{"report_id":"eb3d9b6f-4e2d-4d0c-8118-b71f0b051066","version":6,"status":"done","tags":[],"date":"2026-04-04T12:32:25Z","url":{"schema":"http","addr":"bull-run.fun","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"title":"Airdrop Live | Claim Solana Token Airdrops","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bull-run.fun","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-09T12:32:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"bull-run.fun","ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":12,"request_count":6,"received_data":4173244,"sent_data":2787,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.coingecko.com","ip":{"addr":"172.66.172.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-03-26","domain_rank":442226,"first_seen":"2018-05-18T12:16:11Z","last_seen":"2026-04-03T21:33:28.502425Z","alert_count":0,"request_count":1,"received_data":1246,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"bull-run.fun/captcha-loader.min.js","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"74ef7d161abb76e8e9930c62e4213c8e","sha1":"1bca28257e3eea32463a90e68362a8470e33a384","sha256":"d272735708303674059145194d40c0031bfba7cd5fdbb57c741921dd81a83ee3","sha512":"46d01188f428deba1b7cf0c3c3bcac2e1376406e4a4ed29aa7e78733f80e22c7b254aadf19f615bd2e9bd5169a889d066c3756198954d64b37f3abe5d96fcd6d","ssdeep":"192:Fo70yIyr1R7j4Fa77eDUESvtnwBp5N67NyxqhcA4JzgPnQnn9:m70yIyr1R/QiVU5YJuqF4J8Pw9","tlshash":"a8320a71627412148537d19771619fce34b4a44bd637424ce6ec223acbeec893d3aea9","size":11193,"data":"","first_seen":"2026-04-04T12:32:37.728196Z","last_seen":"2026-04-04T12:32:37.728196Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/p2.slim.umd.js","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"14705dd0279252d3457cf87f7b5252dd","sha1":"fd8b4043e6b08c2d2c37a4fb080368ca03a486b3","sha256":"23ce240cb55db91646ac4c5f8b4591a5c72756511b64fe426397e74dc65f5775","sha512":"22cb9dac15e7c9f601923ed8ef112ec70be234fc2cd8a1d8b62a0fe9a84df72bb1adc0f0cae6068c3e3c14e3609b38fe5f3679c53718c9d6c064793cc128fe9e","ssdeep":"6144:r/2hrEJqaZGVgQkZ2diu7NSOTiKiBf6Np:r2hYgaZGjkZ2diu7NmoD","tlshash":"82744e65109dfaf78b904f94a62541cbe4482b380e413b27a3f7ff96a1e5b4df0e6091","size":364080,"data":"","first_seen":"2026-02-06T22:38:09.234577Z","last_seen":"2026-04-04T12:32:37.707166Z","times_seen":98,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"893fc64b7e1379e29e4b82d0105432c1","sha1":"9960d3439508b1d000f8a0613b3fba3913a44c68","sha256":"6a65d1b063a3fe42946be2bb4aa942e20568ffcacefcb2f64e494167633b038e","sha512":"99e433221635967121d101241c3b9394d615bc0d182504c66ad1f2c0917cc2d5eee2159f1e7546ba178eed6ea7d189dac9ad4340f59007d7325dd93b87ec07a1","ssdeep":"3072:RV8Y/Ytx9NgolPWx7uMC8rNtDwmyQKq+kCJJD3YOTikkQYvVsgyP:RViS6TotDwnQKR3YOTikKvVsp","tlshash":"52742d64149efaf78b915f98a62582c7d4482f380e013b2762f7ff92a1e574df0e6091","size":356837,"data":"","first_seen":"2026-02-06T22:38:09.255187Z","last_seen":"2026-04-04T12:32:37.729573Z","times_seen":98,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"943957e65fd20166650c6a13c0eecdd1","sha1":"c2c349601bcd2d0c0175667a9645166150d9db8e","sha256":"7bcc4837258d3a93eb70781abed9becc3a5db8cebe386c703dec2c04e3d712dc","sha512":"bed275232775c434dcc8c24021c9c787f1fdc1b65d8ebdb43e0738413bc8e78096941beab84cf73f0c39d56a97d8d989b44232a2bc94744e6bf3855ffa95d8e8","ssdeep":"","tlshash":"12115927222233707ce9d5dca9b6d98e39bb501be40a0090b09f944d2e34bc944f7bec","size":875,"data":"","first_seen":"2023-03-07T12:01:37Z","last_seen":"2026-04-04T12:32:37.730194Z","times_seen":290,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b6152eb23380f7fb3f016eb4e80f3101","sha1":"f67ab7a3509113ade978c8a1190cef389170289d","sha256":"dceb0ad360644628a29598ddae7c1b91c2a96a4d31bf48c77a73630db314dca4","sha512":"a1bc7e6dda532c711b7fc91d052ff8dc33700a377feeca9a3892ddd67b0d823f6ac05c8379d53cf5dadba5ab353e17715709d39f2a5ee5865b011c7ac41a281f","ssdeep":"192:9nwq9MLji4vkF4lu836PTrC97JAuVnra4A+ecr89ChWtY3+BRDmibUvvD9ptI7xt:OX3pL56W7X3+BhmXvD7O3","tlshash":"6e22946e7aa3207a6413a63edfafa11436b9a403160edc087c0cd6d15fe1d1491bbfe5","size":10571,"data":"","first_seen":"2026-04-04T12:32:37.730777Z","last_seen":"2026-04-04T12:32:37.730777Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3a0af34ec1c7d1bec5bd69b91bea2956","sha1":"c98c11dc993b419b768c96a6d1d28d09fc96a7bc","sha256":"c531c3fd0bac473180598093bc3d3f8206eb915a5cb28bcbcb4ce40be4bdee11","sha512":"b46d00630f20fb2e2671d4cc230074a4165ffd68aa4aeddb3a9ac874d91615ac5d07ebf0587dc44234e89157144138b9e6bd1d0f076656ebcd371b4fc477a6a0","ssdeep":"","tlshash":"f5f02b1e72f715b74033702e434b9e4e633244072464ae0439bd0bc51fe152a0ad3fa8","size":456,"data":"","first_seen":"2026-04-04T12:32:37.732145Z","last_seen":"2026-04-04T12:32:37.732145Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fshaka-player.compat.cjs.js%3Ft%3D29588432%26u%3DV_PQrC8LSUiLD1NqGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMQCVp-IuxI3vffotmQ","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","size":656642,"data":"","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-04-04T12:40:59.505964Z","times_seen":2439,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"bull-run.fun/p2.slim.umd.js","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:03.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"GET /p2.slim.umd.js HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bull-run.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 04 Apr 2026 12:32:03 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Fri, 13 Mar 2026 20:30:05 GMT\r\netag: W/\"69b473cd-58e30\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZojMsPGrMmPKWdui8Ai0etUnBsQLdsOldNAqI1vPlkRFb8rmzwQXVPmUYSWjPcpO0sRmLKyiFL6zQ0d%2BpEHoVCfhp1HHSWwOERQX0ubtklE6Y9554AiCmE0cgePlmw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e705563985b56a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":364080,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65159)","md5":"14705dd0279252d3457cf87f7b5252dd","sha1":"fd8b4043e6b08c2d2c37a4fb080368ca03a486b3","sha256":"23ce240cb55db91646ac4c5f8b4591a5c72756511b64fe426397e74dc65f5775","sha512":"22cb9dac15e7c9f601923ed8ef112ec70be234fc2cd8a1d8b62a0fe9a84df72bb1adc0f0cae6068c3e3c14e3609b38fe5f3679c53718c9d6c064793cc128fe9e","ssdeep":"6144:r/2hrEJqaZGVgQkZ2diu7NSOTiKiBf6Np:r2hYgaZGjkZ2diu7NmoD","tlshash":"82744e65109dfaf78b904f94a62541cbe4482b380e413b27a3f7ff96a1e5b4df0e6091","first_seen":"2026-02-06T22:38:09.234577Z","last_seen":"2026-04-04T12:32:37.707166Z","times_seen":98,"resource_available":true,"data":null}},"time_used":374,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":292,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/secureproxy?e=ping_proxy","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:03.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bull-run.fun/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 04 Apr 2026 12:32:04 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 4\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\naccept-ranges: bytes\r\nlast-modified: Sat, 04 Apr 2026 12:32:04 GMT\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Muq21seojHtwzcxw2IFzzVfnN9fA%2BQWbd4JsGdQTDlW6FxaCeyHFkrRmgQ3Uh9annj%2BafWR3PzoATO3%2BOBQikPU4AhwUbh34%2B7DGpfCuEProOMgoVq5u1e2V7joCgbE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e705567d86756a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-04-04T15:34:34.14573Z","times_seen":8337,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.coingecko.com/api/v3/simple/price?ids=solana\u0026vs_currencies=usd","fqdn":"api.coingecko.com","domain":"coingecko.com","tld":"com"},"ip":{"addr":"172.66.172.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:03.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.coingecko.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Mar 2026 16:39:57 GMT","end":"Fri, 05 Jun 2026 17:39:55 GMT"},"fingerprint":{"sha1":"B1:44:A5:9B:AC:F3:25:52:00:21:91:75:61:8B:17:93:85:F4:78:C4","sha256":"E0:56:40:D8:85:96:53:52:4F:90:29:79:2C:CF:17:88:F0:D7:07:24:3B:53:CE:49:85:97:D9:4A:B3:F6:97:4A"}}},"request":{"raw":"GET /api/v3/simple/price?ids=solana\u0026vs_currencies=usd HTTP/1.1\r\nHost: api.coingecko.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bull-run.fun/\r\nOrigin: https://bull-run.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 04 Apr 2026 12:32:03 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS\r\naccess-control-expose-headers: link, per-page, total\r\naccess-control-max-age: 7200\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: max-age=30, public, must-revalidate, s-maxage=60\r\naccess-control-request-method: *\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization\r\nvary: Accept-Encoding, Origin\r\ncontent-encoding: gzip\r\netag: W/\"cc033086372a3971ad118ea102024444\"\r\nx-request-id: 57211bbd-5005-470f-8f26-d512cd4e992a\r\nx-runtime: 0.003204\r\nalternate-protocol: 443:npn-spdy/2\r\ncontent-security-policy-report-only: script-src https://accounts.google.com/gsi/client; frame-src https://accounts.google.com/gsi/; connect-src https://accounts.google.com/gsi/;\r\nstrict-transport-security: max-age=15724800; includeSubdomains\r\ncf-cache-status: EXPIRED\r\ncf-ray: 9e7055680bb90731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a9f795b6fafec939d7d4333cce31682c","sha1":"b759bf3a0f68abb0a76bf2b23caed261f577c5ec","sha256":"e7e1038f8d1ff8198bdf5a4570650b81b076a727ace84b62f3227af2fcf8a6d2","sha512":"1e51c8aafb526298182abfdec2b85e407ed99720e2d814f319cb2a2682e7345b079bba4342a7b27a1d0a66625dbf8974be1d51f1a2c8ee741927b7f4d92d7747","ssdeep":"","tlshash":"4770000000e00eab8c2000a208200202c282002a002c030c880ea000088c28a20a08e8","first_seen":"2026-04-04T12:32:37.708606Z","last_seen":"2026-04-04T12:32:37.708606Z","times_seen":1,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":22,"dns":3,"connect":1,"send":0,"wait":139,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fshaka-player.compat.cjs.js%3Ft%3D29588432%26u%3DV_PQrC8LSUiLD1NqGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMQCVp-IuxI3vffotmQ","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:04.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fshaka-player.compat.cjs.js%3Ft%3D29588432%26u%3DV_PQrC8LSUiLD1NqGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMQCVp-IuxI3vffotmQ HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bull-run.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 04 Apr 2026 12:32:04 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\nvary: Accept-Encoding\r\ncache-control: max-age=2592000, must-revalidate\r\netag: W/\"a0502-14+i6Bt7XM8ofHk8WpmFyqoPYWI\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=shaka-player.compat.cjs.js\r\ncdn-proxyver: 1.50\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 04/04/2026 12:32:04\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 158ae9d1245266abf287a51a4233834e\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yAWonP9rV7hCxHIxFoKczzwjkrrab%2FS3sRfdnyKxPTTpdufyMy1mgAQf69AltERmqpNunxZ9hFc7GQdvHQY3nnc2yaQeRqNXZ1MPqE76ANQWdxyRM40plnVeDMc36wM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e70556ad87a56a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":656642,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-04-04T12:40:59.505964Z","times_seen":2439,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":398,"receive":182,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun//secureproxy?s=%2Fjmpd%2F","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:05.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"POST //secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bull-run.fun/\r\ncontent-type: application/json\r\nContent-Length: 2191\r\nOrigin: https://bull-run.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2191,"data":"{\"route\":\"8XUwkBv9vhPYfVpD1fxb7EC65sUXJdqr\",\"payload\":\"2TLAhEJtQsQx9dPWDXp6MhjZtkz1sMkdL4hgVszTMk5G2gHC3wfX4ABhxgWnctBRoMabsWn82HQBGJvsjFsTPxyPtUZNvqAYsg21DA4eehZQ5oXh14F9rR4zCJaVdhbYne38gaVeSXmi7jYW8H5id22xqz3UK1QGWqpUSej2F9yztDwGinGsEWCpXV4vuPfyKTRHjjFKv81aaKV4H8poHGEcumEpMRRjZi5aAa91Ua74SiXE2JBXiPKKVdUR68mJNCvdxrLUCnPJoB3Wjo3cdSt1WndGAdzW6ut1z6PuHeCzfm5RTN2LXE5thWDx45KQSc7qeje2x9LaQT6dC3px7icp9fceXfSbx9fA328BoxPY3nEBj6JNzFgJ9H8NrwQ4SYCwpnL7eEyCzXevTgnR4L6TZZBWbmgFee1QKV6GpUxjZmDJq3Rmzpt14Ht8N7GGMP1oQx8vYrMTSSUh4ZBsDg385DHEVnUEHe1TD4oZwCGR6sgog9mUb1un3rMZxhWdTsPV3yx86QTrwDMbfQQymu9KcBC5K8J5D6ABiuzyYrKbWGRS9uXg3JADo5R6Lpxi8jvHX4RNkXFXY3eD1Fa3eS2RU3j2JNMg3nZhpgn2ZmXf9NCLNxEGKVNgsgPeAixKNoFTNifj7P9Aab7A8LB12MZ1Z5hspcW6qc32xyJpsoeTqUH8fea2tk9ax4DEeW7iaMJP6Kky2cAYHbpT51sbXcpskbhKgUWViTnmTyJfq7LQp4Hyh3RPK5VaNoFESVY46WWKws3SyUfFpeH2JxyTyNzSvVFzXJCpe1DU2DuLyp5z4bFyYzbZtufn5dmUXyWfvFPcS9kCnrYUvZjLgGxpr2GfQH1BeVVADq7pngH5RAv4qKMnpZzHpqt56u1VHfAGMYPHYzCo4aeyMEiqpva5uweaHsYzBLPdMNpBBjPfaB2PeAt9H18Z9NTFCWQ3bidj6NR6TSdvUMNo6oc6B2QpJ5oKcor1Kpr5CKeNzK4t3V3cbCoaKvbuoZPNJKq5KVpWjj9qagCoAvGuBGzLTMxG65tWWdCF8EHzJ2EowRSfvkqP7d8nUtpcLFLGbYgo49hA68LtNhPapLQQazgrVERAbLxWBf8u6G9fYHZxZT92bjjmrcBy7GGvZuBCFA7J1crgf8SYyETkU4MqDEdjcAaRHTRVFgGRGEtXj4of8nWeTHVbMWoyGpdaDooCW8wvHBHUQqgoPnhc4oztJYwVgn6FdaoTHUuQ58yXEHK3XhMVHwJUHRGpDifSeYZqU4jBrdHe9tGV3FhVaXNX1BKu4LbZnhUtzE9uEaZaXHcU4sZ6Xr7aw8S4UHm4QW4QUvjJ6UTVNEG9XiUh1kuPTi8JRFyEHyQgxssPa8fXiyEAkBbFF28D6UBH6Er4j6yZPXHxVCd39B5EAGE6HDh6b3zLPju75aYthFhGWSukKeyQVuzFnjH4Eui8oLER3uxF2LFGXBHJW5uySBaGDLFaw23q7i6MRSmYvxrmVcbRh9FpwqBSbwpAR5Fs8rnRB38MqqBqsSGiaV9gvUaTCXM1D7hr5fSKn8TAgiQH81WnbRjE4ty1QpapCAGtTUFdP5MUERw4rvkP5wUcqxJQ2AGGF46wcYfvD2hNSjo86aTS97dBjwEJWzwxcEBGXTrEdumJCwAYGeft2xDgLj9v9iDHXQpn995a8R4EoJQDnx5Y2RJpv7GiCrY4snwxLF7gdYCfijLZTyZWeaLNzLNshEkdaVyAUaCuQ4Y51G6QpQAr1d1WSF1qzQ9dP4FmL9zPUSCJAgE4Qe8ScgQTUZvcfoTm2NGosRbguRDRt2NS8EZUHh5cgLRYB5G8J2n4fVfN8pXhJRFL3TKMfhjjjqwfnyep7GTE99Mx64KByEtbufRFmmS5Rbad4axyBEWuE7bCMwUmo7qGVCS5TuzVLBKHday4VVpdsx1ZiYC1uc5d3UeDrY2LQDafwXkkpCqSGcdi9mYFj7KvvKg4jbHC672mXyFeuB5jcXjzBKk8U6EthfiwAiTGjfiCXQMPe8WqJDS9Ktj9yHcje487u44cQBiiFktTtkPmrLWoJNNNRJHNqtEJttqcMdXrEYEFJEUSfHtnXe8JiZ9ZMd2E6Ut4X2mda7jff5xK8Nj2XG\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 04 Apr 2026 12:32:05 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"ca-ldNrMa+/dpxS1CKJ3R2rVjDhSNo\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1775305985306\r\ncdn-proxyver: 1.50\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 04/04/2026 12:32:05\r\ncdn-edgestorageid: 879\r\ncdn-requestid: b094ddd49f0c88283ef7c99b37cfa7b9\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oZkBqczxqc9opVzlQl8eoFU7QEJLZt5VeJxR9nhYqAJnb5UrZeIxxJSiTiUyJpSMKAt5ZE42w59upwKwZMhT1JDqT5miylwnn%2BFSLuDz0%2BuW7t3iFtpgs9StnAs9p2w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e705570d8ca56a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":202,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c48a9befa5eec2c4984c9a5f559fcf87","sha1":"95d36b31afbf769c52d42289dd1dab5630e148da","sha256":"12fb697358d7ed631288fd544caa35dab7e82e5ab9e7232da94ecee94884bafb","sha512":"96f18c99f6192314174d236fa22cb1b3cc3cd24a3d985656443a59ce863c066cf3807b185357161ccf1ee04d6b280c586763ade1fd6efdcbdc1d336c1be49377","ssdeep":"","tlshash":"14d023c11717134d5670386725d9c94d11550407d9da595e4550320242406993e6cd94","first_seen":"2026-04-04T12:32:37.725391Z","last_seen":"2026-04-04T12:32:37.725391Z","times_seen":1,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-04T12:32:02.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 04 Apr 2026 12:32:02 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Fri, 13 Mar 2026 20:30:05 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pKJ6py13RxQE8MZEG1J7LiVfYpF%2But2twA%2BjHjPd%2FHYLzuXqx7R%2BlHbM7DdXkxi4O2O60Z9rGLjZeno18Zk8Mg2Yt3%2FalI%2FyaY%2Fv9FphtdCT7S2fXbWSjquaYz%2FOPqQ%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9e7055605f09c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3134093,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (52456)","md5":"a9b85cb9091facec3ba60f90abf35f74","sha1":"5a977ba3af08a9cfdc8f0eac00cf0602c24e7c3a","sha256":"d15fe57a02ea20567afcc9316be175cad8449f262993454fbfeccd4e9245c3bc","sha512":"1908e1493f147b062a0949ca3aebfe688221e826c2a28b782389357a1d9e372f894924406d1680af7b18c94d53ee1708dc15513a2f12adb2a004b072e1b93bf3","ssdeep":"24576:9zbqhdmf3ICANUl1vbiOl9V8c/8xvXEdlW:9zuQvWP7","tlshash":"a52572b991af15c45b12e460130622406b2df627c908cc1cfacfba9edfd6155ceea6dc","first_seen":"2026-04-04T12:32:37.726754Z","last_seen":"2026-04-04T12:32:37.726754Z","times_seen":1,"resource_available":true,"data":null}},"time_used":326,"timings":{"blocked":39,"dns":23,"connect":1,"send":0,"wait":244,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bull-run.fun/captcha-loader.min.js","fqdn":"bull-run.fun","domain":"bull-run.fun","tld":"fun"},"ip":{"addr":"172.67.178.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bull-run.fun/","date":"2026-04-04T12:32:03.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bull-run.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Mar 2026 02:40:29 GMT","end":"Mon, 08 Jun 2026 02:40:28 GMT"},"fingerprint":{"sha1":"63:20:FB:0A:49:52:50:5E:A4:2B:D7:5D:82:72:EB:F9:1C:7D:77:95","sha256":"1A:72:E1:02:F4:1E:15:C8:B0:B9:A5:C0:01:76:47:94:16:AE:0A:46:36:DE:18:C6:3B:31:C0:80:40:96:FC:8F"}}},"request":{"raw":"GET /captcha-loader.min.js HTTP/1.1\r\nHost: bull-run.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bull-run.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 04 Apr 2026 12:32:03 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Fri, 13 Mar 2026 20:30:05 GMT\r\netag: W/\"69b473cd-2bb9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gJy3TDmPoc6QfA%2BHhb7jhq%2Bnn2oC%2Bz1mdcHYb864V70TnwAg7fD0aN7hxpy650Ru3csZLn%2F1bZD3aBJY86RqPtOMtdWCOwDkulV1%2FYkTb5ueuC8LK3vTke7eeyyC8BE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e705562d85856a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11193,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (10793)","md5":"74ef7d161abb76e8e9930c62e4213c8e","sha1":"1bca28257e3eea32463a90e68362a8470e33a384","sha256":"d272735708303674059145194d40c0031bfba7cd5fdbb57c741921dd81a83ee3","sha512":"46d01188f428deba1b7cf0c3c3bcac2e1376406e4a4ed29aa7e78733f80e22c7b254aadf19f615bd2e9bd5169a889d066c3756198954d64b37f3abe5d96fcd6d","ssdeep":"192:Fo70yIyr1R7j4Fa77eDUESvtnwBp5N67NyxqhcA4JzgPnQnn9:m70yIyr1R/QiVU5YJuqF4J8Pw9","tlshash":"a8320a71627412148537d19771619fce34b4a44bd637424ce6ec223acbeec893d3aea9","first_seen":"2026-04-04T12:32:37.728196Z","last_seen":"2026-04-04T12:32:37.728196Z","times_seen":1,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-04","alert":"Sinkholed","trigger":"bull-run.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}