{"report_id":"f4a19ce9-5273-4a27-8405-8beb97cd8f31","version":6,"status":"done","tags":[],"date":"2026-01-30T06:30:15Z","url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"172.67.133.36","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"title":"TOKEN_NAME | Airdrop","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"172.67.133.36","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-06T06:30:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"claim-lab.fun","ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-28","domain_rank":0,"first_seen":"2026-01-30T05:42:22.845013Z","last_seen":"2026-01-30T05:42:22.845013Z","alert_count":5,"request_count":5,"received_data":2579619,"sent_data":2375,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"53182466ddba072e5f6b8d0d9d655417","sha1":"e341cf575484a89d90092c574a1ce14b88ab0eab","sha256":"e0ade97da03808f7401f60d4b951ab082c52e18905d62bfca303e97a5da08b5b","sha512":"51b45218d568160f0cf2a51b920fd78266f8bbadb3332d84b242cbb9c1f7a31a6149e7f44ff96ad906f22020c559bf063b39164f036c8bdbc03b9506c5dea266","ssdeep":"","tlshash":"ef113826122632653c8eb0ee59b6dc4d7a7f100be90960a0b59ed08d7930b5544f76dc","size":957,"data":"","first_seen":"2023-03-07T13:09:46Z","last_seen":"2026-06-04T12:50:03.022623Z","times_seen":336,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/naive-ui.mobile.min.js","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d61b47938d37141b541c58e006d0693c","sha1":"d54e8ac2cb62970991f88315dcb7b630f49ec311","sha256":"bcdec0ba3ae264ac30ac566ad19ae82c8dd41c71c4e5b8e1ee69ea3092f2788d","sha512":"f8d0002618e059d912482c0daea5de2233dade10c286bec3c95fe36f6f905feedee690c0c6eee12e25bff6e6d2abf14e093a5ac0f5c523283f85ff7b3e9adc25","ssdeep":"6144:tZkrQJjkrQJuXJVchZ5mGGPX5ArGzwSVLzKB6:tP0GY5ArGzwSVLd","tlshash":"f28483893db1b31b8f91905fdc2b200d55d70815673abc9abfa1c185bc58db8e9e23e1","size":384765,"data":"","first_seen":"2026-01-26T07:37:30.029868Z","last_seen":"2026-02-10T19:25:28.886895Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2f0f1697364eabaa52f244549e9464c5","sha1":"0ce7c4e29c9ea7996f7e1efe4f88ba7b066cf12d","sha256":"fb5b067773c94f37ea879e3e6b08a82e58ecd9a900daa234caf945e2d1f8a427","sha512":"44321844cb7193c20f0f9c7160d9e73b3e1a4863fe87f6063a58d6351543bec38c9aa5e74b2b76881adb78f8e8356b1ce749a1d20bcb007b896621786aa1c6c8","ssdeep":"6144:nZkrQJDkrQJuXFvej9nxAlY69r5AVGzwSVb9+/z:nl9GlYC5AVGzwSVbi","tlshash":"728483493eb6b31b8f81901fdc2b210955d70c19673abceabeb1c151bc549b4e9e23e1","size":378118,"data":"","first_seen":"2026-01-26T07:37:30.041644Z","last_seen":"2026-02-10T19:25:28.899287Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ad1ecca7cee1b9c8249f2aba08d2977e","sha1":"38cc8ba74b6011fe9daa7d61d2956a26741c39d6","sha256":"c23b1aef1ddcb191a289e39711d6759a23aea97da55bbb53e1f4b14872cb074b","sha512":"0fe7ddaf50d374fcbc879b7e6b1488881565c0c958d32a8974d5f7a6577257d3891cb12eb68171798d108759b394d218066e6229d3160e2bad1c507b4a02be34","ssdeep":"","tlshash":"2151303e25b754334e4265e9efcb61613158a0837785e9853e0cc3d24fc6e12d863bca","size":2902,"data":"","first_seen":"2026-01-26T07:37:30.043885Z","last_seen":"2026-02-10T19:25:28.901098Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fstylus-loader.js%3Ft%3D29495909%26u%3D3xjVJBx0ew49W1MXGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMcqsoqivtrOqa3an6w","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","size":656642,"data":"","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-08-04T05:59:25.953933Z","times_seen":2650,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"claim-lab.fun/","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-30T06:29:50.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-lab.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 13:49:39 GMT","end":"Tue, 28 Apr 2026 14:46:52 GMT"},"fingerprint":{"sha1":"29:E2:E7:1F:CF:FA:30:08:2D:C3:DC:CC:68:F8:EE:9B:83:D7:99:6B","sha256":"C3:5E:B1:35:AA:C5:D8:2D:68:BF:28:1C:C3:31:B4:40:D2:52:60:AB:25:DB:11:87:84:F7:75:D9:BC:3E:32:36"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: claim-lab.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 30 Jan 2026 06:29:50 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 14:46:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cSnfhzO%2BE1k03ncG2RxVePWbmlmckXS1RCiR7oI3b9OHBwz8El6O7VU6dDWIGenscywGGD75NoAQNn1ky9jXMFYq2G5AcAV9oWXkCTI%3D\"}]}\r\nage: 2873\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c5eead0de54a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1532019,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (65452)","md5":"b3e5bcab93a4969dad7da085bc825a71","sha1":"9475f84fab09c94d0be6534ca3e14b48742ba398","sha256":"99b8ddd565a5e23e97e7c534f0c8fe2a336e5d60d127f85e12c5c5d58a66797e","sha512":"f6e00e6915140f7ea42667fb5dfa43542fae2102a1e35f83225144e2efaaa5e8674a78e55d6adc5f644dc9c72eb3175c4925314ba3ae1b41c7b530d70615e6de","ssdeep":"24576:ccQIXB+uhcQcYOU5cQIXBNFx+p/acQIXB1cQIXBsI:cQWQTOuXaAe","tlshash":"a82512212e67841778135a9d3bdb9f49bf2074438582f9aa37fd21808fc7ab55c63a1c","first_seen":"2026-01-27T15:26:59.514106Z","last_seen":"2026-02-10T19:25:28.888154Z","times_seen":29,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":69,"dns":56,"connect":1,"send":0,"wait":15,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/naive-ui.mobile.min.js","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim-lab.fun/","date":"2026-01-30T06:29:51.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-lab.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 13:49:39 GMT","end":"Tue, 28 Apr 2026 14:46:52 GMT"},"fingerprint":{"sha1":"29:E2:E7:1F:CF:FA:30:08:2D:C3:DC:CC:68:F8:EE:9B:83:D7:99:6B","sha256":"C3:5E:B1:35:AA:C5:D8:2D:68:BF:28:1C:C3:31:B4:40:D2:52:60:AB:25:DB:11:87:84:F7:75:D9:BC:3E:32:36"}}},"request":{"raw":"GET /naive-ui.mobile.min.js HTTP/1.1\r\nHost: claim-lab.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-lab.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:29:51 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 14:46:00 GMT\r\netag: W/\"697a2128-5defd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2872\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FKh1Jxj6VkDVyvWvQ3UTwT4y8EFFYeRKTWAAHUMZP%2FH2txqc%2BZ9F7UpvlobYt%2FCp1%2B4OAVElFNbXKD5M%2BIAwJfkZJ5zntfzilvxG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c5eead229675687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":384765,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65159)","md5":"d61b47938d37141b541c58e006d0693c","sha1":"d54e8ac2cb62970991f88315dcb7b630f49ec311","sha256":"bcdec0ba3ae264ac30ac566ad19ae82c8dd41c71c4e5b8e1ee69ea3092f2788d","sha512":"f8d0002618e059d912482c0daea5de2233dade10c286bec3c95fe36f6f905feedee690c0c6eee12e25bff6e6d2abf14e093a5ac0f5c523283f85ff7b3e9adc25","ssdeep":"6144:tZkrQJjkrQJuXJVchZ5mGGPX5ArGzwSVLzKB6:tP0GY5ArGzwSVLd","tlshash":"f28483893db1b31b8f91905fdc2b200d55d70815673abc9abfa1c185bc58db8e9e23e1","first_seen":"2026-01-26T07:37:30.029868Z","last_seen":"2026-02-10T19:25:28.886895Z","times_seen":30,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/secureproxy?e=ping_proxy","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim-lab.fun/","date":"2026-01-30T06:29:51.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-lab.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 13:49:39 GMT","end":"Tue, 28 Apr 2026 14:46:52 GMT"},"fingerprint":{"sha1":"29:E2:E7:1F:CF:FA:30:08:2D:C3:DC:CC:68:F8:EE:9B:83:D7:99:6B","sha256":"C3:5E:B1:35:AA:C5:D8:2D:68:BF:28:1C:C3:31:B4:40:D2:52:60:AB:25:DB:11:87:84:F7:75:D9:BC:3E:32:36"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: claim-lab.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim-lab.fun/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:29:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 2872\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nlast-modified: Fri, 30 Jan 2026 05:41:58 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mIsuxP5Q0x3r3KjYpgn9HBxXCuAfb%2BoGqcf4dvzdz%2F7bsh4JnvhEHv8VSfMAC12BjZALegtZ8YnKeL%2FShGT3Fvl0nOfEpONeRat0\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5eead4996e5687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-08-07T02:31:31.630366Z","times_seen":9011,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fstylus-loader.js%3Ft%3D29495909%26u%3D3xjVJBx0ew49W1MXGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMcqsoqivtrOqa3an6w","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim-lab.fun/","date":"2026-01-30T06:29:51.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-lab.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 13:49:39 GMT","end":"Tue, 28 Apr 2026 14:46:52 GMT"},"fingerprint":{"sha1":"29:E2:E7:1F:CF:FA:30:08:2D:C3:DC:CC:68:F8:EE:9B:83:D7:99:6B","sha256":"C3:5E:B1:35:AA:C5:D8:2D:68:BF:28:1C:C3:31:B4:40:D2:52:60:AB:25:DB:11:87:84:F7:75:D9:BC:3E:32:36"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fstylus-loader.js%3Ft%3D29495909%26u%3D3xjVJBx0ew49W1MXGDY5MjU2NDRhMjhjZmYzYzM0MDI3Y2YxMcqsoqivtrOqa3an6w HTTP/1.1\r\nHost: claim-lab.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-lab.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:29:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\nvary: Accept-Encoding\r\ncache-control: max-age=2592000, must-revalidate\r\netag: W/\"a0502-14+i6Bt7XM8ofHk8WpmFyqoPYWI\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=stylus-loader.js\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 01/30/2026 06:29:51\r\ncdn-edgestorageid: 883\r\ncdn-requestid: f657f9fa6673692786c5e173e13be7c8\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A7M7V6CWkTGHPo3Vij23KnhsIVITeX%2F8o1ENmEwDv4WHw%2B%2FMwyUX9%2B2rTvfhoLSHm%2BrMNdrQxjLav3iEsTyc%2FIUoQpr41LzXO9vs\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c5eead589725687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":656642,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-08-04T05:59:25.953933Z","times_seen":2650,"resource_available":true,"data":null}},"time_used":811,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":678,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-lab.fun//secureproxy?s=%2Fjmpd%2F","fqdn":"claim-lab.fun","domain":"claim-lab.fun","tld":"fun"},"ip":{"addr":"104.21.5.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim-lab.fun/","date":"2026-01-30T06:29:52.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-lab.fun","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 13:49:39 GMT","end":"Tue, 28 Apr 2026 14:46:52 GMT"},"fingerprint":{"sha1":"29:E2:E7:1F:CF:FA:30:08:2D:C3:DC:CC:68:F8:EE:9B:83:D7:99:6B","sha256":"C3:5E:B1:35:AA:C5:D8:2D:68:BF:28:1C:C3:31:B4:40:D2:52:60:AB:25:DB:11:87:84:F7:75:D9:BC:3E:32:36"}}},"request":{"raw":"POST //secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: claim-lab.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim-lab.fun/\r\ncontent-type: application/json\r\nContent-Length: 2196\r\nOrigin: https://claim-lab.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2196,"data":"{\"route\":\"8XUwkBv9vhPYfVpD1fxb7EC65sUXJdqr\",\"payload\":\"B33rUFpg92qyLHnzfJ3PDuVyZm2ZZDHJQDGUi1B4eC5XqgigPN9PvWxznLRJ3j95iujgHaGhuGuN3qn4bzvC3gE7yQHmxRVCYubdfQpLGbZG2wYbDjjeQo9Sf3fSuicWR3bWHCSQxQRk857wnuySfBXqvzmm4g969DvfwWbL5Tg54orfJkDwG5bVYPoZp6kWWjWcMmrxtKYbiKXnSN9NkDNL82inkLuTNe6qyXTUcLEKWM4VYXRdzuPvghzHXH9wstVSydgty9Syue34qke3xRZEbSV6Tzh6KG9UrGUDrfcGkxaNy7teyEpiahDiBykShoUhzLq9aJsUkKRhb9o4825D3sPLARaWbf2g9UjbWZ5DZQPaSoBr3JymLJ9fEcQjhmUr7C1PKVwna741T8j3gEcrK62k6UmFaK9iw5486RfcM5yubLNVdnAGQfk4KAwdB3AaemqeAho6C1DYFppc53G4mgiXGJzEt6sBQCTGBpsNHtT6prfwEe1huCU9iUQgGkBmmepuHs9JrUVemYLvRBz1kHoSLBSZ8GqPiaQgDJXG3cSHYa1WAd6V4s7JwjLzHFRLUpFB75wvWyAGoy74zR4XDBxWWEgqBaXt7nCdmGbeLcukvz3n1pk6xd5R7V7TdozqcwxR868VzQXFvG695aYeXveMqymehmthGeQt9KP181r31nEmuXDnRvPTM2iKT7Nu4rACdCESusEd5Fc852whtUuzqpbuHuzEFxP49cNRUwf57Kc3pdoZrBjrZpvevmJoRm3n7GNpWqv5cQC2LGozmDRYEdWh8AqPhSYVQChgvaJpzRTXphvNAPhcxwXkvEjvrLGRH8Cw818rh7GjZDBsT8FZxrmxnZzHw2mSy7TXUFSP9Pd6rdfebCnsV64hH8bHeMnfsnSoPfM15sVc6uBYCE2BVp5VC2StPKd5aevBDFNHuvQ3MvLp6YB4qYnGbbAXNnUHvVesPRTYAVaj8Cg382oN7ddiLH8redacGAkm9k3qjc6SFAQNNgt6WcbfaByRJDxkaV9RCiA2oQsvKC4gTMao57CKg2CeL49UBKbNwPA5bCuSAHrYiTuNMmHBGQskk2eVzstZeaUT6fitY7MEnnpJ3FXU9YaSCjaFPNfNLJe8shRjTW1eNowHbFsaT8mHT6qRAEb9cWNPQnSTxgx3Wq9E2F7XGwf7pFK8Qrb73R71Jj6VMLsyRrZCaf3hf3awBABA5sRvP8YhTaSny8o3eWVWVZ4eBfaGpUuzgX6QBj2soSLWvUZCmdi7REmxwTS6DmJMcBP4WwGb2pKHLGwMWLzXyaJRuvTejbqbra62mHo6ZLKskYzRtv8Tk4QZZufo4cN1VcJxKUxf4XRoeCuapYdmb8xXCqVwmbJdv61agYeDgKoGGgbsDdNe8Eiwnj1oFVxRQb7QbLGBdYm7sBzxKgXWNzQ3XHLtyuUBPdzgULWq1L9cvcYwga3qyAwgdz7rg5nfK4QyaiLAuzQHKffoMDByCv3U1ZGdKoYBQ9UmGe6SbccBHjgyv5yoLxTVdTmfAgedp9BtPP5W8wJbXgoStmdwjxLyNasA3Z3DSsehR2tfHZvecHwU6VXAqFWix9AhDnm6jcZRpFhxfhgz9G4crzkAgtsvY4MP2Jvc8gXzqNwQD1VnL4YPDgXcFMQaDBnSbKsSayxeCgRPGMTg1JcyFYBymZPRxgkdw2zrxWCb6Jbz6gxgFc7QbCGXSHcnCqcy2tXGCWehWeZzaewaUBGq9EHKXu3QK6CizTSQHiWV2XUcGNNXq2kNzCamy7pAxcRZRepbtzMDBiNU3eooYg3Brsq3oL6HduHr38tehXPdC51b2fX851nu8TXgaL62gRHWo28MtCkeDpreViAninfZB73qKDHoUvH5ygrKR6Gd5GpuKnNmU3r698kz3dw66ywT2ficRD8LUYGrQSPAFuVrfWW4DFCDaeveoiFMDHhaeUqAerY5yPoovLPx2c6BkQvWQNcTWHd51Nromstv1xYzgZf9SxzZK568Mp5HHKi699wx6gZNu3hG3C7SK4xPZaPhK9mkEZXvCfYL7DqkYRtcrnAcPxVmxpQVJtSWGxbmdVmZw1XWsWmsztCA2korQdjxsvmiKBpepCpe3fxkUYwNkgi\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:29:53 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"e1-NLTAv8oMwiP4psryVIVx11bQzvI\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1769754653039\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 01/30/2026 06:29:53\r\ncdn-edgestorageid: 879\r\ncdn-requestid: 63e606113d9a312179989a4aa80c334e\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h0O1kzYwlX30LBxel5jzOB93n6zO0bViFerIKkj5FNw5NbKgxiceHPmX5m05HC6DHI%2Bk%2BJwm3C7EuaUxoAR2hnTtvy%2F4LrdGzXgh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c5eeadcf9cd5687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":225,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8cfde0bdba8bda251b0148b45d1f02b6","sha1":"34b4c0bfca0cc223f8a6caf2548571d756d0cef2","sha256":"b7729e81007bcf16e9a73541ae007b5951f765a99da46fcb5d5a3266a888adc2","sha512":"847c9e5a0093133ba9f339bc5cadbd0432661e2d38079a4520ed74f8b3a78d4b762365ae6e363d7241962684bad5188b45cf5b56432bff8dcdfb7eb3e80d219d","ssdeep":"","tlshash":"edd02361cc63b7057115da5f33c98494c94074d3741e5dec83e6760d9552530310ed85","first_seen":"2026-01-30T06:30:21.853012Z","last_seen":"2026-01-30T06:30:21.853012Z","times_seen":1,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":530,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"claim-lab.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}