874,"size_decoded":1861,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0851e876da3bd8b52d25d273c562fec8","sha1":"7d11550cbc32d616b79c7085dd00464f4fd27bda","sha256":"095fda720849f037518398226a1e6405d1db17fd5d80ae9be8a96f21ea7ac28b","sha512":"732c1306c2d6a1c2d71900fb97a693dcf535a10c699d8be955a3924e02a59e0438d045da5c1532f90d3c352b95aeb8ec0b4c0d6938da1c42a6ed16d7637752eb","ssdeep":"","tlshash":"c831acab8758c5f2ae19981cee2524daf30ce0e744c4d3e0731c9a3495d50dafa4f9ac","first_seen":"2026-10-09T16:22:41.17798Z","last_seen":"2026-10-09T16:22:41.17798Z","times_seen":1,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/inter-latin-600-normal-LgqL8muc.woff2","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.478Z","timestamp":1791562649478,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/inter-latin-600-normal-LgqL8muc.woff2 HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://phantom.larpshop.cloud/assets/vendor-ClSxivZm.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: font/woff2\r\netag: \"dlyld7x4f7y8iv8\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 24452\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24452,"size_decoded":25343,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24452, version 1.0","md5":"2ede57db1a3a5f41f40467e7a43a1dd4","sha1":"e0d61f6dc511d64a072b2f4dc94e155ecf1bb6f6","sha256":"f9a06e79cd3a2a20951c0f0e28f66dd0e6d3fda73911d640a2125c8fcb78f21a","sha512":"a30d204efb2a66231f29804b8c1e467d61a741b0252eccb40aea60206bd4d5cdb0a32a76cb01d1ba8ba0c73469d10fc55df1d8e54ea3b55b6b75b17e94afc80b","ssdeep":"384:WuaNAiwkOHiuWl18daDX7+rEvHG297z5lzWMTSbXhVR7ebvio772036BhuJJRiVF:zaKfkOHiJEdWX+svP5m7R7eTio7JKWHC","tlshash":"79b2e03132ea530e5b14c43c9537287e5eca2fe78aa93e5e9fd5d004b2104d6836fe06","first_seen":"2025-05-30T14:20:15.679609Z","last_seen":"2026-10-12T02:06:08.578987Z","times_seen":8574,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/inter-latin-400-normal-C38fXH4l.woff2","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.482Z","timestamp":1791562649482,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/inter-latin-400-normal-C38fXH4l.woff2 HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://phantom.larpshop.cloud/assets/vendor-ClSxivZm.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: font/woff2\r\netag: \"dlyld7x4f7y8i9c\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 23664\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23664,"size_decoded":24555,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23664, version 1.0","md5":"da03732a27e16543f09d6a6a62b0cdd4","sha1":"68f645c6b6ff12e25c54b13d4ed119e631dcbb26","sha256":"8909904ab6c872eb994093482a88a28eca2cd95912d7b6fecd72103b0dc07edc","sha512":"8f8a1b22d7fedc8a5c0b75a237932fa00b71d25b1c13d1ec6f9c31fbeceba5d7e1a728a06fc3c2abd803337617394f91d2cc08e9798417b73e3587da3b9d882e","ssdeep":"384:LDIByvvcpxzNfjZ7amidC7gcUH6rpfmzO59sT+m+WFg5ivhjpaBNSS6X:LMBYabZ7aXvaVfSCWSogoSSSi","tlshash":"fdb2e0e97b5be3e2e077c67d41bbdf94e64c2860435e4b830e24be14e2d24fe6484416","first_seen":"2025-05-30T09:01:41.826892Z","last_seen":"2026-10-12T02:32:10.919329Z","times_seen":20778,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/index-public-simulation-0b63222351ce.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.101Z","timestamp":1791562649101,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/index-public-simulation-0b63222351ce.js HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dlzlio8nyp357h41-zstd\"\r\nlast-modified: Thu, 08 Oct 2026 16:26:22 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":348769,"size_decoded":129135,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65522), with no line terminators","md5":"b66e577f53c68f15d6313568739ed337","sha1":"542f5a44455acad37334fa8a9ba3f862fcf535b2","sha256":"fd5dc0aeb3eb2ede0e3d6454cd0f1465732809f24ce292298f05fa8aa99598e9","sha512":"0bfe1bcf9ca7af660c24f543985f9d0a31d77606e9bb951c91923db4da4fc7696522bc462608a9a808d8eb059fbb52b43746e1b58a01849fd77b1f0523b31753","ssdeep":"6144:QcqBUBsIdSfLNHLug/ZoknljbZpFWzB8NGK5XFlEf:Qcq3I4/ZHjr4B8bX4","tlshash":"56745c156240f69ff42988c5212fd00b700e3d9ef50aaaeddbf9745a1b823697d836cd","first_seen":"2026-10-09T15:51:04.260597Z","last_seen":"2026-10-09T16:22:41.186352Z","times_seen":2,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/workbox-window.prod.es5-BqEJf4Xk.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.393Z","timestamp":1791562649393,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/workbox-window.prod.es5-BqEJf4Xk.js HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/assets/index-public-simulation-0b63222351ce.js\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dlyld7x4f7y84ei-zstd\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 2501\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5706,"size_decoded":3418,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4574)","md5":"71ae66381176eb6f97cbca8d8c3b9e20","sha1":"5d2ed764dc9c544aa8591cdd9a28c54cd1013087","sha256":"a5e753498adaeaf5aa2aeb6aa33cc8b477f6dae8621f1960ab8e12d4cebf9c70","sha512":"8024097bd2e61f9ad22db8b1416bd167864db51f346c611582ae42aff8c47ab152aa26bfe54bd22995445450fdde28b33f5006e61b9f73b4c970c4ae17763194","ssdeep":"96:rkVG6ZVECTBVFejrwRtKgZsTqyLfZCARdf9ZXPLUR1BSMHJm/5GPBn:rkVG5CTFcrktKg4qSC0dVRU1hJm/5GP9","tlshash":"c3c153c8ba96f47b43a3e270f16f950ab17f6980845c5064e116fce06cb6649c23bf69","first_seen":"2026-05-19T20:35:54.787695Z","last_seen":"2026-10-12T01:46:57.342216Z","times_seen":373,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/icons/apple-touch-icon.png","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.431Z","timestamp":1791562649431,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /icons/apple-touch-icon.png HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: image/png\r\netag: \"dlkjybkv0e0w2zk\"\r\nlast-modified: Mon, 21 Sep 2026 00:02:47 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 3872\r\ndate: Fri, 09 Oct 2026 16:17:30 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3872,"size_decoded":4761,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"3958004ed61c9dfdc60f6db13b533b0a","sha1":"91ef040bb95fcb97301ff3e4519661c0322da151","sha256":"2905b812b385e684cdb8ce398d05ca719e42174e2ea914bdbb9e5ea44853db0b","sha512":"d1ba16c4f0ca9faea13c880bc536bbf217fed228eed7162a8ad355458b60350337e2d41628e614a535cb260e8c51fd9e9d40890c798e42706ba799ff044f48d8","ssdeep":"","tlshash":"27816dd8cb5af8ad2bfb1294158354d4fc670c3d0d90860cd660b3f51d913a856cfa69","first_seen":"2026-10-09T16:22:41.190891Z","last_seen":"2026-10-09T16:22:41.190891Z","times_seen":1,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.coingecko.com/api/v3/simple/price?ids=tether\u0026vs_currencies=usd,eur,gbp,chf,cad,aud,jpy","fqdn":"api.coingecko.com","domain":"coingecko.com","tld":"com"},"ip":{"addr":"104.20.41.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.702Z","timestamp":1791562649702,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.coingecko.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Oct 2026 17:00:32 GMT","end":"Sat, 02 Jan 2027 17:00:31 GMT"},"fingerprint":{"sha1":"74:23:96:C8:1B:43:FC:23:3A:29:06:01:57:11:41:82:7B:C6:F7:84","sha256":"F9:DC:44:DA:51:D2:A4:CE:FE:38:BB:89:FA:C4:5F:A9:E8:3A:12:24:F2:A4:A7:2C:A9:A0:95:7D:BB:CC:96:8F"}}},"request":{"raw":"GET /api/v3/simple/price?ids=tether\u0026vs_currencies=usd,eur,gbp,chf,cad,aud,jpy HTTP/1.1\r\nHost: api.coingecko.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nOrigin: https://phantom.larpshop.cloud\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\ncontent-type: application/json; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS\r\naccess-control-expose-headers: link, per-page, total\r\naccess-control-max-age: 7200\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-data-source: 2.0\r\ncache-control: max-age=30, public, must-revalidate, s-maxage=60\r\naccess-control-request-method: *\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization\r\nvary: Accept-Encoding, Origin\r\ncontent-encoding: gzip\r\netag: W/\"2d4a058f886b036917de91a41f0dd731\"\r\nx-request-id: 1f8e1f5f-846b-4e28-a889-c21c1b87257f\r\nx-runtime: 0.006314\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-cache-status: EXPIRED\r\ncf-ray: a47eb220dd37569a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107,"size_decoded":1100,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"64b2374a67e48424f35a5bfccbcdfe4d","sha1":"179ba359a8d1114828489cb0326167a76aa02a7a","sha256":"40180b0c55df0a2fa1bb9741cb740cadbfe0401de8257cc91ec254883113c910","sha512":"b051a2673c113fc3f26d41f8655861cfc3145ea0423035706853b4cff29142b6e059fc7b52de1c0fbfae29b40c412628fc8e22355bc283df09d472b62fa4325f","ssdeep":"","tlshash":"f8b012036d6279b21e1a39881c20d3d9fc42739495ac020194454e500c5e47bd2e4c12","first_seen":"2026-10-09T16:22:41.194206Z","last_seen":"2026-10-09T16:22:41.194206Z","times_seen":1,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":11,"connect":28,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/cash-CSkttTD5.png","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.433Z","timestamp":1791562649433,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/cash-CSkttTD5.png HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: image/png\r\netag: \"dlyld7x4f7y8bbv\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 14683\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14683,"size_decoded":15573,"mime_type":"image/png","magic":"PNG image data, 160 x 106, 8-bit/color RGBA, non-interlaced","md5":"16da9f03dbf5a2992a0cb971b77ffb8c","sha1":"c0f7ebd0de95155b9f6823c97b7e81ff6b15f2b5","sha256":"7486abb77137fd79db291ec327c4905f4a21198746218056a12202815ddfde1d","sha512":"2315afb0e56c7a821bc7ec22505e512825bce8c4d9a65d1df095b1bcf77f4cd6073e9e6cc5d2eb0fe1a493ef1425c9921311da6c50336df29883eb3fa51a8220","ssdeep":"384:h86vQjkRHqXC6GCOpXqowknwlWXK11ENaknM3:h2yp6oXXK116ako","tlshash":"ee62d0ea1d6c0eaec41cfc252f79b754edc7ad8c852251c3ab2e6746420eb90c850ab5","first_seen":"2026-10-09T16:22:41.197242Z","last_seen":"2026-10-09T16:22:41.197242Z","times_seen":1,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/inter-latin-500-normal-Cerq10X2.woff2","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.480Z","timestamp":1791562649480,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/inter-latin-500-normal-Cerq10X2.woff2 HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://phantom.larpshop.cloud/assets/vendor-ClSxivZm.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: font/woff2\r\netag: \"dlyld7x4f7y8iq8\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 24272\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24272,"size_decoded":25163,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24272, version 1.0","md5":"51205681a1ba304816fc629e8989256b","sha1":"6b66c741bf8bc3ce248af04b2051a648a38391d6","sha256":"f3779f1efccc4bdcdf9c0a02ab95bf6bd092ed09c48c08cedc725889edd1d19f","sha512":"06a0f1bb5df53f0f01a69fcde97dac63e6cf382bdc38ac84cde4021c8f38f8998c525b564c24fc9caa47fa7253a1b8eb1f50093b9d6b858ac59f358d08285ac8","ssdeep":"384:G+N/IC1hZek0x7rvoWFOdMoldqrE4Fc8BGW8CqKiLIPGFpLDK12JBoB/cYGnIYz+:GpAhodx7DXOdMcsZF38M58p212JBoiYp","tlshash":"f3b2e02211fa659d906a131e29fd782b77bb373d3940cc8aa86f49cd9dc675308c5cd8","first_seen":"2025-06-02T05:01:52.622319Z","last_seen":"2026-10-12T02:30:18.275264Z","times_seen":7831,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T16:17:28.736Z","timestamp":1791562648736,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/html; charset=utf-8\r\netag: \"dlzgdt9mnegp660-zstd\"\r\nlast-modified: Thu, 08 Oct 2026 12:24:55 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ncontent-length: 3400\r\ndate: Fri, 09 Oct 2026 16:17:28 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7992,"size_decoded":4311,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1363)","md5":"2a1ac3497a5751a32f7677c809871a51","sha1":"002729f228f775f2717128a44eae86a22075684a","sha256":"6e1f07590345a8fc912a4d88b3af6b5e04649e1670fbf6ae8bd1b784a5ea7bfb","sha512":"825218858f7037cc160202b0ac4ad76a4ddab9f52c091f1db17aa329000512f2e589a30f0eaa7574095e7f90a8466fb3e4675f56b8bafb3081b54ebbb6d439e8","ssdeep":"192:N2ipTi+4jSVqRhoFYe21mdYk/68Jw2f2S7Hf30pZx:hY1Rhce2TjfkTx","tlshash":"68f1c61b47d0948916c8413efea2f095c62ce98785c8c384359e92986fc5bd8e6ef7f4","first_seen":"2026-10-09T15:51:04.254199Z","last_seen":"2026-10-09T16:22:41.21456Z","times_seen":2,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":6,"connect":31,"send":0,"wait":42,"receive":0,"ssl":74},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/vendor-DEHDCODn.js","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.103Z","timestamp":1791562649103,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/vendor-DEHDCODn.js HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dlyld7x4f7y8427a-zstd\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":189478,"size_decoded":67095,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (37509)","md5":"7731402502c6fc923aa67fb364ffe055","sha1":"c102735ae2b57d53284b96bcaea14f8302d8ad11","sha256":"88415a85fe05c74a4e253d3bc2f9909e3b1e296866283c64e4819a0270b62f11","sha512":"fb94753a6b2e0ed0ffd03bd182c184b26c3ba135781891078e2d39df9455c4449a798b9b4e0317b20394ea9d232f6cd0c35e4e08eac28d40dd8704af01c3b9fa","ssdeep":"3072:eST5bOQwl6/A847ZvlNQYjKdm59CbQMRpFEfztkTSIH8:l1bV/A847Z4wzWLT/8","tlshash":"45042be831aab566aba316b6006f1507b37d1c172c0c4860b111fd9b7af580991bbffd","first_seen":"2026-10-09T15:51:04.213622Z","last_seen":"2026-10-09T16:22:41.21581Z","times_seen":2,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantom.larpshop.cloud/assets/index-BVo8a49d.css","fqdn":"phantom.larpshop.cloud","domain":"larpshop.cloud","tld":"cloud"},"ip":{"addr":"51.254.212.37","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://phantom.larpshop.cloud/","date":"2026-10-09T16:17:29.106Z","timestamp":1791562649106,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom.larpshop.cloud","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 21:57:58 GMT","end":"Tue, 29 Dec 2026 21:57:57 GMT"},"fingerprint":{"sha1":"87:7B:3B:D5:2A:0D:A3:95:03:CB:15:7E:93:4A:EF:74:E5:53:11:7F","sha256":"C6:BB:3D:46:5B:27:8D:22:04:C9:BC:5D:A2:5E:29:C7:41:3E:CA:F8:F7:67:70:2F:51:DD:6A:6A:7C:6C:3B:B9"}}},"request":{"raw":"GET /assets/index-BVo8a49d.css HTTP/1.1\r\nHost: phantom.larpshop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://phantom.larpshop.cloud/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: zstd\r\ncontent-security-policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; worker-src 'self'; connect-src 'self' https://api.binance.com https://api.coingecko.com wss://stream.binance.com:9443 https://sim-api.larpshop.cloud\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dlyld7x4f7y8q90-zstd\"\r\nlast-modified: Wed, 07 Oct 2026 12:06:35 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow\r\ndate: Fri, 09 Oct 2026 16:17:29 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34020,"size_decoded":8876,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (34019)","md5":"b8cd0dd60f2123037b89af88335d4976","sha1":"4c0d357cb32b554b6e04e1c4cb2e9ce539cde924","sha256":"a1cae5757a989695e96023606d72767a669e71b5bf7b604eb41369c3f15e3e00","sha512":"736e3fdb74b822c3caa56208bdd154f65f7a80ad7015494575a58ad25040e3b53801423fb2e8c3f2bdca9a9d85fa55b08a430b5ccbcbc9e6df6f7a4fdeec4462","ssdeep":"384:ku/NMV5hi/sveDkcRwsRKUR6kW3MSA5H1ZhlKVUScPxO7UzTD/y/m/HfrFa+:MVIsveDkcRwsRKUR6kW3MDZPiUlfrFZ","tlshash":"f0e2531e6f15113b7c6780f5d5e4beccb21af5c2df3a57eaa88261219ac27f61c63204","first_seen":"2026-10-09T15:51:04.224798Z","last_seen":"2026-10-09T16:22:41.22033Z","times_seen":2,"resource_available":true,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"phantom.larpshop.cloud","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}