{"report_id":"cadd72d9-4781-4dd6-ac3b-e6d5e0410ad0","version":0,"status":"done","tags":[],"date":"2026-09-19T07:08:49Z","url":{"schema":"http","addr":"embercurvereward.xyz/","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"embercurvereward.xyz/","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"title":"Ember · Launch on Solana, paired with any stock","dom":{"size":65607976,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (31010)","md5":"4f626ea600a7a7779b465ffbddc5585b","sha1":"f7b484fe19db55e61c7dd759d093c1aaba5e174c","sha256":"6a2bf9eab92afced167687a38a3ab0c6436fbcce2013966d1b79059d4058b9e5","sha512":"9c743132660698467eec5dd57fcc3717b710e38e6f3fa3b59ada0402a29a0cb7e3a4be86f4897f65d7a5d041a590ee34019f34916d8aef0c8089c5dc33fc8378","ssdeep":"49152:1G4525HuFJgpqW9ZeTjTClCTRTQzJBgaTRTQzJBgTTRTQzJBgRTRTQzJBg7CPK87:eCJ","tlshash":"9ce73330aea77d3a075c9229603f2f1e2ee04ec78148d6d6b39c75d757caf404a5b868","dom_hash":"domhash66051bac3dd268aaed2258131f1c8104","first_seen":"2026-09-19T07:09:04.02848Z","last_seen":"2026-09-19T07:09:04.02848Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"embercurvereward.xyz/","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T07:08:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"embercurvereward.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"embercurvereward.xyz","ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-14","domain_rank":0,"first_seen":"2026-09-19T06:56:55.415652Z","last_seen":"2026-09-19T06:56:55.415652Z","alert_count":3,"request_count":3,"received_data":66290281,"sent_data":1525,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"embercurvereward.xyz/","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"78db240014e383765240cb39ddfba5bd","sha1":"c471ccfa8fa8c9c7d270da18ead97555a6aebc89","sha256":"e3ae09f6cc9535c88d2c2bd443e7757161a5512e14304567d0c484c51fc84fda","sha512":"8237f12016af4551c0e1286b29494f7a12b886227f2a97dabcd517e88a2987c7f14fb96374ab82f52cee5b091e7371cfbc784226e9daf6bdf94539c53b178417","ssdeep":"","tlshash":"06c0c050c0f08f34084c40ffc03c01e035e07d2c016224c5c6b85c4dc8ccd914f04d10","size":180,"data":"","first_seen":"2026-09-01T19:54:28.593872Z","last_seen":"2026-09-19T07:09:04.03341Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embercurvereward.xyz/secureproxy?s=%2Fipfs%2Foy7oJloaFZBemiMDVVokXg0226a5eaf51e219899ce4de466a7fa84%3Ft%3D1789801679221","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e7af52d8b0c552d1405a246b2bc266b7","sha1":"72656b09bbad54b01ecf27d22fd04ce803270caf","sha256":"3a64aa570256320f95ddf6a870ce4f33c4028d5b5638c54131654098699fd8d6","sha512":"d3060674eb84bbb8f1c177cc738ac1e2cb44bcf4053b8f8da47310542534b7acc5db613365208dbfe74a458db7c36712e9230672d61bd71dbea18e6f81b49fd3","ssdeep":"6144:ch5gDXrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:csbq9NWCEiox3Ti/ESVPHSyyA","tlshash":"98d4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","size":645581,"data":"","first_seen":"2026-09-19T07:09:04.029967Z","last_seen":"2026-09-19T07:09:04.029967Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"embercurvereward.xyz/secureproxy?s=%2Fipfs%2Foy7oJloaFZBemiMDVVokXg0226a5eaf51e219899ce4de466a7fa84%3Ft%3D1789801679221","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://embercurvereward.xyz/","date":"2026-09-19T07:07:59.223Z","timestamp":1789801679223,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"embercurvereward.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 14 Sep 2026 21:01:25 GMT","end":"Sun, 13 Dec 2026 21:01:24 GMT"},"fingerprint":{"sha1":"00:C2:4D:DE:D7:9C:AF:9A:2A:13:E4:ED:78:E4:76:1F:8F:53:44:5B","sha256":"F3:87:C4:AF:11:B6:93:1F:99:8E:50:C0:C3:F7:15:76:54:A6:83:18:09:8B:67:D5:1E:EB:A9:E6:E5:23:8A:09"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2Foy7oJloaFZBemiMDVVokXg0226a5eaf51e219899ce4de466a7fa84%3Ft%3D1789801679221 HTTP/1.1\r\nHost: embercurvereward.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://embercurvereward.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 19 Sep 2026 07:07:59 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"9d9cd-cmVrCbutVLAezyfSL9BM6AMnDK8\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=kkuqaEIG6GT89fVqnPCmeA.js\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/19/2026 07:07:59\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: d534459a7d0949b6a6e32ef4c15af7ea\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QFpSLSLNOAsDidnmbzp7ywIxENqduJlpYRyJhHudunRPsPIiImo1OJdecrLfdS7YbJRUpAfJPbGYFNd9hZqLWXght%2B0PImGfOD18QHIY2%2Bq9eJbVRAnYslFNQdSqhoAumN%2Bv0EyaQw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a3d6c1af2aebb505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":645581,"size_decoded":141884,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e7af52d8b0c552d1405a246b2bc266b7","sha1":"72656b09bbad54b01ecf27d22fd04ce803270caf","sha256":"3a64aa570256320f95ddf6a870ce4f33c4028d5b5638c54131654098699fd8d6","sha512":"d3060674eb84bbb8f1c177cc738ac1e2cb44bcf4053b8f8da47310542534b7acc5db613365208dbfe74a458db7c36712e9230672d61bd71dbea18e6f81b49fd3","ssdeep":"6144:ch5gDXrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:csbq9NWCEiox3Ti/ESVPHSyyA","tlshash":"98d4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","first_seen":"2026-09-19T07:09:04.029967Z","last_seen":"2026-09-19T07:09:04.029967Z","times_seen":1,"resource_available":true,"data":null}},"time_used":628,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":536,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"embercurvereward.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embercurvereward.xyz/secureproxy?s=%2Fjmpd%2F","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embercurvereward.xyz/","date":"2026-09-19T07:08:01.491Z","timestamp":1789801681491,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"embercurvereward.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 14 Sep 2026 21:01:25 GMT","end":"Sun, 13 Dec 2026 21:01:24 GMT"},"fingerprint":{"sha1":"00:C2:4D:DE:D7:9C:AF:9A:2A:13:E4:ED:78:E4:76:1F:8F:53:44:5B","sha256":"F3:87:C4:AF:11:B6:93:1F:99:8E:50:C0:C3:F7:15:76:54:A6:83:18:09:8B:67:D5:1E:EB:A9:E6:E5:23:8A:09"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: embercurvereward.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nContent-Length: 1309\r\nOrigin: https://embercurvereward.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1309,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QBDAMEAyIACAAzA9cCJwDiAh4AAAECUQMAAO8nhn2XtsKCARQOcIXzmUzDiXSw-I4CAADJpY_1xdjKHPrYO_f8Zs_TZjZlQPdFzrfDOkgpQt_bpfgq-bdWaRYc6CdHYg1e5oZKCpM8PkZwcJ54AEgwxJTw9C8e433mCXoCFKUHLN-ot2cpNiH9xktjeUDzms7zGIRGdeTQSb4Qj4MGuYP95jPzAudDCUerXfW4lRt02WN0cdCwp1WewZr8EgNI1u7ZKrowKuT6EbqMBh_T39Wxu49enp_hp3FmURiRPnPkIaD8qvMqHc2Ga0m8sGVNCXAWwwIsq3gGNrEVFu-8bdRxx7DGYzq3Ba0o8ZLvOAVb1q7sX9zWPVhJh8SKxu_BlH0kihXGsWMXfFe0BjKuabBYHOctjTUu_Ge-v_1EPFsltvzRobYYof3BCgultTpewHeSQkqwIDY__ca-7n0Xq9jKtEZJBtaLs8kk8lYA81K-A2bJGHYPIT3qApjwIGz4BntRKYi8a7uiiOCiLPz02ym5-6N6deN-EnUQjTmHSb9DfwJjuAhFobwtjaC8yWMHifuuAHjbthKJ9OWCe5zwZ6djU-x-Wdk84PAb-RZNH9a4nW3u9OaxR3am8vffPGKpMEn-vRMxpgs0kbql2JqzvGOSLHjJjVMt553uW_F2QjntQT6YJ_Vxzun_Pt1Q9G8vhDB8un4-tXeX6j6WOk5URV6YhdqwdrryPXMcaz5ETBZJgwPn48CADHvgbTX1opz0ELCRhMxDAnx7BopyULVOQFBXWCfORRVopI-Vpf8BCARvCA141fXCxRkm4L7_mKQCRdZg7dY42-w8LOdPRHhfnGTuuENpOftojLowZwBaux8GAHUjl_f_cdF3YHCkg0aLWZc0l2ShaLODSIZT-amgrIPOfeDwn8s722WucoHqWZ9lB_WF7JjRzhhHwMEYZEZ9tvA_xTyUaPIhTXISw4ZoPAGzExgpuzQMarUh6Glt4-_G6J6J16Jkx6T7UqF2t0DJuN6CJ-gRM7wLgNqdv0tSEajiMRJVY_3IBMECQV6n0YmT1sBV_E_1Cpxd6BqCob_JpL7YRVrn2oQB051oT4L77d2-KyOFJSiHHfovQNtH36b6RnwP1PLgXnNqlt-921vheaag4Te1-TEM8uflbRCQKBiXJQQLNAwZAZyU17IOGFuGd7k5MqUwpfWAexifAL2f0KQQNFgooY7e2Uj2JBA\",\"challenge\":null}"}},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Sat, 19 Sep 2026 07:08:02 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 19\r\nx-ratelimit-reset: 1789801741607\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 09/19/2026 07:08:02\r\ncdn-edgestorageid: 1444\r\ncdn-requestid: ef34a826fdce3355f4695db905bc321b\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sRXGPk%2F5SXswaBWIIJOIOmcO9BnDGYzg8zvJ7PUbCAJxm4PrWDGTpI%2BZWugQa0K6s8Rj2llenNEUpjzMkhloM7%2BE1KKfdimHPMQ1B%2BWv8wO2sMg4gSFpbMJbcG%2Bm%2BnW36HFhUuYyLA%3D%3D\"}]}\r\ncf-ray: a3d6c1bd5bc6b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":3260,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T13:41:56.030351Z","times_seen":18549281,"resource_available":true,"data":null}},"time_used":902,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":902,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"embercurvereward.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embercurvereward.xyz/","fqdn":"embercurvereward.xyz","domain":"embercurvereward.xyz","tld":"xyz"},"ip":{"addr":"104.21.94.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T07:07:58.520Z","timestamp":1789801678520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"embercurvereward.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 14 Sep 2026 21:01:25 GMT","end":"Sun, 13 Dec 2026 21:01:24 GMT"},"fingerprint":{"sha1":"00:C2:4D:DE:D7:9C:AF:9A:2A:13:E4:ED:78:E4:76:1F:8F:53:44:5B","sha256":"F3:87:C4:AF:11:B6:93:1F:99:8E:50:C0:C3:F7:15:76:54:A6:83:18:09:8B:67:D5:1E:EB:A9:E6:E5:23:8A:09"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: embercurvereward.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 19 Sep 2026 07:07:58 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Mon, 14 Sep 2026 11:29:54 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MZ9ArEKAerz3%2FD%2Fzi39A9SEncAeEgUDpw44ZaqMva7p8uYaSByweirQiiJwDf5IAOqvv8wDUDZmCvZ2vjtJ5mUkJj79w%2BaHUGBna74wyfjP25wgYtcEeGMaB8kfXCBxtF0Be4cHXaA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3d6c1ab7ac0b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65640819,"size_decoded":44878697,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (31010)","md5":"a85cddf74a038a273c00bb846934d58c","sha1":"0f5f2703bb3b714f9a44a4230d45b14209aabc02","sha256":"3ae0142175cc5c58b40005a318c2f17daad67af265dabd29e208e4859bf8dbc3","sha512":"348f27d9cea1cbb60e5daaae17baa5c3616767a521a85143e265e6d1a388c54dc83093a665a654e9d8edaa49f16a0f0ac4579b451f9c26a6f048bcf3758816e7","ssdeep":"24576:n08WcbTe45cuK5UbW6Ouwy2L2tWG/Bz+5qmpqG/zYmZeY50:JG4525HuFJgpqW9ZeN","tlshash":"7c2523f0ad587c7457066a9971dd9ac82ece4fcb800cf1e5e19cb0fa432eb9086d547a","first_seen":"2026-09-19T06:57:11.223837Z","last_seen":"2026-09-19T07:09:04.032506Z","times_seen":2,"resource_available":true,"data":null}},"time_used":3033,"timings":{"blocked":0,"dns":94,"connect":20,"send":0,"wait":224,"receive":2695,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"embercurvereward.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}