{"report_id":"d3c31b2c-3765-4d93-90af-3c30e8e3292f","version":6,"status":"done","tags":["suspicious"],"date":"2025-08-18T12:31:16Z","url":{"schema":"https","addr":"trezor-suites.io/auth.html????","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":0,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6?#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"title":"Trezor Suite"},"submit":{"url":{"schema":"https","addr":"trezor-suites.io/auth.html????","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":0,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-22T12:31:16Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-18T12:30:56Z","timestamp":1755520256,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.10","port":36658,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-18T12:30:56.085016+0000\",\"flow_id\":1365265363283442,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.10\",\"src_port\":36658,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":918,\"bytes_toclient\":4500,\"start\":\"2025-08-18T12:30:56.044530+0000\"}}"}],"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"trezor-suites.io","ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2025-08-10","domain_rank":0,"first_seen":"2025-08-11T21:12:06.706356Z","last_seen":"2025-08-11T21:12:06.706356Z","alert_count":21,"request_count":20,"received_data":1188598,"sent_data":10736,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.0.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2025-08-18T10:35:07.844518Z","alert_count":0,"request_count":1,"received_data":1714,"sent_data":385,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2025-08-12T11:56:20.71279Z","alert_count":0,"request_count":1,"received_data":401,"sent_data":609,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-18T12:30:56Z","timestamp":1755520256,"ip_dst":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.10","port":36658,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2025-08-18T12:30:56.085016+0000\",\"flow_id\":1365265363283442,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.10\",\"src_port\":36658,\"dest_ip\":\"149.154.167.220\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":918,\"bytes_toclient\":4500,\"start\":\"2025-08-18T12:30:56.044530+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"trezor-suites.io/js/jquery-3.7.1.min.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-14T13:37:26.01681Z","times_seen":185629,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6?#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","size":8399,"data":"","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/recover.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","size":8399,"data":"","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/config/config.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"bc90fd178e81f1a313da5005497d5d4f","sha1":"8812f362d120eb0cf52dab23cff9a5a9563b9a6d","sha256":"c029d2e6ae89c6a24741c3c23c4e5daa07d3ed78095b64f584bcbf30ec9f4684","sha512":"c4ae947003c4f78ee7bdbe4bc62045b124c680b1aa209dedcb2be432760d94d0b832de41fc7d9f034d99c4528926ba64780970a9e467dac429a2a07730af8cc0","ssdeep":"","tlshash":"a9f075af0a84f100396c0179d45f222337dacc1cb1c4d011f48b4743db502b6f173a99","size":527,"data":"","first_seen":"2025-08-11T21:12:11.796047Z","last_seen":"2025-08-18T12:31:17.537218Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/jquery-3.7.1.min.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"da05bc651316292b346c032628454b5c","sha1":"2688ecab289be0657a26e8fb5a92a1c986a6e9ee","sha256":"07719189da6e936d361950ea0b1f29316a26a77b29bf3b18f69bfc6fb825278e","sha512":"76c96d3671f98d49079f5210d740c122c669853341581e237209a6a5b41fb7dc7e9a651af2f3423d01222f98b128b7fede75a1d6fe42b70efe18bd0cbb1e50df","ssdeep":"","tlshash":"5a11549d3455b2bb2aa312e47137954ff271517c205c18328b5dd8f66cb9caf8233a8c","size":1000,"data":"","first_seen":"2023-11-13T22:31:22Z","last_seen":"2026-06-07T05:31:10.709092Z","times_seen":8829,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/secure.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b195785f343b156a3b9357b101ef7220","sha1":"6e48d4832a530a7ba332c03312d751420eca5d35","sha256":"ab475ea33c25c49c8ee1bd303f1b884ca5dc40d8aa4df95a21b21d88422027aa","sha512":"d99115611aec9bceb3e95d0d45c16ae8917657a336c6f339f240d8d27c29f6980704f3d907d2a46600e27a49447610f2c4f8400e5000bad49828d4329f9eca4e","ssdeep":"","tlshash":"0811af0bec150d8aff54e322c0dcf1e9521d47093d64cecec639c791e435191a6e4898","size":1000,"data":"","first_seen":"2025-08-12T06:28:33.262702Z","last_seen":"2025-08-19T13:03:33.348073Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/config/config.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"bc90fd178e81f1a313da5005497d5d4f","sha1":"8812f362d120eb0cf52dab23cff9a5a9563b9a6d","sha256":"c029d2e6ae89c6a24741c3c23c4e5daa07d3ed78095b64f584bcbf30ec9f4684","sha512":"c4ae947003c4f78ee7bdbe4bc62045b124c680b1aa209dedcb2be432760d94d0b832de41fc7d9f034d99c4528926ba64780970a9e467dac429a2a07730af8cc0","ssdeep":"","tlshash":"a9f075af0a84f100396c0179d45f222337dacc1cb1c4d011f48b4743db502b6f173a99","size":527,"data":"","first_seen":"2025-08-11T21:12:11.796047Z","last_seen":"2025-08-18T12:31:17.537218Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/secure.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"8ab0ecc9fa70872d139af6d03ced77e6","sha1":"df9517aedde5f2b1caa198f2c1018521fab9e696","sha256":"aa81331ab020d34d836b6e37164430ec84c83d22a140cb40273c2225183087ab","sha512":"45540f2f24df521e318efcf9ec656524434de190b991f1da34e8511f2b95f4e4fa5f252a4c19196f88596be1ebdd1d769b5d0cdb4dc5e5ac475c2eeac067aadf","ssdeep":"1536:0wDWLzYY9zs5igBEqhTM/NEAMZVMtZZWU+69BR:ldUchciafR","tlshash":"d8733b0a9f020c9657b07aa7d1fe69dcd83cd3c7181286d4f9be9e84df3621859c4a9c","size":75033,"data":"","first_seen":"2025-08-11T21:12:11.803925Z","last_seen":"2025-08-18T12:31:17.545636Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6?#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","size":8399,"data":"","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"trezor-suites.io/config/config.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /config/config.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=AaCRw9Ry7h31VP8P; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=N6EoMR7Yv1eLY3XS; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 19:59:22 GMT\r\nlast-modified: Fri, 08 Aug 2025 05:09:00 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 59493\r\ncontent-length: 354\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":527,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"bc90fd178e81f1a313da5005497d5d4f","sha1":"8812f362d120eb0cf52dab23cff9a5a9563b9a6d","sha256":"c029d2e6ae89c6a24741c3c23c4e5daa07d3ed78095b64f584bcbf30ec9f4684","sha512":"c4ae947003c4f78ee7bdbe4bc62045b124c680b1aa209dedcb2be432760d94d0b832de41fc7d9f034d99c4528926ba64780970a9e467dac429a2a07730af8cc0","ssdeep":"","tlshash":"a9f075af0a84f100396c0179d45f222337dacc1cb1c4d011f48b4743db502b6f173a99","first_seen":"2025-08-11T21:12:11.796047Z","last_seen":"2025-08-18T12:31:17.537218Z","times_seen":8,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/jquery-3.7.1.min.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trezor-suites.io/auth.html????","date":"2025-08-18T12:30:55.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/jquery-3.7.1.min.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=iJsvZNJwoTTSMwGU; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":87533,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-14T13:37:26.01681Z","times_seen":185629,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/recover.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/recover.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=bBAOVl6POX6wsTFV; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 10:52:03 GMT\r\nlast-modified: Sun, 20 Jul 2025 23:56:24 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 92332\r\ncontent-length: 1966\r\nddg-cache-status: MISS,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8399,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Jun 2025 03:26:56 GMT","end":"Tue, 23 Sep 2025 04:26:54 GMT"},"fingerprint":{"sha1":"CB:93:31:E6:56:D3:32:7C:68:B4:79:F3:3A:6B:55:95:D4:3B:7B:EE","sha256":"D4:C4:92:7A:43:90:77:C5:0F:84:BE:87:D1:6C:EF:04:89:F4:4B:E4:C3:74:21:53:3F:47:BD:F5:18:8E:E0:51"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://trezor-suites.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 18 Aug 2025 12:30:56 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\nallow: HEAD, OPTIONS, GET, POST, OPTIONS\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://trezor-suites.io\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=zx3r0Uhl0ghxTrXKEW7bq3Oo9DtC4bMbIzlm0CW5Du0L0yS4r2O578sqvY3I4nnKmz6CtA5cZKYsMbqn2cd5erqk5AKG8KXwC7BxwcJEuDPRBvBMZJ2cntc4\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 97116cdeced0805b-ARN\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=11605\u0026min_rtt=7752\u0026rtt_var=8044\u0026sent=11\u0026recv=16\u0026lost=0\u0026retrans=0\u0026sent_bytes=4348\u0026recv_bytes=1181\u0026delivery_rate=555498\u0026cwnd=257\u0026unsent_bytes=0\u0026cid=88280c7fef97ca5b\u0026ts=476\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":744,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ff89c398a44cc92279d2b06af24de1b4","sha1":"b5652ec8dd9b65936f2fed18bc045e5a368461aa","sha256":"a7eb6e5e6e52b4e942822ffcf44f708eb4df446e553be9cdca5de5001ef2f7c8","sha512":"61b5625c01c8822b2ddb410c73285052aeda57268dab0e50b83e5dc217cb935902915f99725c45cab02371a3080049b563161904d8d95dfd929f0a4aedbcca2b","ssdeep":"","tlshash":"7701df78e4680e7bacb9135cb4386907127422075e16358e7bd0978d0f8e8bf30b534e","first_seen":"2025-07-24T09:57:19.696547Z","last_seen":"2025-08-24T16:40:15.909698Z","times_seen":734,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/css/TTSatoshi-Medium.otf","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /css/TTSatoshi-Medium.otf HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trezor-suites.io/css/fonts.css\r\nCookie: __ddg8_=CuK9vqDtXViweEjG; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=UBdkPMo0kN4vGnzG; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:38:02 GMT\r\naccept-ranges: bytes\r\ncontent-type: font/otf\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":318760,"size_decoded":0,"mime_type":"font/otf","magic":"TrueType Font data, digitally signed, 20 tables, 1st \"DSIG\", 35 names, Macintosh, Copyright (c) 2019�2020 by TypeType. All rights reserved.TT SatoshiMediumTypeType: TT Satoshi Me","md5":"e727cfbd3790350ff5b5e17e680ac354","sha1":"32c06d7597baff6e3ae02daf124e6096cf27b472","sha256":"7de6dae5dbfaa662ef8901ded1f49c04d216d77d798e2aa41b0e649590206e6e","sha512":"66c24d84316629309b3111eba6d00dbdd5a194184d30467a2bfa3e19965714082f3b8a1f636b592d380a05336ac07d21c1b81b3c34b378463cb558ce3e62013e","ssdeep":"3072:RZsOeIbsK2LNiq4XJztLa8zaRFE3301NvrnEksjGQFdJ24ZiCygt3/c/17l4HjiD:zskYTLoht941hrnEkKFbJE5W6","tlshash":"bd64c687dffb5d17e3560bf98de18baa0665f503ef71268e6c619000c6ab2400e17de9","first_seen":"2024-11-22T00:31:32.77549Z","last_seen":"2026-08-01T12:25:15.696852Z","times_seen":79,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot6588790709:AAE4FVpHXATtU46hfeI_-NrXFQpU3qkskXs/sendMessage?chat_id=5843196897\u0026text=BOT%20ID:%20_d8FwGmllKM%20%20%20%20User%20Location:%2091.90.42.154%20%20Norway%20%20NO%20%20Oslo%20%20Oslo%20County","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.220","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:56.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 25 Mar 2025 13:09:41 GMT","end":"Sun, 26 Apr 2026 13:09:41 GMT"},"fingerprint":{"sha1":"8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D","sha256":"80:58:CE:C7:28:68:D2:99:42:91:1E:43:06:54:D2:D6:F0:9C:DD:E2:F7:6F:68:A0:8A:EA:0C:15:FB:DB:8C:CD"}}},"request":{"raw":"POST /bot6588790709:AAE4FVpHXATtU46hfeI_-NrXFQpU3qkskXs/sendMessage?chat_id=5843196897\u0026text=BOT%20ID:%20_d8FwGmllKM%20%20%20%20User%20Location:%2091.90.42.154%20%20Norway%20%20NO%20%20Oslo%20%20Oslo%20County HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://trezor-suites.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 400 Bad Request\r\nserver: nginx/1.18.0\r\ndate: Mon, 18 Aug 2025 12:30:56 GMT\r\ncontent-type: application/json\r\ncontent-length: 56\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d948d5845276032d39194409db9ad97b","sha1":"475fe4e71224df85d494e34e0cb8ed799afcdb0d","sha256":"a0a1e0f24b392c6da875c10977d169497a47f669b7e671e62330e125a56721fb","sha512":"3e538a78d85dc32eb47db705c97d627ed8851f6dd87904e2e39aa1d5357cdeaea2a7746fc2ccddbde9bcbcab66ddcceff4ab5cf8db169c49e0f81c592104c67f","ssdeep":"","tlshash":"22900244098ed56744da11605935954855b756b8641964404d95611d56421ea58f240a","first_seen":"2023-07-28T20:34:41Z","last_seen":"2026-08-14T13:18:52.627209Z","times_seen":471,"resource_available":true,"data":null}},"time_used":312,"timings":{"blocked":146,"dns":3,"connect":18,"send":0,"wait":20,"receive":0,"ssl":120},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/auth.html????","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-18T12:30:54.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /auth.html???? HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=iJsvZNJwoTTSMwGU; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg1_=Gr03t9cOyElCnx2yYapq; Domain=.trezor-suites.io; HttpOnly; Path=/; Expires=Tue, 18-Aug-2026 12:30:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Thu, 10 Apr 2025 05:14:22 GMT\r\naccept-ranges: bytes\r\ncontent-type: text/html\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":4780,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4095), with CRLF line terminators","md5":"e360a5f611fad4913ea7b6e3e68f4a89","sha1":"284d531bcb1af181714080c7763ff3076ea7d06f","sha256":"26ee532d6e2add37d52a5e5f440673818d8f1aaae2a3c81861334251c78d4635","sha512":"61810119195c9ec7ace38120f736d4963e8e34e591cdbd260d772f7920b4686ca31ee9f7f5ca2c4a7e5fc6ebc5ac8e67deb345f415b5d46fbde3320b440ea497","ssdeep":"96:T6pUFTj8SXydNy1rw/bKYPcquIlozVv/qRY:TXFTjvXydw10bKYUq9lPRY","tlshash":"f8a1d771a86ffc1fa3945371e84353985db3243fd394aa80d5c810139aa3345f9d8a46","first_seen":"2025-08-11T21:12:11.781821Z","last_seen":"2025-08-19T13:03:33.340572Z","times_seen":9,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":120,"dns":43,"connect":18,"send":0,"wait":173,"receive":0,"ssl":59},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/secure.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/secure.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=AaCRw9Ry7h31VP8P; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=bTD3o0a7QkUDVigQ; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 09:40:13 GMT\r\nlast-modified: Fri, 08 Aug 2025 04:49:30 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 10242\r\ncontent-length: 16956\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":75033,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (58855), with CRLF line terminators","md5":"8ab0ecc9fa70872d139af6d03ced77e6","sha1":"df9517aedde5f2b1caa198f2c1018521fab9e696","sha256":"aa81331ab020d34d836b6e37164430ec84c83d22a140cb40273c2225183087ab","sha512":"45540f2f24df521e318efcf9ec656524434de190b991f1da34e8511f2b95f4e4fa5f252a4c19196f88596be1ebdd1d769b5d0cdb4dc5e5ac475c2eeac067aadf","ssdeep":"1536:0wDWLzYY9zs5igBEqhTM/NEAMZVMtZZWU+69BR:ldUchciafR","tlshash":"d8733b0a9f020c9657b07aa7d1fe69dcd83cd3c7181286d4f9be9e84df3621859c4a9c","first_seen":"2025-08-11T21:12:11.803925Z","last_seen":"2025-08-18T12:31:17.545636Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"trezor-suites.io/img/png-4.png","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /img/png-4.png HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=WW0zIF9qpW65b4mv; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 00:28:03 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 76478\r\ncontent-type: image/png\r\nage: 43372\r\nddg-cache-status: MISS,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":76478,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 410 x 650, 8-bit/color RGBA, non-interlaced","md5":"b5684240712b0800649c2bb3096f0451","sha1":"cd3f3798233add81feb2d636a6c57261c43fd9e1","sha256":"dd401bf655e08186f32c04b30a48aa8c6154c2bd31e077d4b0a5e07c2f45f2e9","sha512":"a03df54349b086312a91f6bcee9b3c799434ab2e9123ab7b2cafee61ca64f0a8265fcc0482c55ae30271c843982a1fd9e3bff7c63cd8b8f1df6b41c0c48f383f","ssdeep":"1536:QROCU76guNexrDN730UPPQPnLF+mnCRI7f6azUFjs5y5VfP6JlGaiZ1wy:QROHSex/NwUPPmLFDfiFAOel+7wy","tlshash":"0a73025c862b6547f8dacd300592c1ff9182231d3af9276abe28158929b462dfc0d33f","first_seen":"2024-12-03T08:23:48.403487Z","last_seen":"2026-02-07T09:39:28.022037Z","times_seen":25,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/img/png-1.png","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /img/png-1.png HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=XWcFmMhqVCq1zaVC; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 76478\r\ncontent-type: image/png\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":76478,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 410 x 650, 8-bit/color RGBA, non-interlaced","md5":"b5684240712b0800649c2bb3096f0451","sha1":"cd3f3798233add81feb2d636a6c57261c43fd9e1","sha256":"dd401bf655e08186f32c04b30a48aa8c6154c2bd31e077d4b0a5e07c2f45f2e9","sha512":"a03df54349b086312a91f6bcee9b3c799434ab2e9123ab7b2cafee61ca64f0a8265fcc0482c55ae30271c843982a1fd9e3bff7c63cd8b8f1df6b41c0c48f383f","ssdeep":"1536:QROCU76guNexrDN730UPPQPnLF+mnCRI7f6azUFjs5y5VfP6JlGaiZ1wy:QROHSex/NwUPPmLFDfiFAOel+7wy","tlshash":"0a73025c862b6547f8dacd300592c1ff9182231d3af9276abe28158929b462dfc0d33f","first_seen":"2024-12-03T08:23:48.403487Z","last_seen":"2026-02-07T09:39:28.022037Z","times_seen":25,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/post.php?text=Session%20ID:%20_d8FwGmllKM%20%20%20%20User%20Location:%2091.90.42.154%20%20Norway%20%20NO%20%20Oslo%20%20Oslo%20County","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:56.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"POST /post.php?text=Session%20ID:%20_d8FwGmllKM%20%20%20%20User%20Location:%2091.90.42.154%20%20Norway%20%20NO%20%20Oslo%20%20Oslo%20County HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://trezor-suites.io\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=RhQ0m52CJzQTrYNT; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=oSCIUtqCSuiDXcMT; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:56 GMT\n__ddg10_=1755520256; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:56 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:56 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:56 GMT\r\nx-powered-by: PHP/8.0.30\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.0.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":23,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"0a3ab00abcbf1bc105bd26feb63e52fb","sha1":"1b6a110bab072d5efcda1b7d2cc1cfe282a330d4","sha256":"8f738bf1e381ad353e76bd49bde43ad34d76c6ffa2caddcc6026617e70400463","sha512":"e0f5cd21f2bd7793699f331df199736d1e3a0ce268dae4f2f4eb346c12b83f1a8dd40c43ebce980e0f197e4c9b3e29b284de7b2fefc95f55bc9824a229dce7b9","ssdeep":"","tlshash":"7170002b080002c0008220288820282aa0c030c208000022e02ea808caa88322083280","first_seen":"2024-07-06T05:37:52Z","last_seen":"2026-04-05T11:43:20.556888Z","times_seen":25,"resource_available":false,"data":null}},"time_used":599,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/wordlist.json","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /wordlist.json HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=UBdkPMo0kN4vGnzG; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=RhQ0m52CJzQTrYNT; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":315,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a34ac19f4afae63adc5d2f7bc970c07f","sha1":"a82190fc530c265aa40a045c21770d967f4767b8","sha256":"d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3","sha512":"42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765","ssdeep":"","tlshash":"b0e0e75f41473347402252907dc110d1d505236b797161fd3d85b4ab501dc3dc99f7dc","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-08-14T12:24:37.39558Z","times_seen":146738,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/css/fonts.css","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.585Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /css/fonts.css HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trezor-suites.io/auth.html?????\r\nCookie: __ddg8_=AaCRw9Ry7h31VP8P; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=5IzDJB8NOqyJPGT1; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 19:59:22 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 59493\r\ncontent-length: 179\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":615,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f72bac84a2041d90e3a209110f92e9c4","sha1":"639d7f2af3188e25033679ca8fe0a209341bb614","sha256":"b853530af844d5ca7e8af27205367704f8942f4eec3c91fd52d27ac9ac14f656","sha512":"3d1dc77a463ff72903e2cc898d93cf95399c21112586f15bfbfd697a453bf79aae7f7459c93593622313099bb4d65852cae0f341ef2a9b133b4041a2c97d8e9f","ssdeep":"","tlshash":"c5f04410551aa042b1701d4eb78b3a28dd0e245b52468022bbb93f689ff66365381fbd","first_seen":"2024-12-03T08:23:48.397365Z","last_seen":"2025-08-19T13:03:33.34459Z","times_seen":16,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/jquery-3.7.1.min.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/jquery-3.7.1.min.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=AaCRw9Ry7h31VP8P; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=eOaU4X9Px0pEawuI; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 10:52:03 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:08 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 92332\r\ncontent-length: 30022\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":87533,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-14T13:37:26.01681Z","times_seen":185629,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/img/png-3.png","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /img/png-3.png HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=XAojZfVT0Q3iKvWQ; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 26046\r\ncontent-type: image/png\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":26046,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 106 x 667, 8-bit/color RGBA, non-interlaced","md5":"45189e65d5f4dc4be87c9edf004b8043","sha1":"d948062b5de8d5fe3f2af9352e87092b1afdd655","sha256":"c6ee1abbe2c377ea2bc27b7adb34b9731cbac4fd0bd54309cdc12f0e00860280","sha512":"80de9344627b0cbc25c2bec3dac597bea72717e79d7eb220f521f49bb27b750591778bbcf78dd0d1da0741607663ffbe4e784acd55587519b1cc3d03a0e47290","ssdeep":"768:rawwmlXGAZWRqUaX1YJkkvfoO8qynlBJ69:rawXlb4aX+q4gO8xBJ69","tlshash":"49c2e04c80f3e5b47ca3991886223867e3b42732116fb59d8998273932f66613dacf15","first_seen":"2024-12-03T08:23:48.399828Z","last_seen":"2026-02-07T09:39:28.054084Z","times_seen":26,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/recover.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.797Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/recover.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=CuK9vqDtXViweEjG; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=qtB2uPNYwrqZS1Li; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 10:52:03 GMT\r\nlast-modified: Sun, 20 Jul 2025 23:56:24 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 92332\r\ncontent-length: 1966\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8399,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/img/png-2.png","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /img/png-2.png HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=LVDygeogQQ3CgiAi; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 09:40:14 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 26046\r\ncontent-type: image/png\r\nage: 10241\r\nddg-cache-status: MISS,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":26046,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 106 x 667, 8-bit/color RGBA, non-interlaced","md5":"45189e65d5f4dc4be87c9edf004b8043","sha1":"d948062b5de8d5fe3f2af9352e87092b1afdd655","sha256":"c6ee1abbe2c377ea2bc27b7adb34b9731cbac4fd0bd54309cdc12f0e00860280","sha512":"80de9344627b0cbc25c2bec3dac597bea72717e79d7eb220f521f49bb27b750591778bbcf78dd0d1da0741607663ffbe4e784acd55587519b1cc3d03a0e47290","ssdeep":"768:rawwmlXGAZWRqUaX1YJkkvfoO8qynlBJ69:rawXlb4aX+q4gO8xBJ69","tlshash":"49c2e04c80f3e5b47ca3991886223867e3b42732116fb59d8998273932f66613dacf15","first_seen":"2024-12-03T08:23:48.399828Z","last_seen":"2026-02-07T09:39:28.054084Z","times_seen":26,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/img/warningSmall.png","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /img/warningSmall.png HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=eOaU4X9Px0pEawuI; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=kQ9IhJmUBPvi7ymt; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:35:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12636\r\ncontent-type: image/png\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":12636,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"0c37b0c55a08920c1dc3986766119daf","sha1":"a1ed88c878c3774e463520051b4862eac60df93d","sha256":"7acec745d8a64ee063601a3f3704dfcbf651732cbf21480f19d7772799774429","sha512":"229c2cad0ac51700701c7338405a389126c180fdbab539483644003a96bc662379c59d69914890e4184ec32869e6091e79388496bf957b22641682b896154f85","ssdeep":"384:skF37XXG8Npckjb8BUwUVOXTmxe/Puzlk:97HxNpckEBUwUV/lk","tlshash":"6d42c121fcb3a857145cce3bab24349720b74dd0c885164245fa24f87da95f4c8e98ed","first_seen":"2024-11-26T01:24:06.797761Z","last_seen":"2025-08-19T13:03:33.336239Z","times_seen":20,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/js/recover.js","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /js/recover.js HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=XWcFmMhqVCq1zaVC; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=CuK9vqDtXViweEjG; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Sun, 17 Aug 2025 10:52:03 GMT\r\nlast-modified: Sun, 20 Jul 2025 23:56:24 GMT\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 92332\r\ncontent-length: 1966\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8399,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"2fb680861696894dafa793f93505b9c1","sha1":"c0d62212a9755c6ae197ff3abe12482501058b0c","sha256":"a4939b7d6ae6a2b1b50ecf9fdd336e3886c5dbe927b87e923b8c7a3dac05cdd0","sha512":"af8be074e33d9cb749031d8618f3f97e1423ba2db28c41002a68af1bfe937766ecc1f3f0f835697531aef313bc617bc74931432e327ca67cdca89aec80baa906","ssdeep":"96:KIbtXFD4w8e6pX3UCzgxJsQD2clu36ZBa6dezyJ13DBExNlbEFURW:KS1RJCzyLDehw6g","tlshash":"7f0211d4b1a22b920537737aca6b840cff31143b550147217c6f4ad42f78a588ab3fac","first_seen":"2025-08-11T21:12:11.787775Z","last_seen":"2025-08-19T13:03:33.338368Z","times_seen":9,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/css/TTSatoshi-DemiBold.otf","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /css/TTSatoshi-DemiBold.otf HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trezor-suites.io/css/fonts.css\r\nCookie: __ddg8_=qtB2uPNYwrqZS1Li; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=qSNPhxCFe77RuSle; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Tue, 28 Jan 2025 06:38:12 GMT\r\naccept-ranges: bytes\r\ncontent-type: font/otf\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":312024,"size_decoded":0,"mime_type":"font/otf","magic":"TrueType Font data, digitally signed, 20 tables, 1st \"DSIG\", 35 names, Macintosh, Copyright (c) 2019–2020 by TypeType. All rights reserved.TT SatoshiDemiBoldTypeType: TT Satosh","md5":"92196fc08fa4a38e62c9f3bee1764f3a","sha1":"5b957f6e6397eef25a155106893b96fd15172887","sha256":"fcefb74239de3b1e766c2bf57d257d7a5bdcb2502f5bb1e8e4205d12662b9113","sha512":"f56fcb863020750ae8b324a1c74be9cae8d35b08fe9293506c28b2b2f2a9e952df0d605f7921eaa1fa1cece9e122476c5850876ff1ed752a494c020a99dff0b2","ssdeep":"3072:pIss/GIE2Yc1JrSEe94gm6dppe1S1kMuXSqksrZrRYkpNMUxB3jV+bAoUxt0E9la:Kss/RE2YcTSH4gBLeKqksFrF9Vvt0tW6","tlshash":"4f64e8c6dafb9d17e3550ab99de3836a1ba0f907efb1328e6c609050c6db2505d13ed0","first_seen":"2024-12-03T08:23:48.411142Z","last_seen":"2026-08-01T12:25:15.716895Z","times_seen":38,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-18T12:30:55.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /auth.html????? HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=DIAIErwga2v50ZUa; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=AaCRw9Ry7h31VP8P; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Thu, 10 Apr 2025 05:14:22 GMT\r\naccept-ranges: bytes\r\ncontent-type: text/html\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":4780,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4095), with CRLF line terminators","md5":"e360a5f611fad4913ea7b6e3e68f4a89","sha1":"284d531bcb1af181714080c7763ff3076ea7d06f","sha256":"26ee532d6e2add37d52a5e5f440673818d8f1aaae2a3c81861334251c78d4635","sha512":"61810119195c9ec7ace38120f736d4963e8e34e591cdbd260d772f7920b4686ca31ee9f7f5ca2c4a7e5fc6ebc5ac8e67deb345f415b5d46fbde3320b440ea497","ssdeep":"96:T6pUFTj8SXydNy1rw/bKYPcquIlozVv/qRY:TXFTjvXydw10bKYUq9lPRY","tlshash":"f8a1d771a86ffc1fa3945371e84353985db3243fd394aa80d5c810139aa3345f9d8a46","first_seen":"2025-08-11T21:12:11.781821Z","last_seen":"2025-08-19T13:03:33.340572Z","times_seen":9,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"trezor-suites.io/css/theme.css","fqdn":"trezor-suites.io","domain":"trezor-suites.io","tld":"io"},"ip":{"addr":"190.115.21.66","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://trezor-suites.io/auth.html?????#mode=secure\u0026device=ae04a70cbb3-67ae04a70cbb5-67ae04a70cbb6","date":"2025-08-18T12:30:55.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.trezor-suites.io","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 19:39:58 GMT","end":"Mon, 10 Nov 2025 19:39:57 GMT"},"fingerprint":{"sha1":"55:91:65:6F:4A:8F:94:AA:21:5E:27:05:B1:81:31:8A:7B:6E:87:27","sha256":"57:8D:C2:10:E4:89:69:F5:F2:A0:0E:51:25:FF:A3:38:45:76:FC:EE:97:F6:C7:8D:19:B9:43:44:48:7D:37:4C"}}},"request":{"raw":"GET /css/theme.css HTTP/1.1\r\nHost: trezor-suites.io\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://trezor-suites.io/auth.html?????\r\nCookie: __ddg8_=AaCRw9Ry7h31VP8P; __ddg10_=1755520255; __ddg9_=91.90.42.154; __ddg1_=Gr03t9cOyElCnx2yYapq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=AuDJlw7iHIcUKIx2; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg10_=1755520255; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\n__ddg9_=91.90.42.154; Domain=.trezor-suites.io; Path=/; Expires=Mon, 18-Aug-2025 12:50:55 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Mon, 18 Aug 2025 12:30:55 GMT\r\nlast-modified: Thu, 10 Apr 2025 05:19:26 GMT\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 8499\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":41954,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (16802), with CRLF line terminators","md5":"17a0fc619d83a6b5d4ad7e378896eb0c","sha1":"80dc417825f69240d169db882eab72a881d4ba2d","sha256":"9917e9f42594afa241f2a9342600792adac47b14769690f5f793874eef57742f","sha512":"e1fbb7a7dd269cca0896c59f4aff2137efde030dec0d5e514165173bd7721f280ad8c71dfd6440f49c6f4e6a4b7c8434e5c639c5a505f768ed90c6e7f4725cec","ssdeep":"768:y7SDcDvLPwpfsDcDvLR4NsckvPOpTxD5Jd:yTDTPUdDTR4NsRvuxD5n","tlshash":"de13e8265a0638a3593a3ebadbf51d0dd748e0b36513055cf6c91888afff12c4d94b9c","first_seen":"2025-08-11T21:12:11.798086Z","last_seen":"2025-08-19T13:03:33.339877Z","times_seen":9,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-18","alert":"Sinkholed","trigger":"trezor-suites.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}