{"report_id":"e9225af5-6362-43a3-9432-732078fc33c7","version":6,"status":"done","tags":[],"date":"2026-03-24T19:33:18Z","url":{"schema":"https","addr":"curvefinance.co/","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"curvefinance.co/","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"title":"Curve Finance | Leading Decentralized Exchange | Curve fi","dom":{"size":50874,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1033)","md5":"52be8415db5ea80cb7291dfc83500458","sha1":"87ac93c7787a470bf117d8f5317cd906e4a8ce84","sha256":"cd6e744c36116f8dc734df3c689d653da958a567ad53f1b3525b319e1a7de377","sha512":"09e87baecc443a6b140dd723f38bb6bcf4194091d69d96b4947bed7b8a121a62b88b2135b70b28cd99f7b8de8e7435f31622b81e02065e8c198611be8c300873","ssdeep":"384:AUVJUyCdrpbb4BdkvsVnlNv5NpDNUTgzvaz4/uczWNY2NFzVoczNhMNWoAeguJxu:JdjxNVGWWDeU","tlshash":"a9339420e4f08433862301647b757b2d9f4de947860a0a91f5bc56be9fd2daacc3349e","dom_hash":"domhash1f6b3b51dc46dae99d8e68e8e1c031f4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"curvefinance.co/","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-28T19:33:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"curvefinance.co","ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":106,"request_count":53,"received_data":4758895,"sent_data":32550,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/brave.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/brave.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-12fe\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4862,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b8570ac8f51c4291503ae4ee6dfcd82d","sha1":"e7a4d1fd2d09c4aa1ee50aa9cf5ec7d943a35c62","sha256":"a9797c6dbb4c35116f99052b8f7fb379fb9d990042fbbf34d61b698e71f19b0b","sha512":"33f70f05d23009bcc8ddeba9fcf22852aa0672e952ba79fe00682b7e946c71c40f9470e94d996ca5f5f38ecc5920050c7d21f5679de5fbf74319617fc734ba22","ssdeep":"96:f6gPi5mSGYUqCqsxfgvi6Bnk6Lxg42Sfy5kSmLqTHgs:5PsGYUqGpgLkwg42SCBTb","tlshash":"40a163ffa2ecf0e5b106e7a4dd329461346634bfab56cb164268fe64792119cc88dcc4","first_seen":"2025-12-06T20:00:54.632299Z","last_seen":"2026-06-02T22:11:06.751013Z","times_seen":11,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/godaddy.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/godaddy.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-88c\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2188,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"09d1ade4969894b9aa548d0ef8edcf83","sha1":"6d42e1595151da6c804706e1dee2898e8dbb7fdf","sha256":"83f86990397717b454a277cbfcd9291f07b00467ae940707eb8b5ea2407b3103","sha512":"e8bd5bd5c671a7cfd92029af1ca1d3dcc314519ece43b5f979ab16d509dd2eca40931b195e271c6147439faab24f89c5bae348fdd861ea6f265f8f6b85e47596","ssdeep":"","tlshash":"cb411efd43e531f06007fbb0d665a0767b5b24ffba62cb194be8ed80960558d8898ce1","first_seen":"2025-12-06T20:00:54.648649Z","last_seen":"2026-06-02T22:11:06.703829Z","times_seen":11,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/favicon-48x48.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /favicon-48x48.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 4499\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-1193\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4499,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"c7ccdf1520a4b02848b6727f4a5d129d","sha1":"4c8746926a3c13e7a9d9e212aad5ec9db67f506f","sha256":"c82eaffb0d16b17261066f77322b08c371f33b23047339dc9115a83e5d4067ed","sha512":"4e7ccae9c40bfe6d019a9fe8ac3f1644fcc804966b01117128c3714834ac635a622966ac78b115969567d594909ba33b70c311523c1c2be70b415e84cd577d25","ssdeep":"96:hnRu/MFy3dDFWuL9z7ISR5mJjMSLmaF/30HPYJvO21spGwLbKbq:XTQDEuLeomJ7LBFv0HaGUsp5L/","tlshash":"f4916cfaf6a4b841fb611b3405b13a45d12bfa16c3f3bc4f9504c708a5a4a2da0af346","first_seen":"2026-03-24T19:33:25.633175Z","last_seen":"2026-06-02T22:11:06.736245Z","times_seen":3,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/stories-2.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.951Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/stories-2.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 54660\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-d584\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54660,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"26e880fbaaee24332702d47289f21ec8","sha1":"14666563c2e2a1801335025f6615f6efba702c1a","sha256":"32de93ad294cd3fce4945c80fb74331eb8429d83f1c298d4de6a51e887da50f6","sha512":"48c00c2d9839d784373197c64d5ba327766f1283cb0361394fc9f6bd33a43da9375a2525e72d7aad45f09931e4cdeb550d191c4ebc0ba48cc70a32b06b3329ff","ssdeep":"1536:AAZ3eRjZFQZYbnL1Jlbmrp8Z+VRjGigShwJDQA9Dn1z:14RjZ+eDhJE8Z+VxGchwldV","tlshash":"6933f1c44cebe0715b04abd2307a20860f3d99c8afeb6d6252b0d94d7f6573dab0116e","first_seen":"2025-12-06T20:00:54.627201Z","last_seen":"2026-06-02T22:11:06.707639Z","times_seen":11,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/css/bcfc3522bfdd2ecb.css","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/css/bcfc3522bfdd2ecb.css HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-c1c0\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49600,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (49588), with no line terminators","md5":"e9f84a59455b28148a9b101ab0c07f53","sha1":"4bf0b435e7f9d74bfdcbe8e93e1c500e58521c84","sha256":"4a56ea52f82fc0d4dcd7c8bce03fe1455b7695a5e77ff50efc71fd79de2bfefc","sha512":"17d407aa8680b08d94bbe56182a5f0f6083bed7ca327686640ed77a69d2a2e98241a004bfa1eea99a4a2cacde7ba8bf86a9ba495ea202ae8ec9deb7bf0d8b562","ssdeep":"768:mzal0JcQ5VvnTs6udjsNl/Txy6avU8RjcT98u988:mzal0hDlavU8iT98u988","tlshash":"1323a5b8e325e6bd7c3b66595abc901d33117772e5f807e8d6a1b601dec2bb30908634","first_seen":"2025-12-06T20:00:54.637337Z","last_seen":"2026-06-02T22:11:06.762374Z","times_seen":11,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/css/55cf7ad78c3be2af.css","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/css/55cf7ad78c3be2af.css HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-200b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8203,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8203), with no line terminators","md5":"d09a5c078182581ab8377296bac1a2c4","sha1":"a2ec99d180394ddc334c9c1e92c3c7493acd4ccb","sha256":"d0c5f2df837ad78aa9e98a573ea4b86b0de9bab5ed197cde9229edde1e583eb3","sha512":"f3f40db7117d13f99a59029f92e3f3cb5dd991c76f996f7bca7c5cc006acfbadff91ba9df550e9c66fbdf9dd30bde5923a629e45d80495e15a310da8ed38febd","ssdeep":"192:jz2SwZbOP+wluNssKA/hJkK5F9FiShNF2YMsfx/hMrEMRp1HIlWITlH9:PwEP+ZsvMdLD","tlshash":"1a02a07a8f5c9c28a7f2ca39d892d40d117a51037faa05fad7d0a06df6c96d04d3a249","first_seen":"2025-12-06T20:00:54.62806Z","last_seen":"2026-06-02T22:11:06.747126Z","times_seen":11,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/3e2eddd540c45a11-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/3e2eddd540c45a11-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 20764\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-511c\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":20764,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20764, version 2.6619","md5":"1df2099aec802227233400dbec921a97","sha1":"d4c352dd3f1b26c03c7a6efca04e131f778f4cd9","sha256":"80dfabd8df0db7a5d77d64e6040bd9fe0219eb64f126020ecb3158d69a88dc65","sha512":"5c0ed0e22b9f86de7e2a963667d7ed5d69bd903f71ba4b736858efd0f6c8870b69f21b5a19bcd08cbcd4fe82960364eab0cae34a76eb7c2115e10891d7cb8448","ssdeep":"384:9vVs0fRuFpuIaPNykvQqX9MLFxV6OXMJtcHC2MTrHR++RrrSr9U6Ev2J:D5EwB9tX9MLV6tgHC2sHRVtrK9tok","tlshash":"1392f1ef4125d2d10acc7a110a329e9e0841d35026bed7a7ec77022d8d92a4fb5a31fc","first_seen":"2025-12-06T20:00:54.613097Z","last_seen":"2026-06-02T22:11:06.732698Z","times_seen":11,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/luc.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/luc.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/home.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/home.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-6d5\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1749,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1f25640f72c088cb106f8adba8288a7f","sha1":"5f22c7c7c09fb27d8bc7400569038401eb1ac941","sha256":"24be15810d4782c3f1b8c69a3280040cf925c75ad210d240641e5d2c1dca973c","sha512":"4fe4421817354584df2496b28516e4d3b659b17f74619f8cf903d468689c9bd21a3a511314818830d194bf5ca7f560e1ce0bb1b977559247d24ac20671725983","ssdeep":"","tlshash":"7231d3f4326c41e95e0b4f80de37599d8d2a90fa6b8d56ddd1e4f59434291d3cc41ca8","first_seen":"2025-12-06T20:00:54.638741Z","last_seen":"2026-06-02T22:11:06.741973Z","times_seen":11,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/search.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/search.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-67d\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1661,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"81876563a33162377706bb1891259068","sha1":"4867d2436d2a959b5a1d0b2c64f592c595dadd9c","sha256":"7cd6446290e140474ffcbd4aee839986226aea508b14932040472e77cfc36ce3","sha512":"df341ab0b25aaa75a16b4de3b895cb811a99bd4c58ebefeee6c4e9de304c8ebcaad7a52f8db18ed705fc9b4d396644ef3e9b7193a53509adf192f6da2748acef","ssdeep":"","tlshash":"6d3122f82158c2e06a0eaa06ef347c80c06aecf61fc95ae9d195c9c428242c5de1ac68","first_seen":"2025-12-06T20:00:54.631411Z","last_seen":"2026-06-02T22:11:06.748646Z","times_seen":11,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/Brand.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/Brand.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/css/0cd1cdf70b131ed8.css","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.951Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/css/0cd1cdf70b131ed8.css HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-2276\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8822,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8822), with no line terminators","md5":"107715794dabcdcbd1dab75adfc13e3b","sha1":"2e5970e4c1398633c969dc047277f6f49a8a8a07","sha256":"9ab57ac376267e14c6a59fcd2bdebd11d6a2f96717f9c5bb92a898192442ea23","sha512":"58819cfcdefbc15aa7fa85fbfbc62d178dc5576a4dc871494b77d8f1fe6a033317b87a4a7e842828d47d979791d57b065eeff5a1becd3f8b556c533a49599f71","ssdeep":"96:HRxErApdBrH4s1RxgKEbpN9H46X2GIvWbWfdH65uI0P:xx1BrY+x29Y6OW8dHyu3P","tlshash":"4102df24501b901dd5b2bd8335cebb13245a9c15a5ec0971fe2e097e8deb87b23e1b78","first_seen":"2025-12-06T20:00:54.645985Z","last_seen":"2026-06-02T22:11:06.759864Z","times_seen":11,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/stories-3.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/stories-3.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 89806\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-15ece\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89806,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"59da409844dbc304762e5da16283e3aa","sha1":"76725c8b5d1f41e100362ce68957dd9ba7a491b7","sha256":"237e2409025d868c0496e1897bb47b93a4946dfa99fa4720175c8b4babf4e66e","sha512":"52a65a89b352b59ba1f47a9c2912ea18d9fd8aec28174fb8bbb4bd8ba0fe5b544489a1662cd9775e942bccbd639d7267d6d3179a33c123a66e01ca28b426f235","ssdeep":"1536:lgE8R0DpYQiHLzCHzjr5gAsknRCTzp+I7fr4YyqhS+RbjIK2pKrMMBdhYigHBrQ:ixSHHzjqAnwzp+I7frHyqhZ/SuMidhYs","tlshash":"2e931318e53374f3a6fe2c29a4047daa581b93eb2c99025b945ce0fdda0f844ed4f258","first_seen":"2025-12-06T20:00:54.616984Z","last_seen":"2026-06-02T22:11:06.708728Z","times_seen":11,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/plus.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/plus.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1014\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-3f6\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1014,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2445401276afe48615323fd692477c68","sha1":"9dba94cc63122cb99cf16e0ef64da5adf13e7fe1","sha256":"ef93e98a536ff010950b5aa5925b80240b6e836237f339d7556fc52592ef9958","sha512":"af5c631122a4ead2cd5a4dff293c4d3c6e4a4517d99a413aa5deff6ff905f84f72393cbf2daf4c373dfb10ee0f000c8c4400915794aec17c615087e7bc400202","ssdeep":"","tlshash":"f611aff02093c0c891838d24ac31befd9d5ea8b4fa5a12ee12d44b75fa517c3cc81e55","first_seen":"2025-12-06T20:00:54.639566Z","last_seen":"2026-06-02T22:11:06.701496Z","times_seen":11,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/blue-hover.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/blue-hover.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/green-normal.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/green-normal.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":49,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/pink-hover.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/pink-hover.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":46,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/pattern.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/pattern.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 276\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-114\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":276,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ae9f7dbb7bea688af7223ce7d8adc8d6","sha1":"0e75deb103acf9b54156384b85e568142a214498","sha256":"8c0bf33d2d0ac899fb2ce19308a50ea58558b4425644fdc10634b89f3647d48c","sha512":"7882ea1b771b9a35277d6052a0bcf7f5dee5a94eab59f94bd20414d0be0bd24ec3776b5cd506a3afb67af4c16ddeace6337e943d29a66bc3a1e4436e278cac4b","ssdeep":"","tlshash":"2fd01268d81a5b40d047c1758f2e659d17beb28be00e4495a6b964187420d6ba8337e6","first_seen":"2025-12-06T20:00:54.624576Z","last_seen":"2026-06-02T22:11:06.714798Z","times_seen":11,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":45,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/eebb10ca0b46fc81-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/eebb10ca0b46fc81-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 21696\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-54c0\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":21696,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21696, version 2.6619","md5":"12fb6a481aa16b818dc57a068af3a8cb","sha1":"aaec8e4d97a4ba1f30c9b46e6649b8053ae2f1aa","sha256":"ed100b3b70634cf68e03dc8b0e02e5693982b0f7d2a2655e4fbd0ca047d07b17","sha512":"c690f9b9879605b77508a6e95156c55376db123e2cd218967be221c17672bb2c06bb7464210668fcc237ef2f2962b8e76a6f082a08d800d3af559940b8df201a","ssdeep":"384:tebA+Z6E2P73UDgRPQwXMpCRD8VoLuG9nGNafNBM2PT+SATlZHzEeS1oGnG:gE9E8P0eIVohGNaFB5PTYB9zWoGnG","tlshash":"2ca2e17eb0b2098e9257e996fe5a8792c1c80107d9fcdf22af644753b8b340547827bd","first_seen":"2025-12-06T20:00:54.626218Z","last_seen":"2026-06-02T22:11:06.740604Z","times_seen":11,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/65303d7bdb6c1b1a-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/65303d7bdb6c1b1a-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 26252\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-668c\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26252,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26252, version 1.0","md5":"f365218a09a124f1912fcf412fe8f3e5","sha1":"5af184aacfcffa86b42c4408a5c28b6a72babfd6","sha256":"998940754a7f20d4c61c2becbe59b2a0750a4db59f94178ed0aa423e12f9be65","sha512":"4846419d190317e0fe325c0ac696baeb6d0e6a276eb17200d107c52612a882090687c205427c1b8516f449cf6f0c1c10c7b4a95609282d7e997796a9cb7a9239","ssdeep":"384:xk5bpTZ7bJ1ocvBLJPKGuee7pdlJH1wJLyN0OKxwqLnuhLt5Dq6W5JNa3V4r6bQS:xk3lMKyG23JH1wJZDLnuttJq68Na3K+F","tlshash":"e7c2e1b02ec09f08e21ea6b186dd646ebddb80ac55a751d5f27fa02a627c51173c0c9e","first_seen":"2025-12-06T20:00:54.63408Z","last_seen":"2026-06-02T22:11:06.75374Z","times_seen":12,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/ba6f52faa3750405-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/ba6f52faa3750405-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 35340\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-8a0c\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35340,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 35340, version 2.6619","md5":"01a9648065b0eb5e5185083a5af9ec7d","sha1":"2e46c40a359b6dedbd75285552ebacf2a393ed54","sha256":"005e0051ad41e326d8545c2671f9162db726cb72cb92f72bdc4d9d3c219c68f1","sha512":"b99dce21a93ed01fbafb1f9535e14dd7696f55b04ee53dd276cd64019fa5734ad6c9deb5fca889eb2afc102b35140a9fce792fd17dfb726ae1789545e126109d","ssdeep":"768:wGunvI1Y7aUAFdWTej2O9pmRP5amjfquiHmASBRdEaa:HuvgUG/jj6XjCuiH0RiT","tlshash":"e2f2f15a0e042c646742d87ca6e4677b610bcf85117a77e8b36baf8b07f52c11469f43","first_seen":"2025-12-06T20:00:54.625306Z","last_seen":"2026-06-02T22:11:06.767223Z","times_seen":11,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/coinbase.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/coinbase.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 554\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-22a\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":554,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"25373eb9bbeab1683f73461f75fe9533","sha1":"e1b4366d97287a533d6c7980d0daeb09257822e2","sha256":"b1022ba5129b3047148536f54da71bcec1557a58ccb95b8375c8f0515a7823de","sha512":"f1ac5d8aa38286ac2d55067c4f024413a465ae7adca2c154ac3acf9f888533029c2523ecf50d0dd035f9b80ccf67dd73b5551610ff411798e16105f3bec0bf76","ssdeep":"","tlshash":"79f081ddd34504d4cd44db11c5746c3a65301c911c13d1455f6d2c28a8939df572bd8f","first_seen":"2025-12-06T20:00:54.647715Z","last_seen":"2026-06-02T22:11:06.756058Z","times_seen":11,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/apple-touch-icon.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 16657\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-4111\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":16657,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"b9e289585545a114325910f23d08276e","sha1":"06f2dad43c9da53e7898fba6bd61a360ba6e551f","sha256":"5581f92f23b25393a433783a995aff7d60dbdfcc9645d3942dce6a7fef61c07b","sha512":"210142992953966a7bd200a7835bfbd3a734017f5ff791ad0ad982d1a70c277e1c7266f2b3e02314d1ad6d869baa17ed19989095615dc37d5cff1d90ae8b4ea1","ssdeep":"384:Y5V8orDdE/qRxAYcKlSKXme8KRzoL002wEBooH:o7XdxnVvq32wEBooH","tlshash":"a272cfd1f455ec30853c15bb9943cf6bb2b48ee8bc87ccba26e7c04096cc12e695311a","first_seen":"2025-04-17T13:29:06.540937Z","last_seen":"2026-06-13T04:44:53.265457Z","times_seen":21,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/1614638cdb5afe8e-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/1614638cdb5afe8e-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 45728\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-b2a0\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":45728,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45728, version 1.655","md5":"7dc28b97408a8dbc3cc5b28b90cf3408","sha1":"943950919090bf6c0cdefffadf5005254f7a9d0b","sha256":"8a1c627c7ec30b87144d8690050e0bf0f21f56a58f30d66dbfecdadbf9c1a7e2","sha512":"0464b503f7e792e4ff8bff49f6158d33fa6731663348f0bf38648abf206a70e45c0aa9a9e7d7a5dd812dfa6c6fdacf6b3da748833557d8007cca84012fc678b6","ssdeep":"768:wYArOLxpM/bZFxcU+lKnbebpY0ylAP+yoTEnJzJwaEexgXwSKLws9Xh/nF9XeYVt:wCLxpMdUlKbkY0ylAP+yOEnJ1qX5KLwW","tlshash":"4623f13c3df1c64baa81157c448e5e66be7f9794442fc4ec7468d02983f124c2fea9a6","first_seen":"2025-12-06T20:00:54.651412Z","last_seen":"2026-06-02T22:11:06.721868Z","times_seen":11,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/ab0d0550647a989b-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/ab0d0550647a989b-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 21896\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-5588\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21896,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21896, version 2.6619","md5":"eba030a51d326037959637dc4cfb5459","sha1":"c4ffe2950bdcb468b2cb18b20ee507a374bc5472","sha256":"b949d37b21bbcd8340b0934015feb9746adef7e408fd4e04661cc4a061c6e489","sha512":"7622178647cf73cf2d32b558ac80617a1336d3ffc2619199aac1628b911416db3b325aac9fee30e8544ac7678035b03c881dd8fbbb4da306bf2b2b83e0589524","ssdeep":"384:ZH+IA+aTdS8DzKbqid/juB/CWz0yGnAyiIFys0hs4D5ZmYMYCaTHyz+qGoInwsJw:ATSszsl/Y/RaAyhFyQy/mMJLyz+3iSch","tlshash":"0aa2d112ff9c05d1931321e3aa83e4035c3dcc36169e5bf6294fc76a5ee1a5724cc565","first_seen":"2025-12-06T20:00:54.645106Z","last_seen":"2026-06-02T22:11:06.744521Z","times_seen":11,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/domico.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/domico.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/fnd-1.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/fnd-1.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 768951\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-bbbb7\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":768951,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"99cc99ffb64b93bdf0b0a8876933aa89","sha1":"69f7f6280d18b7ddfa6c2d2ed4837ac122ad1e93","sha256":"fda0044d192d9404cb0dc0b9425719d1064284640b239f2dd83a12c3905af533","sha512":"94553ac30f1ff38e4894cae56e420dc1fe92846c500283908129243828cf0ebdd2570219ee4daa6ca5bf404289d5e93e5a18f00a81a1c86346136233622d55ba","ssdeep":"12288:8ZQbN/aud9RL2+OkK00vcpuHVGO5BKsOSW0hfCwykroi6BLdEFGN/J+XC:8ZQB/W+cPpHQOdV5mkrz6Xnj","tlshash":"15f4237fbb23ec1a51915ebc66181a0d98cdea0fc2e949614f3305def20e617d51bd0a","first_seen":"2025-12-06T20:00:54.642171Z","last_seen":"2026-06-02T22:11:06.754886Z","times_seen":11,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/fnd-2.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/fnd-2.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 2432213\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-251cd5\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":2432213,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"b07b128e8b233c4d41ffb1d6c677bd26","sha1":"7ba3cba509c2aa81c6ba00263c33e5a26e1c718a","sha256":"8ec0854241ec3cecdcc3d5d773141fe7a3af2b77f2d6cab3a6cf527e509b3abe","sha512":"c6978097fd6275e647e7fe8612a032e18d4c6bc189f2368769e04d6b75dd642fd5207d8344d0debc9e24a9fe447d23be1d2b2482fbc9eef741731464e303c5f3","ssdeep":"24576:3Kb7rAHj29VllA641aPPFzrnhtmdVRbtqmt4Okg3mo3tY7iN+:34JlA648Pt3haPYC4Okemds+","tlshash":"422533ff4b870d4b8f5af816a1cbe7d27118761e54048dc9603bf3493a6a110e5edcaa","first_seen":"2025-12-06T20:00:54.621539Z","last_seen":"2026-06-02T22:11:06.700525Z","times_seen":11,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":226,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/etherscan.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/etherscan.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-8e8\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2280,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cddc0e9b1484dbe87251afbe2b1bd974","sha1":"757c358f7d4ad0bb4c4271e49df0ca42347be3c2","sha256":"36d1e55e0644f74ba7018a7dc1fe3cfa3ebef8d8d2cb0caa999923435a234b8b","sha512":"7e112be42ea43ce772dfabed1524de3a675388d2354c67a8f6047882eba912af9d11904d695ceb907fb99959ab03aab38ab6fa2c86491132b8e60b6350ce42db","ssdeep":"","tlshash":"444166ed83c873d0e405f7d0ca396878b39f18fe3ab1d79a47996ea0a95011c5968c80","first_seen":"2025-12-06T20:00:54.640355Z","last_seen":"2026-06-02T22:11:06.75218Z","times_seen":11,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/pink-normal.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/pink-normal.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":47,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/fnd-3.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/fnd-3.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 371209\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-5aa09\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":371209,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"096ee6731183c7b76e7488e929d01ee7","sha1":"a614914b0be4aa31fca1913790f7b8e5ef065ade","sha256":"cbb935323b62a451e62c7060f891396222455d6cdd98195c51913880af7f74ae","sha512":"86fc11c76ce7b115a7d9c8bbc08b195c09e2042f63fdb6432a295cf2a9274ab944e959b19b60601fc18229ffb799a10b163f391410d37cc61a61b0c897d272ab","ssdeep":"6144:ymKDnY2Ys/9ZPM7tnBcT/wHgLmRrib+maOxC0C5tLxPXzREqeMEI5+vIV2RNwkpX:yjrhLMn+6uqmM0C5tltWe+vc2RN2nce2","tlshash":"6d8423f5c2420b21a7f224c948f1c6f1aa9394569d4f40f0379badbbc596ac365c31ee","first_seen":"2025-12-06T20:00:54.62986Z","last_seen":"2026-06-02T22:11:06.758417Z","times_seen":11,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":100,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T19:32:56.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.1.33\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; path=/\n_token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; expires=Mon, 27-Jul-2026 19:32:57 GMT; Max-Age=10800000; path=/; domain=.curvefinance.co\n_subid=1sjos4f.4a.3phjv; expires=Mon, 27-Jul-2026 19:32:57 GMT; Max-Age=10800000; path=/; domain=.curvefinance.co\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":58594,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (480)","md5":"f5be346bcfcbace43c900d1f0afbcff4","sha1":"8956b6014e35375c2dee2b2d12a5a2dfca11c88d","sha256":"491e1e33dfd37f4648668fe8f66f78b784175b6294957ea87f749dcc14976043","sha512":"852a88cdbf67ffe8adeb088aeea864135f9db75f6841ae8e000cb67c80f99005edca0a9f2c30bbaa8bcd9e7167fbfd7879ceb9ca0058923d97282344ed3e0173","ssdeep":"384:i+PJUyCHzLrs1veLYiQMN4z1DNNjNpDvAhgzNMzmdESFGLYmNFzVCSF5XENWougy:XvXpNVqEMdko","tlshash":"e943941094f08432822b01257bb6772d9f4ee987870a0a91b1fd56bd5fd3de6cd2349e","first_seen":"2026-03-24T19:33:25.673966Z","last_seen":"2026-06-02T22:11:06.757205Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1176,"timings":{"blocked":247,"dns":200,"connect":19,"send":0,"wait":679,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/21350d82a1f187e9-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/21350d82a1f187e9-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 18744\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-4938\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":18744,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18744, version 1.0","md5":"4e2553027f1d60eff32898367dd4d541","sha1":"3774b678a66b460089a58d8c79f5d606e7c241a0","sha256":"aebf2ab4a4ce6810d73c1ac7be7cafb4e5ec4cee2d6db5fb3e09691747ec4bd6","sha512":"58372edd0321b2c260a2a6b35bd90fdab4ebd44d27c2be38c9be97e284db3911fa01b960e0bdb63878243b633d2aa9a1ded500af7a48d41f0abae836f3c01718","ssdeep":"384:/WDlvrwNOzspCRRcpkaewzN3pl0wpncoseMiH0ytc0rm7VA1wUFHKtKEj4:/WDlUNOwpkTaewpp2pHkTlKyxvH","tlshash":"3682d0a25313a0c9d172036b3498e8d8844b27fbade14a98e71a57b27dc643ddc8cf4d","first_seen":"2025-09-11T02:33:42.281993Z","last_seen":"2026-06-17T07:35:06.150448Z","times_seen":2066,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/d4338d81d18a706c-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/d4338d81d18a706c-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 32456\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-7ec8\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32456,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32456, version 2.6619","md5":"bd675cae54db2a7f662941d05ae952fd","sha1":"26cf693b270ab149f7da88a3130bddbee916f8b9","sha256":"c8c3a20a1ccb6fc088b89fb0fefe1bd43b4b824d51ee8834a21ecdffa953ceac","sha512":"0e97fc8e7b4f10e25f8a7db7ed3560c4ef36e0bf05506b94ce45a6273b3a2c99df60ef649e37df71ba4377654b337c6efde2426f4a13620729f64e525acf43eb","ssdeep":"768:uYZ7I3tULTYxl+Ua5q3VKnIExYwECHkXEXuxWlTxD:uWrLTioUKnIEIxU+xWdp","tlshash":"7ae2f1881e870096886c5f31ab2529d1b4d9f17d6e3ce3b40f25e9ba635e41c729e031","first_seen":"2025-12-06T20:00:54.635308Z","last_seen":"2026-06-02T22:11:06.739329Z","times_seen":11,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/de0caa117f2939ac-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/de0caa117f2939ac-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 34068\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-8514\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34068,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34068, version 2.6619","md5":"fb4e49cc2c642aaea47022f5d9e3d9a3","sha1":"9455fb69b46fee072406cec5bfdcea89037f122a","sha256":"713d677c86717aa8e56c52677e36b726c5389726f41f9d1583b393b580524613","sha512":"e3ab73e3158f87be0803f4177737ce2648956233f359edcee7474fa15410f7145e28e88293313aebd018f4c1777c2e524bc1a15f8d2659d601d5d186ee033841","ssdeep":"768:txbGAXMBBrcjzCerUEIK/xWH2lUDOIaAqpgiTCdFsA6N/R1:rqAXCW35rVX/4W4vaAwBTCS/R1","tlshash":"30e2f1930e21b00dd6f4a6a50e5162e21f343fbfe00e5b9d4db8d55f0f983072a9a6a5","first_seen":"2025-12-06T20:00:54.652437Z","last_seen":"2026-06-02T22:11:06.768474Z","times_seen":11,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/nick.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/nick.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/bell.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/bell.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-7e0\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2016,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3cf440d09ae276b65fd126c6f9ee1b0e","sha1":"ee11fdf7e8221350ecefd0d2105ae4d0db7a70a2","sha256":"8a653482137d778aea0568a1ff2750ffecd156172f61439ffd3c7cc0d47d0ded","sha512":"f2a137d1861af31fbdb2195e34732f7b4f3204dbe317dd07a2aa9cebaa47f26a9e6d5f429c0ba9ff0ae25d9a55c9dccf3a7f23b797f364a0e43ce194f179d167","ssdeep":"","tlshash":"6e4161f02178c1c855439d50ce752989ca2b5cb2dfccc0d8e29a9661953a3ccdf50f5a","first_seen":"2025-12-06T20:00:54.646723Z","last_seen":"2026-06-02T22:11:06.749797Z","times_seen":11,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/group.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/group.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 668\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-29c\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":668,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d2cdab3b1c0907587ff82014562f4b01","sha1":"21c5d3513f6dcea712067886eaaf7890ec9c4975","sha256":"b18a9d6f5f24cfc927f878531643392034bcb9b9dfb55be94d6d28da91b79c11","sha512":"11825078ce3ee42e0c0c4385ed5672bbee704172cba602ab96b01bdba7bf250ba5606e1b9126546c3e3a7f398866f5e8c3ae16ce3886607e2f768429c1facd99","ssdeep":"","tlshash":"170149e6416508bdf5339760eb7938e441b324f7cbbd227048a46bb85c2068dad6bdd8","first_seen":"2025-12-06T20:00:54.643059Z","last_seen":"2026-06-02T22:11:06.712065Z","times_seen":11,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/logos/rainbow.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/logos/rainbow.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-dcd\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3533,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6a5aa478f5a0961875d6949f4881f3fe","sha1":"18bb02e2ffb580d6eed3457b5b45c4811e086bc3","sha256":"296f0c80303f88f4a877b80577f0b18cfec3143ba4dc0b0802ad2d55f9590cd5","sha512":"d0d16a44fdc1fae0f7aaa8fae4316cc53b02a48cbe593f86ef9edc725930b051b239d3ec8deaf741819cd89872cd65f59fd810c4d2dce280af6d16a1ddcb441d","ssdeep":"","tlshash":"9371bf2b967d582bf164c1ccde966424218dd2b7948682d163a1ff2f087c4d96d4cbe0","first_seen":"2025-12-06T20:00:54.628937Z","last_seen":"2026-06-02T22:11:06.702939Z","times_seen":11,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/blue-grid.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/blue-grid.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-65d\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1629,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6aef0157343f6c9fc38f93225c0ecb85","sha1":"e5101b84f03fc83458fa306cc10c89f874c7a1a3","sha256":"fcfaaf3c7b5ea362a5ff099d2a805e9382552edac8e4b06219bce35f3e0e2ebc","sha512":"7014a1909be17ab8dc7b326d45063d54cee611f6c4d8196720d1ae1554e2d4da77fb74fad530ad8a485c214ede83119b9f290074ed63acc99aae9ee2e770d86d","ssdeep":"","tlshash":"8a31eab4940cac4fc7f6839453af8359fd0299c9919ac193c889b6c9f5834c3de1618b","first_seen":"2025-12-06T20:00:54.62367Z","last_seen":"2026-06-02T22:11:06.737955Z","times_seen":11,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":53,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/green-grid.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/green-grid.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-666\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1638,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"22a588422c040539fd57a8eb1204de06","sha1":"05b66dbe57e009f152e36e5419e4afd195ccb63e","sha256":"21164261be67e39368ce75e3769726edd3f9fed4f58e49951dd4ef4a0a29d250","sha512":"4144aa95bf8930f6f6c98d1090e04b40cebd95112b100ad6891d1526ac0e0e2364f6418b2f0deef1c65617ae74efe93079040148df6b28f1c33c8e8910df5dc5","ssdeep":"","tlshash":"7c31f67480586ccec2f28f71a2c7c71dac021290929bc0d7f484a9ee8ab78d18f0508e","first_seen":"2025-12-06T20:00:54.617636Z","last_seen":"2026-06-02T22:11:06.704847Z","times_seen":8,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":51,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/blue-normal.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/blue-normal.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":51,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/favicon-16x16.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 1438\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-59e\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1438,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"88f72945db4876404e25713b11e256a6","sha1":"c0ee8047a94a072c3bd803982546d7f5a003e9d9","sha256":"45f11427c68c09536da4733c1873a83d29e3558a5f5424d1c601c73effa072c7","sha512":"a48676e048916c70a55431958c4d4802e7baf735b6ec26eefb46a5e95265f6937fbed42b5a18827ad24949b4d3bd8376f14e9e8e1b499af59b5f290b7977f894","ssdeep":"","tlshash":"6f21d8c4adbceb29d4059b72d500048ca63589bb19f049ff7256d0162ebfe1590f5a03","first_seen":"2025-04-17T13:29:06.546942Z","last_seen":"2026-06-13T04:44:53.263711Z","times_seen":17,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/b8a589c825044d7b-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/b8a589c825044d7b-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 33696\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-83a0\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":33696,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 33696, version 2.6619","md5":"5cb8b18b28d20c12e4188f3e75b60490","sha1":"04f05eb3673f7f9a23911be56eba68a84b9ab2bb","sha256":"50c17a9faed4ddab2fb5438ed6223b2a8a1b2a79ad6b94fa992f85c3c6a81076","sha512":"890158d06d22d1d7e2b9820a459686f0aed2671571d9c6ca2127e68c780810a64e7c459939a32ffdd4710537cb4ff99606cff5d8aad4e2c57bab456cdfdc24fe","ssdeep":"768:1C4kFFe14JUXE9uV2Fpg/LHwDeddLkoknEAV8J3TViLpTAg1jU77:KF06JUFV2YTwDMdLd+Ha3MFT7U","tlshash":"10e2e15a04a5e961210d20135f5f8a3ec937441c5443239ce3aef2c1a5ebfb29f0e6bb","first_seen":"2025-12-06T20:00:54.619528Z","last_seen":"2026-06-02T22:11:06.765802Z","times_seen":11,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/css/24841febe54b89e0.css","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/css/24841febe54b89e0.css HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-b8c3\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47299,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (47299), with no line terminators","md5":"ce2fdc6ba880cabb18e7c9fd2e05a045","sha1":"6a010d6717b60b48e29de9377c6d09d35ea4a11f","sha256":"4f77d349ba82139dd5fc870d3b66abc581d25cfde15049cae17ce3cabed37a84","sha512":"b55bb18ef6ccd97a8e6e7bc9d2ce22f5179fdb394617a2947cb05aa8d7f2a4ac5d83198f08935a896972b3f18458505f546c2477eaf12b46496ead27f5ce8d3f","ssdeep":"384:UXP9QL2yhkgCBkeLALxFKM8LleLGLgCMLv54eLfLhasoLFeLiLgCsLvBxsCDJU8Y:UlN0Cg2zNkdl253DIjTXLS28xYHjy","tlshash":"c223c8e19520a13cf92f913df6e654cd75289806af2b47fcfe606435c6c3be50722a1a","first_seen":"2025-12-06T20:00:54.615904Z","last_seen":"2026-06-02T22:11:06.745719Z","times_seen":11,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/stories-4.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/stories-4.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 104509\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-1983d\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":104509,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"7be97c021e9c5cfc18b2a377d45bb263","sha1":"bef8df1a1a2e377a00bb83b348de8d4aae1c8ee6","sha256":"7d52f4927b954bf0bd9844fdaa2302525aa9f8c173f6fdea9310f35915c80339","sha512":"c3211e69ca6f349271189168f6a92df48345293df979b94fcfd27b96a2689daa8ac189f03a7e2f7c767f64ca90bbec5915cf30344b06cab1ace5d2cf187f6d64","ssdeep":"3072:lMi40Yl/5LyQhWXDKGT2+5T3M3AnXajgvRl:lMR5yQfP+5mQXw8","tlshash":"3fa3023afc3353e4b799c130091d05ed276099a30a3b9d37978a42d5cac06bdb63c5ea","first_seen":"2025-12-06T20:00:54.630534Z","last_seen":"2026-06-02T22:11:06.709868Z","times_seen":11,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/magenta-grid.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/magenta-grid.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: W/\"69b80179-625\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1573,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2968b0704198bbf26dede11842cabfb1","sha1":"d43e23241f1bc1eea4145796c7a5188ff2ebf9ae","sha256":"0538b3fbceea0db8ff215ff89fb1170e4fd589189a259e8579eaf9cd564cebf2","sha512":"193b8f60f30687b6f7c67b8f48d252f27f9d49d3561c84dabe580c0f8509404c4205e9d7815959719ce676597f1f8dca9347ca8fab5c7846415a7c81a9a1dbb7","ssdeep":"","tlshash":"6f31c874901c389fd66a47a9629ec219fc029fd442d6c843c408b38da893cc6ce210ae","first_seen":"2025-12-06T20:00:54.649566Z","last_seen":"2026-06-02T22:11:06.74328Z","times_seen":11,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":52,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/cards/green-hover.svg","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:58.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/cards/green-hover.svg HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/styles/static/css/24841febe54b89e0.css\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:58 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 16 Mar 2026 13:11:33 GMT\r\netag: W/\"69b80185-126b\"\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":4715,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d2ad0568dfaedcabd6e6b74b36247c0","sha1":"0e4445e7d1d63b230e6f8bcac9f4b75157f54560","sha256":"23f88f237a4c480d8cb166ba9fba1922c201f4e6b1c38725873e417656ecba48","sha512":"f5c84740ea3468c491c29ee7db3dc07e6447b60ff7ed8ab23754bda2955fcf741b24a021c2cd115785129c5ecde07df78f32cbb99fc1eeb9a0e913a2aa74c268","ssdeep":"48:Rv/tst8rGyE8+FjA7cTy7+jwZ/5R59u6bzedsOoxM0SFH+ixYkATKqf5ipmYytZf:F7rI8+FjAIErWHoxV/K9+I/d3yYAA+2M","tlshash":"eea1de8e57334212a4d3abaae7ef6a5921e48003e84bcd3cbfde1178cf841105d42b8d","first_seen":"2025-07-01T22:26:06.862741Z","last_seen":"2026-06-10T16:54:06.559468Z","times_seen":82,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":48,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/css/6fc455a0488fc6c1.css","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/css/6fc455a0488fc6c1.css HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: text/css\r\ncontent-length: 58\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-3a\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"896483eff5b113f5cb92ee7ee2d05dc7","sha1":"80977b3d6d2df35a3dab1f0d078380e01f627164","sha256":"25a070a214ca5095f1dfa83a8331a60e6aac9049fb980eb70e40efdcfd7d9e7f","sha512":"e6b42f2bfb2ec61b19dcbd14739717671454e65e50d3bd30fdfb68eb3979675293fc5ad27f6b727191b79d499ff100d4834037f2a8713b96d0b163b3f4cd98f1","ssdeep":"","tlshash":"9aa002300530b4ec46b1f46268b6ac456e49956563115196aa552565d1a561818913c1","first_seen":"2025-12-06T20:00:54.622741Z","last_seen":"2026-06-02T22:11:06.764133Z","times_seen":11,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/120085dafc7749e9-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/120085dafc7749e9-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 277516\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-43c0c\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":277516,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 277516, version 3.0","md5":"4a837ac2f1508c22461dcc4ecc005d09","sha1":"31549bb0a0220199a112867a910111895dc93ebd","sha256":"475a5b97988717a39af8feb76b8918c9700baff691c94eb8654941e0b9e40c6a","sha512":"22817d857773574f9728fc53900bce14dab805c79a053bd56f6bef918286576c1a7299fe535f218b1149db96b15365f3f2a14114c726694fd5d8968b5b0e2db3","ssdeep":"6144:rupjxidJlftO5XpaspPDe+7uQ34tn8p6RLA17hj9D4SHlbET:r6xWu5XpTPDe+T3KnV6dQT","tlshash":"4a442280ac5896db254dc3fed233726acd951b6ff5d6fa92b8874045217e2812a03ecd","first_seen":"2025-12-06T20:00:54.633139Z","last_seen":"2026-06-02T22:11:06.706393Z","times_seen":11,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/706bc5db253c3d84-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/706bc5db253c3d84-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 21136\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-5290\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21136, version 2.6619","md5":"b90ebb70a5481021bb6fda026c5c05cf","sha1":"5c157611606879b33e30b6a3403a84f928f923e9","sha256":"bd6cc7a73d64aed657efcc9f43eb4560cd5d92f40e14968b64e90527dce5129e","sha512":"abf8441d3524286b21d255b88f2d4eaa3eb61f945aefc7988ec83b8d6f19edac89710f92be63fd5c5b3b80dd502027ddeb556bed0ce9931eaabbfc871cbe11a7","ssdeep":"384:QEUmVHpfCZFCYWmob+Dwia9wLJYNCwhgizAEkCFv83fmWiYinj:QEUOgZkYqw+Om8KzA/eWWj","tlshash":"7b92d1b843999073f15ecabd46e218c92fff14087e5644ff1322b056ad6a3be2c11817","first_seen":"2025-12-06T20:00:54.613994Z","last_seen":"2026-06-02T22:11:06.734809Z","times_seen":11,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/styles/static/media/f52a80d8b28d1229-s.p.woff2","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /styles/static/media/f52a80d8b28d1229-s.p.woff2 HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://curvefinance.co/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48612\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-bde4\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48612,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48612, version 1.655","md5":"45c78805228dbcf88349a0d7b4459c90","sha1":"baffaa4eb91b751612e763f0a75f4c37f6fc9c9d","sha256":"f1c1e57d7c2ed889ae69341f5e0f2d909909c2e48b8eaf72c313d2b220d0ce2a","sha512":"3e17d6778399adc2d03e245b7cef4df1df5b4c76273f374c9236c3e2a32aede5f42371005cb5404739a152e1122ed14d9e92ad05f51c66b7c521679682a62ad0","ssdeep":"768:H/en9RLXdW5WyTx5mh1Uwxk7dR1k0+jbSBvG5vqs7QtGHjF82vhKtyxTHg0RTTtU:HI9RLXdWAyTx5mh2wxs6l2BG5CVWpbRE","tlshash":"8723f13e6c112169d282193bfd0edb75596ed7071d56f3169dbf801c2916b3f2b93880","first_seen":"2025-12-06T20:00:54.636393Z","last_seen":"2026-06-02T22:11:06.695692Z","times_seen":11,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curvefinance.co/assets/home/stories-1.png","fqdn":"curvefinance.co","domain":"curvefinance.co","tld":"co"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curvefinance.co/","date":"2026-03-24T19:32:57.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curvefinance.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 11:40:48 GMT","end":"Wed, 03 Jun 2026 11:40:47 GMT"},"fingerprint":{"sha1":"C0:4C:59:9B:C7:08:70:99:46:B8:02:1C:26:E4:9F:95:D7:D1:8F:8C","sha256":"0B:2B:80:3B:38:E7:D2:59:47:30:09:00:75:B1:36:B5:C6:10:32:53:7B:BC:B1:D3:6F:E5:60:80:9F:D1:9F:D2"}}},"request":{"raw":"GET /assets/home/stories-1.png HTTP/1.1\r\nHost: curvefinance.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curvefinance.co/\r\nCookie: PHPSESSID=0ac090da505d7affe2546bdc93739f07; _token=24hgrak3ngt405.1774467177.57.7556fa4d170442ffbe01bdd6c8459b90; _subid=1sjos4f.4a.3phjv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Tue, 24 Mar 2026 19:32:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 17728\r\nlast-modified: Mon, 16 Mar 2026 13:11:21 GMT\r\netag: \"69b80179-4540\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17728,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGB, non-interlaced","md5":"fb721ac1e7a4dd1463422ebc917ff850","sha1":"4bfbef77258e3b01b1048ea259feea6f5b43b392","sha256":"23a63e4d4bc1c8357d1c422754b73a95a7a6f87431c28b0584f16533afb44a17","sha512":"76bc08078046a567abad7d809296d203bdddc0b1a912b9c5e1a07b500011c09fe5156dd57b11638632500b2887a038fcc107eb759903823bee4164b6103f7599","ssdeep":"384:kPVuniimt2mP4isWdoE5yQtozhRaRasTw5sD5:uuiimtedWvmO7ss1","tlshash":"a882d17a6834d978efda6661dadc5c91d2c79f041803dc0fac0c9a315d2296d8036bd8","first_seen":"2025-12-06T20:00:54.614962Z","last_seen":"2026-06-02T22:11:06.69799Z","times_seen":11,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"curvefinance.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}