{"report_id":"ec12b6f1-9363-485b-bdbe-df235ce609d8","version":0,"status":"done","tags":[],"date":"2026-07-28T16:23:28Z","url":{"schema":"http","addr":"onod.finance","fqdn":"onod.finance","domain":"onod.finance","tld":"finance"},"ip":{"addr":"104.21.47.103","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"title":"Explore | Ondo Finance","dom":{"size":4162624,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28471)","md5":"25738cf8bb5f22c387ca4fbbb5c92b05","sha1":"79837eae27fb33690eaeeee1be3bb80c1482548d","sha256":"3d292f0248a6ceaf0c1c3770bb9bae3707c5a97243b9ba1a027516f390a56302","sha512":"7fd053ec99f11cd6b59a988267c287aec343a31ba295915e948a24ece70ec22cf19edf437be5fd25376669189eb078f0bdb940b087b5140a29de10ef548fad71","ssdeep":"1536:ElmsTwhRbRIwm9aMvGYOGLbGZMtG819J/XEOhy3Oa69940ngRiAgRE64iUyMRmBr:Elmo737UT1FMdZaKkmoeF","tlshash":"d216f9f53241eae6fa03daabf5624639316f506db7969bcc40c467df24af8c04818e53","dom_hash":"domhash3a6aebbb282c1230950f9464e2f65946","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"onod.finance","fqdn":"onod.finance","domain":"onod.finance","tld":"finance"},"ip":{"addr":"104.21.47.103","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-01T16:23:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"app.ondno.finance","ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-13T13:15:48.132774Z","last_seen":"2026-07-28T16:22:17.563188Z","alert_count":28,"request_count":28,"received_data":5196912,"sent_data":14456,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"onod.finance","ip":{"addr":"104.21.47.103","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-28T16:22:15.844867Z","last_seen":"2026-07-28T16:22:15.844867Z","alert_count":0,"request_count":1,"received_data":497,"sent_data":481,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"76244d8526da359429886b03a7ada498","sha1":"90415cd87cc2f928fc8e16b7740dfb09f7e5bc10","sha256":"3f699786f5f750c5ee9696bce7941003b51f5e5628b55aa6ca59917195d8b490","sha512":"3ba24210155df81c4378587bf70fa4a66f8eb44e60d01deca3b32a8ccdd092d350a1fd870334d90469b750c2fc86822743811cba384e7baa95635291061c3adb","ssdeep":"","tlshash":"dcc0125970206966048e787d4ccf088ebe268412a20849c999dcd8547fb1e6c42e484c","size":184,"data":"","first_seen":"2023-09-20T06:28:52Z","last_seen":"2026-07-29T06:08:56.719576Z","times_seen":1923,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d762fab9cf66979f2fce2662a5d3d4cf","sha1":"4c9f315dbb37a81227c93cc4bb3415b4239391fa","sha256":"20a4794ce46a86fa2eb2ddb2ae4555515c0edd65fb3b614743e4a97249c6963c","sha512":"9ce3c5510cbe2f5bb0434e6f1faccc49fa13a19327d1a77d7cbbcb656705c522c3d24dfead2daebf2fa0a2a308e4f111f85f646969ace874d7ad88e8cd1982ee","ssdeep":"","tlshash":"19c0c080cbfcdc62050800eb403091fc31802f3c010110c9c5fac84f50cce401b6b910","size":180,"data":"","first_seen":"2026-07-28T16:22:21.031763Z","last_seen":"2026-07-28T17:22:11.679674Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-07-28T17:22:11.680245Z","times_seen":3232,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"80968438aae41c86a2d1b6ec0661350a","sha1":"ebbbd52f6b4e8236d854a2ea204a1eccd20b5dde","sha256":"8a89b2bd2a8207cf75df90e59fa9524cb5f5ef09fad0fc011e5204ecea3b91b7","sha512":"8f6597b59c4505ad8b6a8185827b4b192dcdc076a4c6addf18f1e9d7d61083f0488f9298fc8c02f0a57dab4f21bfe4faacde2c64543feea74686baaf023f44d2","ssdeep":"","tlshash":"c601992912759731127b812c170fb76aa27440632248ba853e1e9bac4fac20fc1f9bc7","size":743,"data":"","first_seen":"2026-07-28T16:22:21.033885Z","last_seen":"2026-07-28T17:22:11.680741Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1785255778490","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b6b7369cc40db1b1f8816c399ecd0995","sha1":"d208d064a6baf983496b35e0b953dc1e9d53b2b5","sha256":"251ebcdd6ed1ee7023830fcc64eaf4921f63efef20080d83e8a97813e13b7560","sha512":"603d3769b002fbad0a0251f6fb3d4c4ee5fcf10f8159ed049e2060ffd9153303d4c9beaa65ab5550ae3b7f690e8af91ec5e5ee07378560dfff2bd68a972303a2","ssdeep":"6144:Bh5gDKQDCMEWm7ECNF0gct3VyBKbMboOeC2PYqxQWNahLYzO5WuS2KImDnyJnUCL:JsKQDC6m7hFqa/J/","tlshash":"b0d4becaa73d377f5ae01aab0c2b413fefc80d1e216b09c852d1b8d9527970693d915e","size":619184,"data":"","first_seen":"2026-07-28T16:23:31.071186Z","last_seen":"2026-07-28T16:23:31.071186Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"app.ondno.finance/wmon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.739Z","timestamp":1785255778739,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /wmon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-753\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sys%2ByZOO6mSYGvN0ntAZTDWANrMOStNZSE4aMrJn2qYWywcZ0GzoMnxgCb76QabpF1v6hO%2BjUGZGKqH6ZTAXjh%2BTwXZhWOCCdlPMdiElzFKS%2FjQtN%2BbG3GheCcBRI6aZFiOsfA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c92c890b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1875,"size_decoded":2814,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"1f616acb8ff13871d024fb3e8af83e73","sha1":"cfc880e92eed5213176a6c69f387f5940474c5a9","sha256":"4cf410868388a7499010558b1e473a9b82bd874d6cf2bf6ea99e09df6dcf5599","sha512":"d0cb4156fbc39022a68efae6430c0312b7faa7c9445ca19a39dc2d34557edcb7fb38c5928eb3cb8167cdc7529e45ab9d6f6e9b5ee2d5f548f922b77d2f36feb7","ssdeep":"","tlshash":"2d31d9a5a9ea82f1ed38195163aa4a339323a311ebc725b470559ef316802c9431876f","first_seen":"2026-04-20T10:51:23.416584Z","last_seen":"2026-07-28T17:22:11.671717Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/favicon.ico","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.891Z","timestamp":1785255778891,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fUBb80adTpHfTfPHHp3JZfX4IVX1X5X9ArP5Z0xcASRhTB%2F4lZ4ABMLmAgEL7dyNFlTwD3TSxhh%2BsHldx91MUw8YfAeTV8j0W9zc80UEs5rw2W%2F67VFVzfzYZ%2Bgl51NyD08axA%3D%3D\"}]}\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"69c48845-2ee7\"\r\ncf-ray: a22539ca1c9c0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12007,"size_decoded":12922,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"055daa8924aedb430a5313283bcd28ee","sha1":"1fad23a11533b8408345267e9c34aac620153a1e","sha256":"700ab482214cac6ca7eddd4d74256860604ceabe4bedefd0324e44fd3b1576a6","sha512":"6eb664485d9befc1fa2a683a9f62fd088d29ba1803ba9cfdeee24a11ca79e05019a2555d45be6638ee70f082c43a5daa0dc9942f0ae3e9fbdefe27c2e7b907d3","ssdeep":"192:IRtVZVuKrC+g4lSBdzDowU+92mfbX2mlsTpUfn+TRaluaaOsEs/w9TM:IRtV75gpB9Do69ZmmuCneRLaa9Es/KTM","tlshash":"b642c0dc1310b2ab1f4d6575985e1bc28671690d0c6f4f8fde79cc0fea7e1841849b58","first_seen":"2025-08-14T22:56:29.206535Z","last_seen":"2026-07-28T17:22:11.665825Z","times_seen":150,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/ondson_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.715Z","timestamp":1785255778715,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /ondson_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-263\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yf7iuiRq4NpjkFSeRnxxvFCfCIUkIMdff6j4y%2FDhLR2Po2MgiWI97IxmSLiwjQW94mQzYQ8AYNR%2B27ttdywt9mRycfK8KjmT0t%2FEhj0HNIo1cmDXZsEqbzizZsUHKS1oJafUtg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a22539c8fc7f0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 611\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":611,"size_decoded":1545,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"e43e431e00cf249827c008b493ffced5","sha1":"31a3a4a2db35404fd91101b09da7798de824e51e","sha256":"6228f81f1a6a809dfb36622808f80684a7fb5c151a8478f3a91996edf5e7d877","sha512":"e6b0259f2d01a1389ffb4eb2ade2a52c063cceff851519fc6360cebfe09c7caa816fd33d22af35310b8e15544beb4d4b1a6cff1ed8d0555bb9fcb3ee3548b224","ssdeep":"","tlshash":"90f068c005952d5de9dcd45762272e7dd673151a38438d5d152010173e2b4b8111b602","first_seen":"2026-05-13T13:15:53.145008Z","last_seen":"2026-07-28T17:22:11.673497Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/wdcon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.724Z","timestamp":1785255778724,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /wdcon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-748\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K2y1moXEUjqlV476CWHHH%2FnAdkUyC9oMJQCmkWTU%2Bp2DObXh2K5jgcnprJtbgstCu27NibpIO%2F%2FXYLbshhKv42AaapG2GUlRMwdlvAJw%2BuF48HO%2FdW%2Fzl04NLi6xbxZGimlGSQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c90c820b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1864\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1864,"size_decoded":2807,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"3dac0d9f1ec4e47cdd83a66109ee2e2a","sha1":"66db6280fcd1a2d42c1e366e60db742d09fe0e2b","sha256":"c8698de1c5743687bd00ff4a2f2b09447efa94b40c062ab99a7ec1a5ec6ec32f","sha512":"25fea4f2dba085be65c0ef9988052438b90204bed3a546d2a892c6b21bb81e2492cb73b465e1d41b3ad6b2e1ffd49cd5bebd5547c162682c2f1b593568025e3d","ssdeep":"","tlshash":"c831d5eca3e28cb19a098b200cd45092fe675df53ca1dbc9180b7e16603a6e45aa7159","first_seen":"2026-04-20T10:51:23.409285Z","last_seen":"2026-07-28T17:22:11.664026Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/26b9a48f6f36dcf1-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.599Z","timestamp":1785255778599,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /26b9a48f6f36dcf1-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-6470\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t7%2FJ1wCsx9Ystnm7E3f4s4lvb%2FGd%2FvPQt61i5G99UzrJsaqajPKHeEKOzuuHOAxKQPbb8HvWWs4sFjsS2bZHnOh75Jzi6mLYHEhdC5z7VbYIwav5l9%2F4l5y%2BGqNI06jhuYT%2F6g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a22539c84c750b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 25712\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25712,"size_decoded":26659,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25712, version 1.0","md5":"a35b4c03cc7737dad84a0d5f2b4a2460","sha1":"5535bad7544a481be36d70923edabf0d7236aeaa","sha256":"b508347f9e0a276ced4358c74d45a8fbeaea943dde03241a4dd2699f15f8449d","sha512":"1f0c3c0fe569ff7bce3260f1c8a39769830791c5b19124515c1eedc62eaa4a27a50459a44fc213eb02f9c4d04b89f394bcad3d283fe056ddba2116ccd1c9d936","ssdeep":"768:1Z3ebpCogIlkzRR2e5tkRG/o3lpAUdbYPAyqt:IpCoPWtRNGRGA3lpz1uqt","tlshash":"3eb2e13c857d2f8be14132be55bb4087a380e45b1f50910daecbe560d24fa94e7c86ec","first_seen":"2025-03-16T13:23:15.890573Z","last_seen":"2026-07-28T17:22:11.672794Z","times_seen":7,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/sofion_160x160-3.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.733Z","timestamp":1785255778733,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /sofion_160x160-3.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-964\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=24yOfZuKR28amCd7Y8lItnYP4%2F29%2BXYl%2B8OcEvPUxoXLBpaUhWyQ48nIF8NrH9wQ0ocYKoMTiPGM89qZaNhu17bwH3SZZL4anx9SA3lRIR9%2F9tFAZPT5EY9L%2BOrMnpDYLLSICg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c91c860b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2404\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2404,"size_decoded":3343,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"9af491eac8e22d88fb88b3a9ecde9000","sha1":"9b7bed84537b9646e333d64f079db70fd1e8a1fc","sha256":"8ef9210e86db896481f84b63dc1b4eff873eaf22fb8099c46028a2eb8581f656","sha512":"206cf911975f1f3c144575dad7a8fef66eff789971a07d04d37d86940380d37b89100ec1715f384b6c6395f051f32575d130ef6aa9401534a72baba1c920c951","ssdeep":"","tlshash":"40410a184aa3cc4042dda60575bf265fb7ec320983e6f3a054457dd9b0d494b2055f5b","first_seen":"2026-05-13T13:15:53.130354Z","last_seen":"2026-07-28T17:22:11.669043Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fjmpd%2F","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:23:00.266Z","timestamp":1785255780266,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://app.ondno.finance/\r\ncontent-type: application/json\r\nContent-Length: 1463\r\nOrigin: https://app.ondno.finance\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1463,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB-ALGAiwAFwDdArECLQAlAxsAAAIBUQMAAO8nhn2XtsKCAR91H_MC2_mnNx2JMWgCAAD_ixHsj-JlLchKf_edqE8JVv7nSK3zkMr0kSs55InKZwg9JudNSTac9DOKMOIYH4OwaxZ6OiGSkA490TonAW9L810SxF_VD4ton0EzBjhpVkXZVvZuzb5kQC98Vjq16Bz9fW_ZIa1HDxsU_2wcFJ6mnXCOn_GNEDDy4HBrWDtd9rrzKxv3f7u8hQEojyLahuA3I1kaMriu2u8gDK4tZuifeiYK027s0k_jLi56JSOpFthxBeCVgrRWzy10Zq3JzpJ7R4YRcPlvg0WqYYRTKDKDlY8s1LkcQR-G_EVbtF-7w15ebqHwd8OKPJx_FRpd1h-WZG0No3fmAxAx4Blq2KlafoZe8hKKH5hRrtMhglEuD5sUIkZeOtnUS9baDMay9EFpEBXE7hvbfxpKyKnyGxryDaNwhBH2LFILRxIbaf76arlpGey9qjXVXozGrnf7SUVOymipM5g6WAN0wjF4onaBztqZXDb2bE3jpxlkZrRpj84zKumKjxw9sTezVv6_4KtVtzg6IAjSM6ToJqh_NjzCvPmGfUzEmUTZPMGyEDhXO2I-HTu06NC7BvrQP0WbFPZ2-2V3o4C3gVD_zL3k9hMDKEr3rbDwgji9Z9S_bD6KNpgnuAI2of3tiUZd1k6Z6wHM7flgVUhh5zpmDe9dUQ39iID2GXqDAnmT2zn5Z5xLEHpTzJHfTCN5l1Z73P0fv5SLhpT76FjWiaMCjwh3yvJHo2hrIqIOGuSCCcQ78cjhLpXfojZcROzPgmD5JTMPJecgN3RJan7PSJhDeMW-Wf_2ZUSsRwqUgancijyEEEVHpdmiDQCHnzL69GTMv3u1upyWlChuMoaHJk-7T1spqGcpVcIpD0el5IBDSiVdVFAAdy-QCpvWNZDDJD3htI0rHT4bnbGr_s_uMvzsjN0xVf_Sf-QrEoSqh7DaC63C1PslPwV1mjobk8p1izcArsEHs1-lYBy6G9EioMUI_SVWgWlrmJA9JFa3L23T2SW1snoWeHtr05Zi9J0uuhx1rekk_uQEhUEFznMSrdjxoowj3HW2fWd_LwtqNDhj8p9XBt54C6wW0LZnXQf2oTNtsrUAtNT3lnmqvtUTGg9c8BS2NfheiduY-ZCV5VIOaeCGf3jUi0qZiVuD5WGde2RRuR8xF58E5C5AvHs4hBA\",\"challenge\":\"eyJpZCI6InlObWhzc1Mwcm5vaW9URjAzT0hNV3ciLCJub25jZSI6OTMsImhhc2giOiIwMDdjM2U1ZWFlMTk2MGFlYWJjNjVhMTc5MmQ0NzJmNzUxYzQwNjkyYTQ4NzlmN2M5MWUzOWI4MTE4MGVmYzNkIn0=\"}"}},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:23:00 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 19\r\nx-ratelimit-reset: 1785255840352\r\ncdn-proxyver: 1.58\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 07/28/2026 16:23:00\r\ncdn-edgestorageid: 1445\r\ncdn-requestid: eb66be7216150151c036b999d3be31fa\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=flQ5n5yBlAd1S9PmTC8fTzqCFVSImTO55%2Brcra6u8qQ%2BvsAiqmHJYAWn8%2BiH6HbWdS98pMbWBnodS32SV4c7bIFEqOZXGFlONfqBQWWHCrO4RQGtBvL62PZusQk8XBy069D6Lg%3D%3D\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a22539d2adda0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":3435,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-29T14:56:30.755746Z","times_seen":17599502,"resource_available":true,"data":null}},"time_used":602,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":602,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/astson_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.726Z","timestamp":1785255778726,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /astson_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-70d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7CYWEIb4uipOtNMG%2BJnvhrnaUSGXC5uYQyffduv3Km7euNRggdpKgU5%2BwstOijE%2BDwwj6TM5vT8uhw1uPhH3rqd9t%2FRGaRpo%2FxdcorsjL9mGggRDa5EZf66vlFAL3KRrMVijDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c90c830b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1805\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1805,"size_decoded":2744,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"dd2f585845cf78b87db3eb9a4bd7b60b","sha1":"b9d94196aac72dc1098c0869a0f8c4e0ebffb8b9","sha256":"8f56565be4f830cb2b0ed90ac2407833354ef3810ee6f8a5dfb2a9cc65005dcf","sha512":"94620de9935b8aa94061f7d6b8eff0d5ab9833fe1cbc4c6582864c456770330ae4b658f36f6ba31188d2e48f4c009f3976d955ff2b3f566262c896924a8870fc","ssdeep":"","tlshash":"8431eba51fb62eec910c6b914b2d51a6b986d43410d51d54452c7d26743a32eccd07f7","first_seen":"2026-05-13T13:15:53.129452Z","last_seen":"2026-07-28T17:22:11.675627Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/vrtxon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.741Z","timestamp":1785255778741,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /vrtxon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-749\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uPCQ7PU3HNQKTaFgsQx3einC1r3e2w2bN%2FFstT6aSZaPMW2zJP9Nk0b1R5o40tZxzdP13DqSAZk%2BTQ%2B0kMmxHjntqTt2X8byWv3qKxHruooDg1I8TajhdG%2BpRSVdCIuzeEdZbA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c92c8a0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1865\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1865,"size_decoded":2802,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"52dd5a0963b567bc9e7d9b548d370479","sha1":"46cc0373cee5335bcd098f5b8f8ee9ac068ffd65","sha256":"91426d45dd44304fdf6fce36e5b12d6559da5457c8c4a756436ee3a746eeaf6c","sha512":"0c6ec5384215d156f2cff154cab67dfae1dd5085dc40d4abe55784eea84bc3925f9c4fb7d307b1c5d8ee57610ca1a3836e5fb498d95c9fede90071e1ebd5eef4","ssdeep":"","tlshash":"22311b9e22d4185ac5b6083354e1a29ac5dc2c1968a2811c7bff3c35eebd6b0616e114","first_seen":"2026-04-20T10:51:23.426458Z","last_seen":"2026-07-28T17:22:11.676195Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/intcon_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.745Z","timestamp":1785255778745,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /intcon_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8d3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HSZ0XSxD1bPFrg9GWN%2BkHnGfGs6ryQEckuhMuAcWpE3Pj%2FHMXjzGRrUaqD1aYzXl9NbKcx%2BWyDjcwaTBfwnRR%2FLJqP9Pjhp%2FteDWhW49vVOJOqnVrsP04xNFjaXalnYP%2B328VA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c92c8c0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2259\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2259,"size_decoded":3200,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"68e32b1a6d5ff25704ea5947c92b7554","sha1":"0077c1b7efd501112404e04544d199d7a66febd9","sha256":"132d08c8cee0c810b8349e96ebd3c1a937ae36dfa95172e5f527b243296cb811","sha512":"ef4105dfd99a3af3edef6b47436159c5d7be1cadbade463c660ec186434b2cf8f921fbf37f6891ada5d4d4de50c22df6ffc9df9296b7a88e7088675a4a36c4e9","ssdeep":"","tlshash":"46411980b4b85554a886ddfd12c1a8ac2bf27b3498d0b1cf2a964ea71040f2c488a963","first_seen":"2026-04-20T10:51:23.408015Z","last_seen":"2026-07-28T17:22:11.667373Z","times_seen":9,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T16:22:58.054Z","timestamp":1785255778054,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hMPaXobM%2FDmwWCboifPATjIrJPk6bHSwIuKIwmxwPwTZ4T5WG7eSNhyd4TF944E6JC16YFy3xxQI4ux2TD%2F5EAfXb%2FaNrpUiELoF4cIUO0dv2R5hSSy24i9xsDYciJygOaY16w%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\ncf-ray: a22539c4fdb956b1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4358774,"size_decoded":337385,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28486)","md5":"e3a6b4b06d6226ab2ef84f7adf65d326","sha1":"4970b249a8ca67b30025a53f6f6fef5a0de4e0aa","sha256":"963cd108e5491349207d045856775056fcebbadc86ddcda429aeb3a542e09a67","sha512":"44cb591dfec75f77958aa8b425ecc669e9ed71a7c18a627ec3bd7b39ad76f06925d129e045a8025dda9567199afda871aceed03fc51e051647f782cf183ae97d","ssdeep":"6144:wYTCeZAW5huttpOzKh08G5CyhsiLoll5SGBvVO/D/7aFBIov+w75:fCeTzov5","tlshash":"8a253bb93300f7a6fa03caabb571427d212fa01cf7929edc41d06b9e14ef5c05919a57","first_seen":"2026-05-13T13:15:53.135537Z","last_seen":"2026-07-28T17:22:11.674481Z","times_seen":6,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":168,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/8cc4ca7238341e88.css","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.461Z","timestamp":1785255778461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /8cc4ca7238341e88.css HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: W/\"69c48845-a27\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 76\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hJkjY3%2BZRO%2BvQ6y24vSFrMz1DkDgrG%2BUYCGqHaKOnaVDjAVCuYP%2F205RaNI3Eq4r7VwDwCsaqoYWU3Cd9UQU1%2FmfRZjPDWvAeXpb%2BkZGyMtvSMKttFY6AdU2wJQJuF3Upw%2FxEQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a22539c76c6e0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2599,"size_decoded":1713,"mime_type":"text/css","magic":"ASCII text, with very long lines (2599), with no line terminators","md5":"eb5a2972db949e6d04affd14d011f2d7","sha1":"49fa85a27abde5f5e5b1be4bb21e4c466d899d50","sha256":"88c4625f6a8d095742855c98b06e5e9bf56bf160bbd4cd4dd7f956009dfc344d","sha512":"e087a974de6ab70f3707422a3b98fcfcc100cae4287709c00b112f4b1c6e3319e3e038e34fc0c971b36dbb1f4d790b2d173a0190b5f5f79d9e6c0f2a42f41049","ssdeep":"","tlshash":"2451a124401f9070a5f28e83368efb22256a685589f64971f16b095c9cd7abf63f0f7c","first_seen":"2026-05-13T13:15:53.136514Z","last_seen":"2026-07-28T17:22:11.662722Z","times_seen":6,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/ondson_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.735Z","timestamp":1785255778735,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /ondson_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8fb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DuaFN%2BCoW9Km2JIlS1DJPEtWplVAHE0fZGbL0LERQsBIZw2GWo2OPGU0arQ9vcIkZ0Ulh%2BGjcgYOwpgkUeDD7NoNSfdNsIPfL5tqvlaYGNitVqJ1c%2Flh96Mutobdejb9pftxDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c91c870b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2299\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2299,"size_decoded":3234,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"19304aefee9afc0bbfbf118fb3251542","sha1":"ecc34c5ef692d6ea74cfc6165b069aaa4f17f8be","sha256":"3e51e9917d5c96b4733c45459d5d5656710714b4475168cab973ac9ad8d2981d","sha512":"920c5480810934b1ba0b574141a633511132cdf706248ae8d4a4d3c20af029d2c31e0f7bb0dcf941c361d34fd9add39190b6be5968a4fb8d1547f086365d0378","ssdeep":"","tlshash":"b4411902d4b0318e538e0e71857e5118f9872965b9bbd4c57cf9d2299c387cc0b9ddaa","first_seen":"2026-05-13T13:15:53.142853Z","last_seen":"2026-07-28T17:22:11.677982Z","times_seen":6,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/sofion_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.709Z","timestamp":1785255778709,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /sofion_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-21e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZmbL5Ff0lEFP7WFsVK3nU3Al6wahdrMMWdTN0wUmQUWlf%2Bt5kJ7CU4wPHBlZzu1f6cLotBV3NMolh3sjxDlC%2BUtakAUF2SE6PAEErL3tjg2jV4N8gMrqj%2B5EtlvzChM%2FR4DlCA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a22539c8fc7d0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 542\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":542,"size_decoded":1478,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"71d10f3acdf1c2ffcbf162c73e5668a9","sha1":"62b6654e45f963c604329a75efc881317857188d","sha256":"6248129c0b90e0b17ed63bdc039c85a908c1bd9a3b9754078396c03cbc9e7973","sha512":"cf53b3389cc6c66530563c27bebd6b7f9870ba379e22f25e6fb66980771957ac2fdef4c41be24230f19b50af1ddbacad8d4cbff95eeeccf27f39f184d8814238","ssdeep":"","tlshash":"2bf0755f23e4dc8e418ca67370624038379f10fe09f2571788b820b7081a9f08a80f17","first_seen":"2026-05-13T13:15:53.132861Z","last_seen":"2026-07-28T17:22:11.663276Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/tqqqon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.753Z","timestamp":1785255778753,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /tqqqon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-970\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=flQAX6iUBaiHxlHc9RoAmhKx%2FfLp51FR1Vi9R%2FwbPVUjr2KOGfmiYgrJ0sT%2FNwqAico1ztf3GF40JFXdzMXoX2wGWI%2BvHeVdSyZG9T2G6%2B5KXRFfwUe%2BJ4FeehGrE6xm6hVCWQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c93c8f0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2416\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2416,"size_decoded":3357,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"242356e41367f403c0c6c0fc15a0401d","sha1":"75d3c7b3c723cc2d72a140aa362823452ca81529","sha256":"d771ed35e6e8de65ed76c0a03a0f8aecfc492a772fa41111c9f8cb0d86d8831e","sha512":"7f4f01a6eaafa7924ace757d66df869258dddbf9ed356cc85915264e98e2550044ab17d7f99ef42ee371cb4faa5eed5083e672d477a74e19725b964bbb7367dc","ssdeep":"","tlshash":"31411b8fb3ec58fc41f40af789a95577468a1259a3a36b9b0344c53c8c8590b35d8d89","first_seen":"2026-04-20T10:51:23.410348Z","last_seen":"2026-07-28T17:22:11.665221Z","times_seen":9,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/plugon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.750Z","timestamp":1785255778750,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /plugon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8e9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DeJrNcnLR%2BJC8f2tiJAyPwCSzNxdk858ouNghUpYJt%2F%2BETy6DL2Ul3N8rBWMXO9mTekPuiMGZSPquJEfnM7l3SEeyk6BTfwPPtdvVTKMqfqql%2B%2BXb5B7jnq0CycWcEDCwwkEpg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c93c8e0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2281\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2281,"size_decoded":3220,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"035bea1f20f3240883935408be759bed","sha1":"a11de51afecad0732aea71fe91975856d0fff0d6","sha256":"35a69e110d79c9c1566169dbc893c15ae998dcb24c458744fcb0b1ce96d4fd48","sha512":"a81940335e04dcfa59b85693075f7bd127331854e898a624be0892af29f0f7f66ea9979737b1f9daf90b8780d279a6d696c5ac679ffcea458e58c01b9244fa11","ssdeep":"","tlshash":"0e4108af0a979682d230d92126310a3fa9c527f05ec1b60f0465c4b12df6fe802f04ef","first_seen":"2026-04-20T10:51:23.41752Z","last_seen":"2026-07-28T17:22:11.676724Z","times_seen":9,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/pfeon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.754Z","timestamp":1785255778754,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /pfeon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-905\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ojo9uWRvymyy%2B5McbRPTR71CDzAEw6bD3dM4UoodMiBNiWktMq4hOmFSSI8c4SdDnXuNvK2Sj2UNjGKIIxOWJ5X6Rjx%2BcvQ4BTtBs%2BLl6UichIzzieTl%2Fo5Ue1XIbtXrwKRdbg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c93c920b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2309\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2309,"size_decoded":3246,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"5f1fcdfc385f0238532e9fb8edd66a4b","sha1":"ad23a313874e246a32c2dff8a042dce29773b015","sha256":"890d474745f56fd4bf241ded0f5a3de2c6c74513b4673ade3231e44a88d1908c","sha512":"226ca6e2182f02222eab5b752bbf96b7d58e4b48f3c9bb0b3bdf4865a3c762e5d183b8e2d0d669ac7c22a137991583e9e008c2bd16abfee683e1ec3a69775cc6","ssdeep":"","tlshash":"45411b76b1908e7c16bea4642ccfe565f191ae972457b06284520e5c4320fcf3978932","first_seen":"2026-05-13T13:15:53.134718Z","last_seen":"2026-07-28T17:22:11.678543Z","times_seen":6,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/favicon.ico","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.893Z","timestamp":1785255778893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uZt%2B7%2FQnuERlzhEI2rNOSZ%2BdHcBgiO%2Ba6q2b528ELiAQNEnUbSHR%2BRlehRzyNK3cDCrzPp3c%2FJpC6Dw5dRiuX4jtQ0ELS%2FkT8T%2BWDJ%2FKB%2BDGtIOBwlodgKCIiDoa5ZAdkc%2Fa8A%3D%3D\"}]}\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"69c48845-2ee7\"\r\ncf-ray: a22539ca1c9d0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12007,"size_decoded":12936,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"055daa8924aedb430a5313283bcd28ee","sha1":"1fad23a11533b8408345267e9c34aac620153a1e","sha256":"700ab482214cac6ca7eddd4d74256860604ceabe4bedefd0324e44fd3b1576a6","sha512":"6eb664485d9befc1fa2a683a9f62fd088d29ba1803ba9cfdeee24a11ca79e05019a2555d45be6638ee70f082c43a5daa0dc9942f0ae3e9fbdefe27c2e7b907d3","ssdeep":"192:IRtVZVuKrC+g4lSBdzDowU+92mfbX2mlsTpUfn+TRaluaaOsEs/w9TM:IRtV75gpB9Do69ZmmuCneRLaa9Es/KTM","tlshash":"b642c0dc1310b2ab1f4d6575985e1bc28671690d0c6f4f8fde79cc0fea7e1841849b58","first_seen":"2025-08-14T22:56:29.206535Z","last_seen":"2026-07-28T17:22:11.665825Z","times_seen":150,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1785255778490","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.491Z","timestamp":1785255778491,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2FAxjAR6Zkiq8PvFHzoPM-ew6c0c9d184fc39cba92f0a5c15f840262%3Ft%3D1785255778490 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:59 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"972b0-0gjQZKa6+YNJazXguVPcHp1TsrU\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=BFxIq_XPggMyGPP7M6tScg.js\r\ncdn-proxyver: 1.58\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 07/28/2026 16:22:59\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 5c081df6dc77b08264138b4255ab32d3\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=axvPxzwh2hDIJAO63OlYck8%2BG5EmY1yz4woYeju%2FuM1QI9VEsrAN2ZzQgVmq%2FZCLJMD%2FgCj92RhBhddKD92m%2BOeSRUkyzcJwjqMruZ3Iobn9TtwG5eX2yaAw%2FEkaSdT5w2%2F6tA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a22539c79c6f0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":619184,"size_decoded":137420,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b6b7369cc40db1b1f8816c399ecd0995","sha1":"d208d064a6baf983496b35e0b953dc1e9d53b2b5","sha256":"251ebcdd6ed1ee7023830fcc64eaf4921f63efef20080d83e8a97813e13b7560","sha512":"603d3769b002fbad0a0251f6fb3d4c4ee5fcf10f8159ed049e2060ffd9153303d4c9beaa65ab5550ae3b7f690e8af91ec5e5ee07378560dfff2bd68a972303a2","ssdeep":"6144:Bh5gDKQDCMEWm7ECNF0gct3VyBKbMboOeC2PYqxQWNahLYzO5WuS2KImDnyJnUCL:JsKQDC6m7hFqa/J/","tlshash":"b0d4becaa73d377f5ae01aab0c2b413fefc80d1e216b09c852d1b8d9527970693d915e","first_seen":"2026-07-28T16:23:31.071186Z","last_seen":"2026-07-28T16:23:31.071186Z","times_seen":1,"resource_available":true,"data":null}},"time_used":834,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":764,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/5194627767da3bb2-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.597Z","timestamp":1785255778597,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /5194627767da3bb2-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-d0b8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=evzcvtoby3X6nyamZTNTEOfKFGV422fRBTDRCQugvatBmYPej1YNcK12bI3ORjciEMG4dIjBH8GA8I3gc47EmI7dq%2F7XbxhKTx%2BB960veokkU9lIyYJiWWYDc%2FxPwfzK9irChQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a22539c83c740b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 53432\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53432,"size_decoded":54373,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 53432, version 1.0","md5":"797f386d68cd231cbb898a348a1a302d","sha1":"0627a4505490f56b54222fd8706c387e681a8c5c","sha256":"881a2d3353817360311589e071c75ac7599c3f9196aeff49c1f64329c55ba03f","sha512":"a4f4d7e735680c1220d1b2c893ea6b39021ac53d8d70cadd479a646c3b3f4c4cfb2b4b4443f495948ff6e7913d2e30e61df8506691508bf6bbfd08dd75a1e2d4","ssdeep":"768:DenjtxI7CY6n2s8C53T+LHu4ltUnJMPFNlqofweQ9GmjOqgl80BSIUhnxTX+9mZH:DeR/n/T+LFAuNqoHsjOPPcTM0d33Bv","tlshash":"d333f1c66b69170de6b119b7098cfb35f2af7c91aaae99434b9c01e11c3150c887b1f4","first_seen":"2025-03-16T13:23:15.848192Z","last_seen":"2026-07-28T17:22:11.667866Z","times_seen":7,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/openon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.728Z","timestamp":1785255778728,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /openon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-917\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8jsrAqA30KdTj92rvt5%2BEdA8zNs14k2moMgx70M6vCF8ub63BgsAzNXCfwUtT%2By8IhoxqztomvCfl9nruLRUC7hPHt7fqdRfGXw8FyGAN2fiddXaP32uLI7L3P%2B6Wkl457jZcw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c91c840b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2327\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2327,"size_decoded":3262,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"8a661f1154a1675b931ca1ddb45f7dce","sha1":"7c704e2ea02314581dd0864c6ee5170291ea4796","sha256":"c13f0f8afccb55750ce776ac24d8feb4d484e04074f46aef95ecf74b62765ff8","sha512":"4115a274d9bd5b9b813204ce4a5f562d90483e985b3f43a43366f30e68a18af82f6207d94a4a707f709fe10cbebd1624ca36adc89cf0d0b61fec8c92e3c57f00","ssdeep":"","tlshash":"d8414ed2f438c9b55f406237493f85bd7cf901b765421e9a2c19f340654931ad487a45","first_seen":"2026-05-13T13:15:53.141783Z","last_seen":"2026-07-28T17:22:11.666789Z","times_seen":6,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/aalon_160x160-3.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.743Z","timestamp":1785255778743,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /aalon_160x160-3.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-7f9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qzH1ggey7Xz2AbTaiK0Z03QkrLVZPy%2BziKHgxs3nyCEd81npg57rq4G2Xh6hXuyF0z1KWDTH2jVLLG4ccukHS9VNEVnUGqSkzTqpyQnTNpryW1beWJ50gYYHneAMvjIb1%2BEAgg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c92c8b0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2041\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2041,"size_decoded":2974,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"4b571e1d2bdac8e02a095733d6e997a5","sha1":"b515cd82feef8f8d92ce8a42a9aae444526d4765","sha256":"7a19641615a5f713d4084dec99dc478b5b24bece420cd7157b472439b39db882","sha512":"c4ebb49a63066a23ddf3a7ee64ad82f636417587db8b44fb45235616007156e47b50501c8f9aa35be9858f48ab660edf7651f3eece5d6ce5a0b099d525a0fc9c","ssdeep":"","tlshash":"5441eceb76d9d38e43f6571025b7612cb7ef859a3081851cd1037e20b90739869ac4f5","first_seen":"2026-05-13T13:15:53.146057Z","last_seen":"2026-07-28T17:22:11.669619Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/aalon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.718Z","timestamp":1785255778718,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /aalon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-230\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4A5A1HqS6gI7xAAiRY3zIzwUeXiS2cphb3QIxm%2FxGmPiHZ35veCkW0C0zDQiRy9k%2FrghwsUt%2Bqlcon3arwzl%2Fw9hMHzyAMLH7J9mj9EHzxhhWaojcQN0CR9x%2F7SoDisT%2B4DYeQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a22539c8fc800b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 560\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":560,"size_decoded":1500,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"da0fd067d6e0e471474a09589f468f91","sha1":"147981ba7d554437b76ca63e3cc005a1e8b96c9c","sha256":"859705171ae964138d7e75773c05de75cf0ec49b5b585bdd2c15da8bab3067cb","sha512":"e04d80c3f0bf09b2cc02285c0657ae03fd7302e3684c681f83bd4c2def0ad2f9415aea9b98e19df29178a04e3a9b921a0730614d744947d602908c654a6f2563","ssdeep":"","tlshash":"f8f026d10bd1899df48c43a7c4a5587c88d74e3d3ad96d5ef45270308c4d046117dbc3","first_seen":"2026-05-13T13:15:53.140871Z","last_seen":"2026-07-28T17:22:11.668401Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/nvdaon_160x160-2.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.729Z","timestamp":1785255778729,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /nvdaon_160x160-2.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8b6\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=btoPty1eLKu8Y92LM9tDdCg3dJt%2BwR3l%2FbS2rpyBTaZr%2FvA8PUz1sis7xiagP%2BU6Cw%2FbgZ5FeIDEGQTmo9iv10W2NzOKXluC6WsaooLRgBC7cjWBRenLJziVFrFWbSnKSw5kvA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c91c850b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2230,"size_decoded":3169,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"efa5bc835d99ccfec0b6a14d2eee91ab","sha1":"94eda4f90a68dd01782eebeafee3ad3551800115","sha256":"b296f60525600be45c2df8829b71425245e15169c9fa9f811128d3e48f9c12b1","sha512":"ed68c2995094bece8c36f99a03e3316827b125287379598a6b4c637999fd130867647d22983425cf47d4dabda65a95167c6d02320cba57bf51c7c3511100a738","ssdeep":"","tlshash":"854129771c490cbaafa696cd5128809923bd004d58318e17f8a379c74092d1f21bdf2f","first_seen":"2026-04-20T10:51:23.425153Z","last_seen":"2026-07-28T17:22:11.677288Z","times_seen":9,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/intcon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.722Z","timestamp":1785255778722,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /intcon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-22b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cBgkwduXnDEm7oti9w97zuvwzXdeOsIdmD3JWrBJa9yiOW0GE6bGOgsXSMWGVJs75TJRpD0imWk02DFIoBSD4MIz3BxNxV4L%2B%2F%2BigmyLG%2F25WBUJvUybO7LP4THB30s6IK73Dw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a22539c90c810b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 555\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":555,"size_decoded":1491,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"15242d2cd394ac3c7c8479c5dbca458f","sha1":"770ce4a5399e9ec4a318c2a442e1a5a801c5f2f8","sha256":"5187db1b97a243b6b1e9dc719fda75f591a97c1eec415ca1260245eb7fb68cca","sha512":"48cf7ad6a6491985e6e45ebeef253304a67f4bd735c1eb12aee5813c6bd0b823f14631fd66fc9b4a6735991ad33ce4084edad54ad84db654cae7906b151e50de","ssdeep":"","tlshash":"d0f0264a90d44410d64d93f7d620a9f4fea31821157dc61a8690d47b17557146061bdb","first_seen":"2026-05-13T13:15:53.128589Z","last_seen":"2026-07-28T17:22:11.671158Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onod.finance/","fqdn":"onod.finance","domain":"onod.finance","tld":"finance"},"ip":{"addr":"104.21.47.103","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T16:22:57.952Z","timestamp":1785255777952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onod.finance","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 00:04:26 GMT","end":"Thu, 08 Oct 2026 01:02:44 GMT"},"fingerprint":{"sha1":"F1:2C:A0:06:7C:14:B7:F0:C9:DC:49:09:F7:18:0D:D4:61:0E:0B:B9","sha256":"A4:6F:95:CE:53:69:65:BF:6B:D3:11:8F:9F:52:CE:C2:34:A9:05:4F:B6:CF:72:25:D4:A6:F2:79:CC:3C:16:37"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: onod.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 \r\ncontent-type: text/html; charset=UTF-8\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\nlocation: https://app.ondno.finance/\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o2E9gpnIwOqmOtreEUCcuJvI3DQr2RI6Bcv5tROK6Tq1Ec2u98bomwLNRLdFbebiAcixyE5PEwSqBAyoK37Xr3ya6g%2FIf1GdWxYOTOc2LatYkLgJ15ewkhDDi3Ff%2B7g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: a22539c4cea08deb-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-29T14:56:30.755746Z","times_seen":17599502,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":69,"connect":17,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/7d545a7aa2fd3fa1-s.p.woff2","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.600Z","timestamp":1785255778600,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /7d545a7aa2fd3fa1-s.p.woff2 HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/8cc4ca7238341e88.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-cea0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pTwmbXaPKz%2FdtrAfgosis4KKrx1rTO8Unihm6MCiYHDiNbF8ZPVIod0pEELMv1ea8eH5raDK%2BCMRA%2BIY8%2BGueBqXDsJMDnli4%2Fn5YQ4joaU3wVEpcAZTkfV4Hwg25kiH4JlfMQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a22539c84c760b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 52896\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52896,"size_decoded":53841,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 52896, version 1.0","md5":"519fdff1b3ce5723da31fc8133b85cae","sha1":"c5680b5e0d043886a6cece3adedb63d3a632a27d","sha256":"1cdcf75a31d3aa45b11b430b61d00463f422109915d13e541f635f1fd40ac526","sha512":"c66c962737965b6228d40df702d0493a70ed44b02a35cd27cf55888b4dbad30ef0659e9fac8da12c160ec6287797296ffff7586a2cd344ea3a64b7110f04769e","ssdeep":"768:o6aHpt5yIekKDqO1CYKqZOJfUZjeq/Yqq4PsRPOnurztdPfl1FxQjQx2PNyEFEhq:ofH1IqO113CfUZlVqhpSuHvPd1FxdPkF","tlshash":"d933f24b1dca51ecc6909bbc8c5a2f63e9541b3e4e0b4c8cd066f90ad94fdb3b1154d6","first_seen":"2025-03-16T13:23:15.901963Z","last_seen":"2026-07-28T17:22:11.675056Z","times_seen":7,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/nvdaon_160x160-1.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.705Z","timestamp":1785255778705,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /nvdaon_160x160-1.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-222\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kaK7UoTDLTEa7E88LWm3%2BpbNVhTPIzxjuFwKfgCDBt2tMPGZ1EJkuzmh1wpxdmh5RJOvgeX9pvj1jpnvSpJRs0dyu2ifwiG8dNfZndNEbLqSFc5pHdClzwDQ%2F%2BbN8zJp8RGcZg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a22539c8ec7c0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 546\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":546,"size_decoded":1480,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"b0e4bace98394be28674406af92b8d63","sha1":"299e7d30b0af4c60dddb4022fd928a22f74b8e61","sha256":"05c622db08e0676f5ec25f5b184f4e47730c62fcdc2f05c6d78fcccb574dc863","sha512":"c84a37d76c3ab959a05efa2f59e6263a9f37416f5b11b46cd376f746dcea897bbb65b10c7c9e0a7e19465e2910cc0813bbfd15e59bf4e1dd661e85a53d19cce4","ssdeep":"","tlshash":"81f026d16a81096fe46b87f5316526b15de910744da1c50bed9400740d11b457a9df87","first_seen":"2026-05-13T13:15:53.127687Z","last_seen":"2026-07-28T17:22:11.672219Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.ondno.finance/spyon_160x160.png","fqdn":"app.ondno.finance","domain":"ondno.finance","tld":"finance"},"ip":{"addr":"104.21.32.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://app.ondno.finance/","date":"2026-07-28T16:22:58.747Z","timestamp":1785255778747,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondno.finance","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 22:58:36 GMT","end":"Mon, 19 Oct 2026 22:58:35 GMT"},"fingerprint":{"sha1":"79:43:76:0E:31:4A:75:C9:FE:3E:9B:64:2E:67:AE:1B:40:A9:55:55","sha256":"FA:46:A3:1E:C7:AF:6A:AE:B9:C3:2F:D5:92:16:F2:10:44:5E:7F:41:99:AB:8D:AF:FE:A4:1F:D3:46:F7:41:AE"}}},"request":{"raw":"GET /spyon_160x160.png HTTP/1.1\r\nHost: app.ondno.finance\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.ondno.finance/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 28 Jul 2026 16:22:58 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Thu, 26 Mar 2026 01:13:41 GMT\r\netag: \"69c48845-8c0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 76\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QAc6KjyRI%2F8jCeQS9aUUkoJfFHrlFar79bh5NdvGJVl6M0j3tH2ZKgpdvoA%2B0hvJmfcECrcU9M78p%2F91btNG736SaAuS3aBfGeUj%2Bc6N04lNvOltInF5BMSKOSicCNdQSCSDYQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a22539c92c8d0b59-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2240\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2240,"size_decoded":3177,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"dfe6a0a0e5f065ec80e869fb9d9ca356","sha1":"edda9ba0be99ca4a6580dde952e787fae3ca78c1","sha256":"99768cf3f86d87b886d239f8455b0bf364a8632721ef82d84b5720e339693a7c","sha512":"6fe2ac326fdd8acc61a7c7ab1eb2435598f2fbdf4f0708a8e6ef07db10bd8ecd5d02624021091173aed638df6e61af6aaa61c91f581fca20af8941ea78bcf60e","ssdeep":"","tlshash":"9f411953e39d3a78c6fc64fb212629596912c119a06e7f6fb06ac735027819f1118e60","first_seen":"2026-05-13T13:15:53.133798Z","last_seen":"2026-07-28T17:22:11.664646Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"app.ondno.finance","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}