{"report_id":"0d4e1f79-bd36-4c8c-ba0f-a6692c0382bc","version":0,"status":"done","tags":[],"date":"2026-07-12T20:41:30Z","url":{"schema":"https","addr":"phoenix-farm.org/","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":0,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"phoenix-farm.org/","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"title":"Phoenix Farm | Руководство для фермеров","dom":{"size":272099,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30446)","md5":"19323dffafeb832033954110be8c5dd7","sha1":"3d5cb1c10a34ea4c362c1ebc4835bc96abc43142","sha256":"2cd72d862f2ac728372e518cfd55b821b0ee99f22debe9f78496e2a487cdfb4d","sha512":"53fb219324462766f77de77f759a2e8d89199fa27a772d70f74cb96bd226076c179fbff2882018023277cce6b7ae5e9e49cd8b4093e20b535bf952ed3502e8e0","ssdeep":"6144:Ly9F3RHleXCJxT76w0Tgdl0SYubBLrTCY5ZxlsGO:Ly9F3RHleXCJxTew0Tgdl0VubBLrTCY8","tlshash":"dc4423315149287b5203a8c6ed247b0f35eb82febf5b466095fc9b6e77d2ca0ca35148","dom_hash":"domhash949c68da098000a7f6536b9cea3e3a5d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"phoenix-farm.org/","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":0,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T20:41:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Public YARA rules","description":"Public InfoSec YARA rules","scan_date":"2026-07-12","alert":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","trigger":"phoenix-farm.org/assets/index-BFwUNqSn.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/bartblaze/Yara-rules","meta":{"author":"@bartblaze","category":"MALWARE","creation_date":"2020-05-01","description":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","fingerprint":"f16d06fc8f81dcae5727af12a84956fc7b3c2aab120d6f4eaac097f7452e71d4","first_imported":"2021-12-30","id":"5t73wrjJYkVLaE3Mn4a6sp","last_modified":"2022-11-04","reference":"https://github.com/stascorp/rdpwrap","rule":"RDPWrap","sharing":"TLP:WHITE","source":"BARTBLAZE","status":"RELEASED","version":"1.0"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"phoenix-farm.org","ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"domain_registered":"2026-07-07","domain_rank":0,"first_seen":"2026-07-10T09:52:28.034367Z","last_seen":"2026-07-10T09:52:28.034367Z","alert_count":70,"request_count":69,"received_data":5782864,"sent_data":35755,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-05T22:19:28.847206Z","alert_count":0,"request_count":8,"received_data":275512,"sent_data":4612,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-05T22:22:24.069932Z","alert_count":0,"request_count":1,"received_data":13319,"sent_data":536,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"phoenix-farm.org/assets/index-BFwUNqSn.js","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"924a2c36ea55d1c87edf0194b336bd2e","sha1":"fa9594a1a1a374efed73ace400691b423a7d69f6","sha256":"bb50d9829d2a6918c918b15a7970b9fe9812c35574087a548559dc1406cbd3fc","sha512":"2024562cd08c39084afea6934943b7037f5bd1ebe20a3e2977b0db1faf4f868b0898c3a26c2c3d42b520522677320ee221887f4f2cf3c19e6145f1d41a1e5ff2","ssdeep":"6144:7nOyvn1kdzmFhsEIjjj9bODP1/niCJnlOv0HRo6Y2M3PgkN5zGUW5M3X+syenTTi:7O3+shTTb5ZAkc8pq4Z450lwY78iWj","tlshash":"9ea42854e199b5ee6e1164cac41fa90e34af05be7f7e41b11078ac2e30f4055a23bbed","size":459459,"data":"","first_seen":"2026-07-10T09:52:41.399496Z","last_seen":"2026-07-12T20:41:39.999548Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Public YARA rules","description":"Public InfoSec YARA rules","scan_date":"2026-07-12","alert":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","trigger":"phoenix-farm.org/assets/index-BFwUNqSn.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/bartblaze/Yara-rules","meta":{"author":"@bartblaze","category":"MALWARE","creation_date":"2020-05-01","description":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","fingerprint":"f16d06fc8f81dcae5727af12a84956fc7b3c2aab120d6f4eaac097f7452e71d4","first_imported":"2021-12-30","id":"5t73wrjJYkVLaE3Mn4a6sp","last_modified":"2022-11-04","reference":"https://github.com/stascorp/rdpwrap","rule":"RDPWrap","sharing":"TLP:WHITE","source":"BARTBLAZE","status":"RELEASED","version":"1.0"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"phoenix-farm.org/srt/image-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.131Z","timestamp":1783888862131,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /srt/image-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 15676\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:56 GMT\r\netag: \"a5050227d4734bbc495fb345721ec691\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15676,"size_decoded":15923,"mime_type":"image/png","magic":"PNG image data, 359 x 389, 8-bit/color RGBA, non-interlaced","md5":"0fc36b3ea63d55919f88e36d1809a513","sha1":"5169a090453832c35dc5159d52a0cc8150d7527c","sha256":"939eb735e561230b784dd8012e84ab28d0e03d53ff3a13c0f827860cbc79c72f","sha512":"2db1a52d796090e81c64884f2675274ee23747f2b37a0a6540e2fc4624cf084d7475169ae58511a498f6f504893a8efe0ca386edc3d62f4e5c5a37557924ebd6","ssdeep":"384:+Gk3u0sEsiWbds6dsmk0eICc9bQTFxHNCA3t:fCussiUnsmk0ucG9","tlshash":"2a62bf40025e8e754a6efe3df7efa1e3269719cf65258948d8e2c29dc9125f500b811d","first_seen":"2026-07-10T09:52:41.35497Z","last_seen":"2026-07-12T20:41:39.97391Z","times_seen":2,"resource_available":false,"data":null}},"time_used":902,"timings":{"blocked":854,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-3.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.030Z","timestamp":1783888862030,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-3.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 23429\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:52 GMT\r\netag: \"070208833af5f09dd645c6941be16cd6\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":23429,"size_decoded":23676,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGBA, non-interlaced","md5":"1244949c8ca912c17db9ca3c5ceddb8b","sha1":"e0c357926d99cd5f77a5aae9ce294384ceee172f","sha256":"7e49fb5118a1ddd0d34b6889be4146ec6c59086ae8f24e501aa3c5e0d9b6cf18","sha512":"ecae79b11b805a338c893e6b2b89a0773544f632eda3a58e29e804d7db9aaba20c75ac72fb612ae540915f9359731e1721a6c66afc96ee2267b22eb7f9488149","ssdeep":"384:1ScUeh0jDki35wlHVofB+unpCilulASJLyoaTB2ccwKxN7WjRnPT5zn6OzMzXlPh:QsijDki35w9UBLpJHSJLyoGB2cnO7Wdy","tlshash":"b7b2ae4726d49f3d086de390514e8efb94f6db7060cb1acc442e2db8e465ee40967db1","first_seen":"2026-07-10T09:52:41.412128Z","last_seen":"2026-07-12T20:41:39.98087Z","times_seen":2,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":119,"dns":0,"connect":0,"send":0,"wait":49,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_profile.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.110Z","timestamp":1783888862110,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_profile.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 118947\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:08 GMT\r\netag: \"ea07a7825ae16ce60700efaddca55b8a\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":118947,"size_decoded":119195,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"fd001f922eba36c9443d01205550aeee","sha1":"c460fd595c5a93e9fa725f75d75ceca944fb3ca8","sha256":"977c3b357b9c7b7bc990d82c9530eea99463884d7a05a32db0ab63a10cba2f85","sha512":"2dfb3cf416f4234c35597860c9299642eb030c73a9238e1558e44272204fc6dbf54aad16e8b5ee159240c042e2bbb1906371d7ad49f746d19b46c1d978e0e1fc","ssdeep":"1536:cBfswevgUHVqQrigY5pXC1PI+g/v61DxGIZ3BkrQ389x6iYT11k9zIZj8YVNSt4q:qtevDHVqlgapS1PCa1sI5BYRO1yxhA/2","tlshash":"69c3f1129d0fa63def0784f06179dc9e9785eab8319049376fb652708c0a93e9df2360","first_seen":"2026-07-10T09:52:41.397289Z","last_seen":"2026-07-12T20:41:39.986707Z","times_seen":2,"resource_available":false,"data":null}},"time_used":931,"timings":{"blocked":546,"dns":0,"connect":0,"send":0,"wait":49,"receive":336,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/edit_profile.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.111Z","timestamp":1783888862111,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/edit_profile.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 180697\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:01 GMT\r\netag: \"aecc1d3981efa03f2890f3977b393b6b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180697,"size_decoded":180945,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"932c9ef9579f1053a918ad886837f4d5","sha1":"77b5d3b4705b778b1757f6c845fc4e8b2430c5a2","sha256":"36185e38995f5627e4a96760e5fba4f9a6602df5609e4221fe841ac8f7d82e77","sha512":"17c50a152ac188fce9d3f9b4e9bdd4d49be2b7f401849033a0edf5b23f99c3a6cd1eb237b3f804b34ee8a7b35ecce95055dbf0ed0aeadb89bd16e0f8dae1c96b","ssdeep":"3072:4RxKJGzq/wHDdd3sWe6ixY614UJXvbvb+Qe019XrUIWLYsHTzUfFPB:AxK4zqIf3Je3XdxXte0jXQhLYszzUZB","tlshash":"dd0402684c77e216cc9f15e24cdb9ea94727bb55ec94f13386f2c4886e09e8e901271b","first_seen":"2026-07-10T09:52:41.424814Z","last_seen":"2026-07-12T20:41:39.991563Z","times_seen":2,"resource_available":false,"data":null}},"time_used":736,"timings":{"blocked":569,"dns":0,"connect":0,"send":0,"wait":27,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-7.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.045Z","timestamp":1783888862045,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-7.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 16286\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:54 GMT\r\netag: \"25fd78cc38180ae3b301aa9c2ffe9861\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":16286,"size_decoded":16533,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGBA, non-interlaced","md5":"7194f4b3ff90868a4fcfe2f97265f398","sha1":"0d27d539b34238fe10d868d4deb692cf78cac4d8","sha256":"82bb6f1f20e72d96b3d16f091beedb9a79932e8ca66298d5677d8c4a95a26f62","sha512":"86226993de998a710378295fde04ba577facc5d49c3b774329784bc534eeac2f46bf777c086b1599d8609e88f08f374c777d718e99c3e4b6a4450aa6d9fbaab5","ssdeep":"384:1S7Ohds87clqdPP8OErVmrARM80R5V2olkXbb4Z2tLaOwRu:Q7kJ7OqdM3rIrAL0J/WvntLFb","tlshash":"7372d0f269210b51dddcbc14b706b0b6796a25b0c55dedabe0a3c6fe884375193f4304","first_seen":"2026-07-10T09:52:41.401024Z","last_seen":"2026-07-12T20:41:39.994794Z","times_seen":2,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/inventory_info_skin.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.115Z","timestamp":1783888862115,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/inventory_info_skin.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 159896\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:03 GMT\r\netag: \"5e57a570ee51f4f2b5cf48ffbe220875\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":159896,"size_decoded":160144,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"db5d0cd164b80ae085e372ec2e3415ea","sha1":"9fdd90147c6fac5d386f449d12bf24f2c7a659db","sha256":"2131b3a07b82cec9341e9309380e79af91aeceffce4e82f088fe56d592e53c58","sha512":"d3698a907afbea8bae7e63c59bcb4ba7b574250e8639cd75339755a382e5a8e7071b0156d192995ed697a23a91cfe1df69ebbe87c68fbc9b445b9178fa746f04","ssdeep":"3072:SWs+S39UlnRFn1XnLFHJ2ze/8GtE4oQ/11Ko7xhP6VVT:Nsf39SnT1XLFHJ2s57/1d/PQT","tlshash":"4df302afd922fe46dc4f5922e5b75b4900c25b4e1b21136a1627624d8fdffac192338c","first_seen":"2026-07-10T09:52:41.410866Z","last_seen":"2026-07-12T20:41:39.997212Z","times_seen":2,"resource_available":false,"data":null}},"time_used":733,"timings":{"blocked":637,"dns":0,"connect":0,"send":0,"wait":25,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.150Z","timestamp":1783888862150,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327140\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-13T13:18:03.385751Z","times_seen":233479,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":101,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/assets/index-BFwUNqSn.js","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.309Z","timestamp":1783888861309,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /assets/index-BFwUNqSn.js HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:01 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 459459\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:36 GMT\r\netag: \"ba67675c95c432fba7d0e491f9398158\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":459459,"size_decoded":459728,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42749)","md5":"924a2c36ea55d1c87edf0194b336bd2e","sha1":"fa9594a1a1a374efed73ace400691b423a7d69f6","sha256":"bb50d9829d2a6918c918b15a7970b9fe9812c35574087a548559dc1406cbd3fc","sha512":"2024562cd08c39084afea6934943b7037f5bd1ebe20a3e2977b0db1faf4f868b0898c3a26c2c3d42b520522677320ee221887f4f2cf3c19e6145f1d41a1e5ff2","ssdeep":"6144:7nOyvn1kdzmFhsEIjjj9bODP1/niCJnlOv0HRo6Y2M3PgkN5zGUW5M3X+syenTTi:7O3+shTTb5ZAkc8pq4Z450lwY78iWj","tlshash":"9ea42854e199b5ee6e1164cac41fa90e34af05be7f7e41b11078ac2e30f4055a23bbed","first_seen":"2026-07-10T09:52:41.399496Z","last_seen":"2026-07-12T20:41:39.999548Z","times_seen":2,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":139,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Public YARA rules","description":"Public InfoSec YARA rules","scan_date":"2026-07-12","alert":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","trigger":"phoenix-farm.org/assets/index-BFwUNqSn.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/bartblaze/Yara-rules","meta":{"author":"@bartblaze","category":"MALWARE","creation_date":"2020-05-01","description":"Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.","fingerprint":"f16d06fc8f81dcae5727af12a84956fc7b3c2aab120d6f4eaac097f7452e71d4","first_imported":"2021-12-30","id":"5t73wrjJYkVLaE3Mn4a6sp","last_modified":"2022-11-04","reference":"https://github.com/stascorp/rdpwrap","rule":"RDPWrap","sharing":"TLP:WHITE","source":"BARTBLAZE","status":"RELEASED","version":"1.0"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.094Z","timestamp":1783888862094,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 128296\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:47 GMT\r\netag: \"49a0ec2e76541d9471907e36e51f4223\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128296,"size_decoded":128544,"mime_type":"image/png","magic":"PNG image data, 640 x 394, 8-bit/color RGB, non-interlaced","md5":"280ca09c7cf578021275bb192de29fba","sha1":"21ba5ee4520adf1b54c249d5e575cf9ff655a0b4","sha256":"9adbc8ac0ca3245b7064c26c6da78fda392d681550f7d9affabba69fa2fb5971","sha512":"803b0e378c7f68644e8490c35ffa9e18969f3fa5399adbd6bdf2bb188941245009742209e3ef13bfbb9e3cef7b10699b8bdf3ef67631582dc843b2e7504a04e7","ssdeep":"1536:xKtFCt3KzGXxSIjkYM+VDQr8RGZwJRuUWkSyB6M9J0+fPaUByud9UBcWeNuNtCg5:xKmt3QqLVS6+b+8+XvyeINIgJv3r9c1I","tlshash":"66c312fcb6d874cf3aab8a31dbc37a3e54d46c1a2b4f383159a25511ea0a47c391cc45","first_seen":"2026-07-10T09:52:41.357434Z","last_seen":"2026-07-12T20:41:40.009037Z","times_seen":2,"resource_available":false,"data":null}},"time_used":520,"timings":{"blocked":446,"dns":0,"connect":0,"send":0,"wait":27,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-8.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.102Z","timestamp":1783888862102,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-8.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 25295\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:50 GMT\r\netag: \"7697e41f21a269f5f56c0caaf2f8b4cb\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25295,"size_decoded":25542,"mime_type":"image/png","magic":"PNG image data, 615 x 344, 8-bit/color RGBA, non-interlaced","md5":"a842c544d0cd79a1df6bc457c8ae8d68","sha1":"c1fa0d9cd514ae717045bd6ae4fdacd1f7e69bef","sha256":"5ea4186fbb0c8ef57adc2bd38eec044160f22bdd1bf66880a1a2109a0140906d","sha512":"6e020c416b2d8cb2e4f06ce2942b40e9ca4ed6e4cb139a5c04037e2479dfee781258b4fbb377783b5577aaf570ac785b4a620c2fef159c2e4428b3d423e12104","ssdeep":"768:vaXSXxikiADv9/WiSyPljdVbYYS5GSb42pxGLtPU:vnhikFWX8nYYOGX2WL+","tlshash":"f7b2d0bab2c5cc0ee65af1b3dd9b8d6d30b958a60256cf711d35b73245f0e318a19132","first_seen":"2026-07-10T09:52:41.370858Z","last_seen":"2026-07-12T20:41:40.012227Z","times_seen":2,"resource_available":false,"data":null}},"time_used":526,"timings":{"blocked":476,"dns":0,"connect":0,"send":0,"wait":28,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-5.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.103Z","timestamp":1783888862103,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-5.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 56848\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:49 GMT\r\netag: \"28022aebed7636ab5bf5786441c9b0c4\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":56848,"size_decoded":57095,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 300x700, components 3","md5":"4542ce08a422b0b84d254ad00186bfd6","sha1":"1fb7c118c360554becb162a0a31e2e0f252d5ece","sha256":"dfd2c32802e8d858d77941d05ee9d5bac59391b0f5173174ebfa42e70192528a","sha512":"a99bab85a0c8510428c334d53e9566b240226b4d13d3257779c86a6be689be3953a692129717a228ec8dd80d32a2d66259761d32b1001fc31c2fbc444e5f826b","ssdeep":"768:PX99aTc7qeLDWl1nhnKen/jIC4zRO8mqF3UbGmJ9gNXvAGZRQ7foCWUO4fG+dRq7:0cJ2l1hKSZqO8mZpIhvTDCrwAc","tlshash":"ae43f164c7927d65cc19b4349a903287ebedb600de386163b1326d386b4feba452f70d","first_seen":"2026-07-10T09:52:41.381467Z","last_seen":"2026-07-12T20:41:40.022446Z","times_seen":2,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":519,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-6.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.104Z","timestamp":1783888862104,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-6.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 227124\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:49 GMT\r\netag: \"8287c80dbf2e199756db57eb9abe2d60\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":227124,"size_decoded":227372,"mime_type":"image/png","magic":"PNG image data, 768 x 268, 8-bit/color RGB, non-interlaced","md5":"4926a836e32997f3939aecbbecacb6e9","sha1":"3387b0af13e335f11d528802b6fdabfb82fe9150","sha256":"d2f6f97fef6d063f25abbcfcbce11852800a526adc170166699c12c30eb6aae0","sha512":"02907b9e8afcd2a4520c63a31632bff1f8bcca569b963349e6a0a1497cb61b0b808beafd439cf975f7d3a6c7bc14362bc2136d2d63a6029748ef561b50861840","ssdeep":"6144:n02r7eMOs66pRSaFQn/19n69xRvnRXELevYPsUN:n02r75O0pRSaFQt1cVnaLeQs+","tlshash":"3f2423b9ab970bf09d4efc9e4be06c44a0b490b76df91e1bdf469212060cc159872ec6","first_seen":"2026-07-10T09:52:41.403515Z","last_seen":"2026-07-12T20:41:40.027188Z","times_seen":2,"resource_available":false,"data":null}},"time_used":639,"timings":{"blocked":521,"dns":0,"connect":0,"send":0,"wait":24,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.100Z","timestamp":1783888862100,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 56688\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:48 GMT\r\netag: \"2b78c826ba6beb3b3690c8fbaef422db\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":56688,"size_decoded":56935,"mime_type":"image/png","magic":"PNG image data, 591 x 275, 8-bit/color RGBA, non-interlaced","md5":"edf5229550ff0e6fbf3e0756cac9528a","sha1":"1b9a259032ac2030c3ff6ffa73a6e27a7b5c29b6","sha256":"221d94d14eeb72406945f2d3e367cc7469d9dde8495f8c9b244b25193494f4bc","sha512":"a668ae01c703854432fd2169f57beedf1bc4605ab6dc7e1d5c43246250b030fbaf60eec252f71e5e5832252e8953d016c4119bb30ca399fa2ef43dbe67b2c99b","ssdeep":"1536:MmfXMmeVRrSYEoJQNqANAtFWGjdCvxkCFsb:EolAKXxab","tlshash":"0c43f1f8f666a2411c18c5b5e6b159733ff2742a3ab7135dc2c235322b311899e419ef","first_seen":"2026-07-10T09:52:41.379757Z","last_seen":"2026-07-12T20:41:40.030624Z","times_seen":2,"resource_available":false,"data":null}},"time_used":521,"timings":{"blocked":472,"dns":0,"connect":0,"send":0,"wait":25,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-10.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.105Z","timestamp":1783888862105,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-10.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 30726\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:47 GMT\r\netag: \"2b153a1301c5116b3af66080f4263b66\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30726,"size_decoded":30973,"mime_type":"image/png","magic":"PNG image data, 350 x 219, 8-bit/color RGBA, non-interlaced","md5":"549764dd282dab0aa667c8de7ce5e569","sha1":"fc4d01d9d36d68a9d4974c8eed8ecf4075140162","sha256":"4576e060db5bcb3f5b20545e709363786eafa5b7123d2b8cf5f170d1e72493cb","sha512":"3dbe4815cf9b5a6f85c89450c6436b73f08622e87ca68f51581ef5b83932a526148ad5e349fca0dc9326f9512db06985f529555aea8d15cbbb9924f30824e2e3","ssdeep":"384:QntznoSBgtnRUS0OovEsXt00KFjF/poRW3w643c6f7fPoi85YN7imhfurM5U43:QIRRUSdo/deDpoAP4sSy1Wkg1","tlshash":"02d2d1bda9d39e42ac70214779390e11ea75fabae053a3b41385cdbc9f703b14149781","first_seen":"2026-07-10T09:52:41.420057Z","last_seen":"2026-07-12T20:41:40.034706Z","times_seen":2,"resource_available":false,"data":null}},"time_used":570,"timings":{"blocked":523,"dns":0,"connect":0,"send":0,"wait":24,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_trade_sender.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.117Z","timestamp":1783888862117,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_trade_sender.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 100221\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:07 GMT\r\netag: \"412cb662409b087f2aa89845d9c26b8d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100221,"size_decoded":100469,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"df2f3e1bc6952a299ecf79b5deb8ae90","sha1":"f8c1b0c77db576b159f6ca8a3a6131c642041f86","sha256":"9b2340baffa5509d30390881d216987ca1d88f4c529d0d75936befdbf76e2dac","sha512":"0d48a99d3db5bde7151f9396234ee38be805597d9414a1a1478b7b5cdd0281341e4d6ca64f4874724b7bb3f023c96cef0fec15b03c51a9df455ba15e11c5ced2","ssdeep":"1536:6BHuRYEhPrS7R/4S0xMeMP6OvyCE9T36Ot7vs5NXNzF55KtgfSNsVxVsDYxP:sHuR1r6RgS69MCBCujt7k5NHKtgusHz5","tlshash":"ffa3e187d71fa732fe1ec838a4f74e4b4eb515095e607829b23ce16cc405198be56e2e","first_seen":"2026-07-10T09:52:41.37413Z","last_seen":"2026-07-12T20:41:40.040079Z","times_seen":2,"resource_available":false,"data":null}},"time_used":715,"timings":{"blocked":666,"dns":0,"connect":0,"send":0,"wait":26,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-6.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.043Z","timestamp":1783888862043,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-6.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 15648\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:53 GMT\r\netag: \"e3ceb33195d5429494e856bf4a267d8f\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15648,"size_decoded":15895,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGBA, non-interlaced","md5":"551f2a4daf4784e7317723757f2ca409","sha1":"eb2616b0cfbe4d2631735e2bfac05d760d7ad90a","sha256":"34b31ae7226638afb84550ec00d16aa5dcfe067637d528a42fef81d195bbc177","sha512":"bfe8e127ca0689c7fbaa37f9e08a7365c81404f732dd0ab8aa01bcb70244a4bc6b65733862b40981485d11b40b6e4624e0e7ac8634b16e0b1d7c56c63fed949c","ssdeep":"384:1Ss4yp5OnMStxk3vido7IYwvOrR6HqxATqJx0Tei:QY3aKvido7IJviR6HuATqJOTZ","tlshash":"3d62bf938b837a0059d6245bd3467bb57a4123f26047ddcd787b88aaceaf21014499c7","first_seen":"2026-07-10T09:52:41.423114Z","last_seen":"2026-07-12T20:41:40.042909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":104,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-15.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.081Z","timestamp":1783888862081,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-15.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 61164\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:39 GMT\r\netag: \"9b062a02271946c87135332a085cecc3\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":61164,"size_decoded":61411,"mime_type":"image/png","magic":"PNG image data, 781 x 375, 8-bit/color RGB, non-interlaced","md5":"afa580a98c4eda083110de4372689541","sha1":"0809cf25297dfd2363f83212539b0d5ed6282379","sha256":"cb15f582ed468d8b6130871a984e32593d77ab6de383d8454fda1c356c9c57b9","sha512":"86c39326f8fc0da73a76b7f04aceba46683c86266b384ee88ea14192c08668fb11bea1227bf2e07522a054e5948e381e0d5440205cf9aba252856cb1b0f3ffb0","ssdeep":"768:eLZwNTcScRbi86SbtTo6hheqVQSgeL13N80f7k9VAkgVskO6qCXnbJzYhvrhLM2F:eLZYwrRbicPdSkE2nZmv1bZAw","tlshash":"b7530216c527ce424f2e1f28281b41f665739d8a4bb0b425b9be58ce69f0e51321fe63","first_seen":"2026-07-10T09:52:41.43826Z","last_seen":"2026-07-12T20:41:40.048458Z","times_seen":2,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":358,"dns":0,"connect":0,"send":0,"wait":26,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-18.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.085Z","timestamp":1783888862085,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-18.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 28859\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:41 GMT\r\netag: \"5131a3779e60448cf7f9f09ae32b6598\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28859,"size_decoded":29106,"mime_type":"image/png","magic":"PNG image data, 309 x 201, 8-bit/color RGB, non-interlaced","md5":"74f69eba9c51c9bfc076c9c57c447741","sha1":"c396dfb6b275d58964d3b26e3e0a8449b2b4bd2d","sha256":"bfc610aff72493b6764b9ccff91ccb2b7dcb0639ea8955911489fd98e3584eba","sha512":"deff27f196bd6abb84f08cea415077397b86f2f8ee5a08299cb250ed8ba40f7a9aad2d78686ca534677f047aa2013c846f38ff7dd4779c0fcbd0e7b5983f0ed9","ssdeep":"768:xqsi8oeOM8p0yq+KsWHdwf63jk5u66NozC1v5/K3HwJ/5:QrzeOHpBBKJ9wqo5uPWz2AQ/5","tlshash":"97d2e0c742f65c650c7cb2581f443a2a95ef6206f43892422b964ace5dd016fbd86bcb","first_seen":"2026-07-10T09:52:41.409166Z","last_seen":"2026-07-12T20:41:40.052611Z","times_seen":2,"resource_available":false,"data":null}},"time_used":434,"timings":{"blocked":409,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/2x2/image-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.090Z","timestamp":1783888862090,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /2x2/image-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 32608\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:33 GMT\r\netag: \"ec3a3f2e5805b0d3d56b8eb432a2550d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32608,"size_decoded":32855,"mime_type":"image/png","magic":"PNG image data, 725 x 426, 8-bit/color RGBA, non-interlaced","md5":"74df3bc882928f03b4293c5bde59129b","sha1":"c4812f05ef97c33807b5d8c233500a8de8ad2bd8","sha256":"107b0155f58f79798079459ca162b92e950896c797b381bb08540159305e73b3","sha512":"cd694316a598c3b102e78afca25bc84e474244ef65a20f89e2a5324d0be474e435d05fa40593be13a3f28e168b491c2738f8216b54524b0eb7118cb0b866c22b","ssdeep":"768:Aq64vJG53AO5qWL+4sHYvk/BSlHhxvKtxsaBwtuwJA6W:AqjGdIHBS1mbs0wMwJTW","tlshash":"4ce2d0255133d26e2f0e048e4ad62934b5939d213ada4cb47e4c5e4ae45f3c7bed832e","first_seen":"2026-07-10T09:52:41.362477Z","last_seen":"2026-07-12T20:41:40.05598Z","times_seen":2,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":421,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/inventory_sell_all.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.116Z","timestamp":1783888862116,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/inventory_sell_all.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 112637\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:03 GMT\r\netag: \"7dfbca8eda843ec688816c8c67c476d3\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":112637,"size_decoded":112885,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"d84c3667e9c618a6e4071459383de699","sha1":"4e9ac8519e7f290cd13a0a9f85cd5567c55c03bd","sha256":"4a34a1f2430fd13fb218f4c184467088585d9f1f928e950a4cdcf8b2b9b12f53","sha512":"f8c95f44057f855824da9d3e110ca915b8df52f8b5854c0777ef3c964d5fba3089bbb5db1230901bf5fd42cb75ccecc6cf85f85942172fc5de8cceeb6109eb3c","ssdeep":"1536:AQNPy0jqRek3aMxdqcFgu+1DmKeIXlJwBHjsl57+/3wrkKIGb3hUXhEF+gVqv6F3:xJyNIA9gmKFY2l57OwrbIG1URZaqs3","tlshash":"79b3f1d58a32ce918caf3438a2698f07c447129b68fe1779c24dc47d978fcb6d229a05","first_seen":"2026-07-10T09:52:41.371864Z","last_seen":"2026-07-12T20:41:40.05768Z","times_seen":2,"resource_available":false,"data":null}},"time_used":854,"timings":{"blocked":639,"dns":0,"connect":0,"send":0,"wait":71,"receive":144,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/trade_sender_done_page.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.119Z","timestamp":1783888862119,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/trade_sender_done_page.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 129895\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:09 GMT\r\netag: \"4553b7413849a8a9c8adfdc9ebfa05ba\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":129895,"size_decoded":130143,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"d55a6c89dcf48268ad064c9d396eec00","sha1":"d406db668b8e9e1253e9b55c518a313c1bb895ff","sha256":"bd677f101d945b99f0f1aefedb39efc2f8a8e70308a8dbb9b6ace8423fc068dc","sha512":"5771fafce24dc4e6dd1ca2afea062550ee76de47f735ea7f4acf5d5ec1ddf40ef5d604ee78a65e16409abf62c098724660e3a2f4e86d759855b526ed43b5435d","ssdeep":"3072:YbzkCDtWk0ycKHi63FkkFGnk7FKjGkUDOV/6+3PsROu:YbQyWkxZQkAjGkUWZPsRj","tlshash":"acc3129a033bc33cee1be8d6af7891df6a04690e34572133f5b31568d8026bd76611e5","first_seen":"2026-07-10T09:52:41.354023Z","last_seen":"2026-07-12T20:41:40.060388Z","times_seen":2,"resource_available":false,"data":null}},"time_used":806,"timings":{"blocked":733,"dns":0,"connect":0,"send":0,"wait":26,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.148Z","timestamp":1783888862148,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327140\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-13T13:18:03.385751Z","times_seen":233479,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":93,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.027Z","timestamp":1783888862027,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 16780\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:51 GMT\r\netag: \"c29df8ba824cf80a921854a58bbbd7f2\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":16780,"size_decoded":17027,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGB, non-interlaced","md5":"47e7869cbeadf2c998df5256a86d4dad","sha1":"7052be23ec99e969764f89cc0503bfd7fe3f57b0","sha256":"a6b974ed0e00fa365b5d8725a840761fbcb6c2b1381d21e1b7b23a477480bdd9","sha512":"209b944c1ca69a1770881d83d5962f1591e09ffdda90db6ca00cf6b7081d10ef6894e850dc95852cc666adf684ea411fd3e62f489e8abf8d0c7853441886e72c","ssdeep":"384:1rTkjr8EgRasF9KlFeMJo9xS4eSDmGFh+SxtL6pwORBy8wvXx:xA/q9WFAxS5DAh+SxtqwvB","tlshash":"5472cf5642854e3eb16ce2416a111e84f973775c30bcd1eb0ed8f9c94907e6edcc2ad8","first_seen":"2026-07-10T09:52:41.407858Z","last_seen":"2026-07-12T20:41:40.06226Z","times_seen":2,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":98,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-10.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.072Z","timestamp":1783888862072,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-10.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 31830\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:38 GMT\r\netag: \"4778eb7ce3f3ab709417424c4f7abc68\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":31830,"size_decoded":32077,"mime_type":"image/png","magic":"PNG image data, 203 x 136, 8-bit/color RGBA, non-interlaced","md5":"b14028cfeb8ade1b60c1af86e4f4c85c","sha1":"ce4680f6075736c8067cc1a3201a3d66994a207f","sha256":"95f8983852de7d7b04247faf42da6c861237e684daf986e66203960b4a55927e","sha512":"70d74fc6b42dbea99b57e788def868888183678654c2d42d3a4ee9b9c25a02d9edbd11dfed9ec990d95aa695e2914986c95668750193e155e616c26d86ddfdf9","ssdeep":"768:Y68ThHzieQZw/wqFiMqSX0a1QmQb70HX6byI5hhW6z4QU2tGdi:Elz3oqFMSX0cdQbAHX6bZ7hW6zvU2odi","tlshash":"c5e2f1c3a6339f07ff19ac6a1cee5a78b41cbd3275c9f601626671d0854b6083d0a127","first_seen":"2026-07-10T09:52:41.363347Z","last_seen":"2026-07-12T20:41:40.064849Z","times_seen":2,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":284,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-19.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.088Z","timestamp":1783888862088,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-19.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 69027\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:40 GMT\r\netag: \"166a75a9083e05cc8bd0c5400699ef04\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":69027,"size_decoded":69274,"mime_type":"image/png","magic":"PNG image data, 352 x 335, 8-bit/color RGBA, non-interlaced","md5":"fb7ad7a559227588f10cd8ab3b3cacd7","sha1":"a567b7088f5c34f01309b84454913ceedf86ef16","sha256":"bfd8d6aeaf422d426c7d5c967882e7ee0887d8bb40da15a23bd542d8c0e8499b","sha512":"22d5aa70e1b4b2b9f9142c50a887ee954e04b3c74368a0dfb98ab0f3135a2f4307076fa592f88138f85af951a9a9f9785e362943214b189855a84991079bec58","ssdeep":"1536:cWc4QivPsfZbDIRf54ZYFdKnZtQbYdcYNyZQRExwwJDuwyiJBggPt:cWHFvP8bDIRGYFsZtQIcYuQiqwJzPBg6","tlshash":"9663023686ec1a02134fc049f5131d69b5405ec5bf9da79a9b81c62c0fd85a3bdaf2b2","first_seen":"2026-07-10T09:52:41.361483Z","last_seen":"2026-07-12T20:41:40.066958Z","times_seen":2,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":401,"dns":0,"connect":0,"send":0,"wait":24,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/import_account.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.108Z","timestamp":1783888862108,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/import_account.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 65835\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:01 GMT\r\netag: \"09d8969505bfdffa88e25cd30da55ae6\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65835,"size_decoded":66082,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"7ea619620e81b59e71e36ddebe667737","sha1":"35d917ebc385e8e8ea468638598d2c00a0a345ba","sha256":"a6f2cec7566284bf094f3ab29cca76ba0b5b5226c49ce95f8888f02efb7823d6","sha512":"91812f869f33010c544181c5d72c7568c1a838e0f80782959bd519d63c62daffa5fe9e84b3f609b29d4a7c797e448c1e1d37a9804dfbbccdac0ff85155bb29c0","ssdeep":"1536:TjOo2QdKZ1pyrtvHFMOS5PNAQbNp+4K62H:3AQ61pydHEljbNp+/","tlshash":"c953e00ae30b80a0dc59b6fffa810a2f294cd61cb38b6177177191a5e80ef845f6957d","first_seen":"2026-07-10T09:52:41.385432Z","last_seen":"2026-07-12T20:41:40.06824Z","times_seen":2,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":544,"dns":0,"connect":0,"send":0,"wait":27,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/contract_done_craft.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.123Z","timestamp":1783888862123,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/contract_done_craft.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 91874\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:01 GMT\r\netag: \"d25653e3d53f5a0a5a487783e4c288ef\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91874,"size_decoded":92121,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"72459dfebfe25a7935a0257d4124be62","sha1":"fef37b26562cc0ff81803543049eeb67aa009dd2","sha256":"9a765b9799e0de299e21567cd465374f6cd67060d51ff3f90a44afec4229126e","sha512":"bc042fdcfc2b3b67b138daa1401e552dbd51610f1729280392759cb480b44439c7dad7d536a95a36b0af83ec9dcab347b75f950f7861c6e1821e08f241c72fed","ssdeep":"1536:YYtw378GvUdCwKE8wgPStx9nB0PKU0tBZEIWITvUu4omGtLFbSf0XkS9TndfK8mu:Y648Gv4oEYPStxNB0PumIWuvkomGtk0H","tlshash":"0d93f18fb2a967749892c2bac436bd07425582e56db920f11872d23cdb7d51bb73cb30","first_seen":"2026-07-10T09:52:41.376022Z","last_seen":"2026-07-12T20:41:40.069387Z","times_seen":2,"resource_available":false,"data":null}},"time_used":813,"timings":{"blocked":763,"dns":0,"connect":0,"send":0,"wait":26,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.156Z","timestamp":1783888862156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 10 Jul 2026 18:22:21 GMT\r\nexpires: Sat, 10 Jul 2027 18:22:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 181121\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-13T13:40:37.68665Z","times_seen":10721,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":58,"dns":0,"connect":0,"send":0,"wait":46,"receive":78,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/assets/index-Fykeba7p.css","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.313Z","timestamp":1783888861313,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /assets/index-Fykeba7p.css HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:01 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 82226\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:36 GMT\r\netag: \"e7fa1970bc4f23b62e4714d4b8230091\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":82226,"size_decoded":82487,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a02cb0c7bd0aaf0ffc11126049c42a46","sha1":"0abc61ea2a2132b07188ce25d574ec7d8fa7313b","sha256":"bd14d7c0786768c09ad8c52c65f9137a318a7fffeb92709dd74ceaa3151f979f","sha512":"34e6e40a0031c20fe7c0762e12b4fd02aa6c984df2b159282b362595c6d0383dab588ffb4c16a7e3b17d303499e31d45b25044b475bee35a68e040723f34604e","ssdeep":"768:jdLIQLb7XQm4mTpSESrFWLTPPOlBKAbZcXhOolK7J40WwoRceNeZA2nKfWpW4jLt:j9b7XJTgthKL18eP2BHTJdJ","tlshash":"ed839431a2a9213db533e59579d0abcfb064d003e6330bacf992b175c6c72e71a72749","first_seen":"2026-07-10T09:52:41.433225Z","last_seen":"2026-07-12T20:41:40.071462Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":48,"receive":23,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steam/image-3.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.004Z","timestamp":1783888862004,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steam/image-3.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 65426\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:59 GMT\r\netag: \"0aa0f1cda3e638f774731a4091caacd4\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":65426,"size_decoded":65673,"mime_type":"image/png","magic":"PNG image data, 771 x 731, 8-bit/color RGBA, non-interlaced","md5":"4129cb37a2b4419e412e011b56531f48","sha1":"a4a071a6a75e57798ddc7228226eb772fcd93e54","sha256":"f2a9589e18b8bfd67e70c821dea445cdde64166a29934c5f0d348ed6d55c4576","sha512":"df702f36ffcee432291b2f8e6574f4963b8cf2cab58ae9704f45e62c914748e2cbda8643f9fcb5d42d6ae8dc21479720f8b505bd77be0950ea4cc743b237a442","ssdeep":"1536:a83g9wPmmmO8rDVpRBnbeMPmmmg4HQtynBgYAaF:a83hPmmmO4DVpmmmg4HQMBgYf","tlshash":"7953c0eb59828cdfc92f16b89158df6973320d5711a00ab74236e2f2ff934e5a416c72","first_seen":"2026-07-10T09:52:41.389006Z","last_seen":"2026-07-12T20:41:40.07254Z","times_seen":2,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":24,"send":0,"wait":103,"receive":47,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-4.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.062Z","timestamp":1783888862062,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-4.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 4002\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:41 GMT\r\netag: \"93482c62f37e57ffd3f43242bdeb734d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":4002,"size_decoded":4248,"mime_type":"image/png","magic":"PNG image data, 223 x 90, 8-bit/color RGBA, non-interlaced","md5":"2df1e9435531d5e2ea4d41b1ff196a03","sha1":"6c01dffbc268f024dfb30ae866640c7e2690861f","sha256":"21e21fdbf0945319baa33815f42cedd3cfeb17def8efbb83186b5f15330f981e","sha512":"183a0f158696295ac3870ef36c657d18ccaf5075ff23e76ad7e3111a4b0e3dc5b309532468f4348ceafd612b2babe541082cbb6bf57f8d6a41cbe7b6eca26d11","ssdeep":"","tlshash":"f1818d10a8eccb155aa5b420cd717197f0ba4cf974d410b7c668cab4e0ca2457a73b03","first_seen":"2026-07-10T09:52:41.369742Z","last_seen":"2026-07-12T20:41:40.073661Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":185,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-7.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.067Z","timestamp":1783888862067,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-7.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 74068\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:43 GMT\r\netag: \"cbfad629d8cb73c874a73f4539c7ce48\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74068,"size_decoded":74315,"mime_type":"image/png","magic":"PNG image data, 829 x 122, 8-bit/color RGB, non-interlaced","md5":"ab77c9ff40cc543b4fb6dda533b3d04c","sha1":"8fc66749c2fc4c11baeb09d9341e9759257f215b","sha256":"a70e2e4bab324564ddb69d50c6a531354c3d459b419ed98f9494bd3cf19e2014","sha512":"fdc0a08d88a862afe02d00bb8ae09c0584659d84accf1938ca856da431ae47bb1eb0b4616f954693e38bd90e29a49399e3d16060288e900ba83722aab9015a96","ssdeep":"1536:LUIXxzBhHCAOlDx+A67RMAnYcnviLzqqj2FL5TGclpSB9Nw/hccrU:LUIXJTCAOBx/679Ycnafjj2FL5flEBki","tlshash":"dc7302eb6309d57d5c0a850005c4e933f1135b86c11bfe16b5ae661bb4fa36cfe6ca12","first_seen":"2026-07-10T09:52:41.35202Z","last_seen":"2026-07-12T20:41:40.075048Z","times_seen":2,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":212,"dns":0,"connect":0,"send":0,"wait":24,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-8.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.069Z","timestamp":1783888862069,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-8.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 109717\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:43 GMT\r\netag: \"f3c4e816d756a8757907702b0c1fb822\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":109717,"size_decoded":109965,"mime_type":"image/png","magic":"PNG image data, 347 x 453, 8-bit/color RGBA, non-interlaced","md5":"760027274a326c14635dd415a1943458","sha1":"0539cb3648cbccb64f461a05ca4ed5b33d7b67b8","sha256":"8150a28de5858179e9b476e7ebe1cc354abe77460e90ec3cd2ac825534ab9df9","sha512":"c39552e8d1a082050180fb583389be1b9e8093a845a915bf5d88ba99f21bebc6baf98a349d1acf411615ad75d48af81d79f4412d84296acece0c71b795f9f294","ssdeep":"3072:/y4A9smuRRWCeRr+TKT230ZrKbdJj3hsGgEJC8GWZBulFHU:/yH68RaTKT230ZOb3bg+PLUlF0","tlshash":"fdb312fa0a5a1a3b30cb08be641ddff755fbab71909750854040ae5b98cfa3c3642de5","first_seen":"2026-07-10T09:52:41.435257Z","last_seen":"2026-07-12T20:41:40.07636Z","times_seen":2,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":246,"dns":0,"connect":0,"send":0,"wait":26,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-9.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.071Z","timestamp":1783888862071,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-9.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 4237\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:44 GMT\r\netag: \"68bff7fafea006dacd4d5d222b51022b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":4237,"size_decoded":4483,"mime_type":"image/png","magic":"PNG image data, 105 x 21, 8-bit/color RGBA, non-interlaced","md5":"6a86309ab1128cc454385929d1ce87cb","sha1":"f4eb13970802c272c110067e4e8313554c39a5b2","sha256":"df723eb4d620a74616aad355afa821ead95302b8604310446a843219cc87ad42","sha512":"084c7cb8e1042763b78f1cf1cc90b102785d47765b680ab674e35bb3b8c94654e873fcfbe89cc6f396af054649fc6a8eb337891f1d91eeb8bd8a15c01fc57b7e","ssdeep":"96:rSWZGrfuzkmy4/eepCnY6A5RtVJ/yb8RgTR16:vCHm9GepKW5Rt3/rRge","tlshash":"9c916dc76c1053aa80b8bdc6dd4590a2e84b8b4c2df57d36a607ca9f38c1e01dec2f20","first_seen":"2026-07-10T09:52:41.436315Z","last_seen":"2026-07-12T20:41:40.07769Z","times_seen":2,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":260,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_game_adder.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.127Z","timestamp":1783888862127,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_game_adder.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 79463\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:06 GMT\r\netag: \"51f3de226c416692745b9ea58a1ccfd7\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":79463,"size_decoded":79710,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"99bd15e7cbbdf7946dd5ee37c85728b9","sha1":"8ea45bd5bd677ac9a8c49e80c88fe6467fd9d894","sha256":"93b7a802a40c9a55eb4ba1847b4e3a734f3bafbd915d80ad99578cc504557db4","sha512":"a418c508087642964bcfa1cb956ea64973dbeb405534f0bcc0fd3fcfe3f98bb81dafe44ab539deea154ed6258d17f9cc8d2c2fd94558deaa8a6d339613a0a612","ssdeep":"1536:k7yRHKiuaKWuPF4l5BS6wZyHpGCxrnlR3X:4yRqiHFUI5BSPQR7n","tlshash":"5b73e063ca9fe0aacd3e08b55cd83b89e5710600fad6c53b8673196cd35550bbb23653","first_seen":"2026-07-10T09:52:41.365507Z","last_seen":"2026-07-12T20:41:40.07888Z","times_seen":2,"resource_available":false,"data":null}},"time_used":839,"timings":{"blocked":813,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.144Z","timestamp":1783888862144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327140\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-13T13:18:03.385751Z","times_seen":233479,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":22,"connect":56,"send":0,"wait":45,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steam/image-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.996Z","timestamp":1783888861996,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steam/image-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 94200\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:58 GMT\r\netag: \"30e617ed38cf19b91f9fb6c3f8a9d74f\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":94200,"size_decoded":94447,"mime_type":"image/png","magic":"PNG image data, 802 x 444, 8-bit/color RGBA, non-interlaced","md5":"87d2b3d1b85fd70065adbe4e62dbcfc1","sha1":"b1b27eb378ff51199aad113d76a2549d1d7d65f3","sha256":"2829d817042a3110f875d82e6c50b1cfa8ef285a784e32cd9d0138ef4e953aae","sha512":"c95d4b8ec2310fd9b70d224b8b608aaa9c8d017cd92fba4671abe1e84715dea68f0a5b74992b4405596d095ea827894bf0586270fab8f40620ce007fcba34c48","ssdeep":"1536:KjlvTuAh4Ctb2+cdEoIF/wCmBsFWRTiNpFZ1JmJ1eWgKniDwKfFpU+yabmz3i6Oh:EpT5njtF/wR2NpvO1erKiDjMabmzYTy0","tlshash":"8893f209fbe77673b119918d065ad4daef8fc10ace073e0a4dc0199b45694e3d27b82b","first_seen":"2026-07-10T09:52:41.406384Z","last_seen":"2026-07-12T20:41:40.080855Z","times_seen":2,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":61,"receive":358,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.022Z","timestamp":1783888862022,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 12371\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:51 GMT\r\netag: \"664265a23e703c29a1a8f35208abb564\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":12371,"size_decoded":12618,"mime_type":"image/png","magic":"PNG image data, 390 x 284, 8-bit/color RGB, non-interlaced","md5":"e0414f5e0e67c45f05d3d9c4514282bc","sha1":"a47423513d50f19c0fdc518cbef85ab95e8954f5","sha256":"639fe30c3cc4119a9fecaa79a8e5fdfc6080c5ddb8a8777f42786b2ac1a42f3a","sha512":"e715df4ac9ba64837573d48affc60dcd3858f517a5fdf5e340b4652904db42b5c948a9df8ab02789ca2f2473554d11fbdce97e962d3180ab75d82dbfa3805e69","ssdeep":"384:0Tvna8ex6JjK1lqdcfhAQQMPQrA1MGbXYfD:0znazOjK1cu+qPkA13XI","tlshash":"c842affa29bc1dd7bb87e4ce652b3c1cc3aa51eb199811009e9520ce6c7245e9f74c89","first_seen":"2026-07-10T09:52:41.350537Z","last_seen":"2026-07-12T20:41:40.08242Z","times_seen":2,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":76,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-8.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.052Z","timestamp":1783888862052,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-8.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 20326\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:55 GMT\r\netag: \"46bfe45dcd253ceb20024fbfdeba18e0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20326,"size_decoded":20573,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGBA, non-interlaced","md5":"77cf8c2e7caff0f81053eac91c4175d7","sha1":"577981568ec7f56459f153c17f66a990475a67ce","sha256":"18e2e812b140a302ed51285eb91fe79cb1cd41dd9397454f73a7b10b9cf045f4","sha512":"c6b271c8d643dcb958b2631c051310b891297747f332a5fc387cbdc1a88580670a38cbf8330bf811cefc5ee1cac76b136b3dcc9ea8262af5ba1e7a0fa4cf04ab","ssdeep":"384:1Sf7TD3A23XOVjh8DiIXq3aMABC2aIaurDP8YjCE16S96xJk:Qvb+j+DTNMABCM3IEAKwk","tlshash":"fd92be15afa3dda34fdbc51985cf3a2b5e9232b960163ef78c75acf9b8403927404a04","first_seen":"2026-07-10T09:52:41.382424Z","last_seen":"2026-07-12T20:41:40.083682Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":43,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.053Z","timestamp":1783888862053,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 7779\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:38 GMT\r\netag: \"9c4882ce16b54503d70d9601bfb95c35\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7779,"size_decoded":8025,"mime_type":"image/png","magic":"PNG image data, 407 x 102, 8-bit colormap, non-interlaced","md5":"3247cd42627e5a5ad1618bc62f8aa453","sha1":"bca8fd27b762a9491eb4798624f2b59fc4deb3ac","sha256":"cc432d1c0a1037c10c34d7b29bbeff73e3fea96a2dbcb63a918e713e8eb91735","sha512":"9927aaff8dc999f95db39090e2573b95e32faaf86daa9391bed0dbeb9b5293955ac5b7739c05e45764df91f9224fe1427a131c7f7353bee4bcaade0843af4a9a","ssdeep":"192:qURLff/NbsQify/EFDNSJgdsEQdvmnLK8Z22GerqVWB:qUR/NbVSyiN2rYpZ5b5","tlshash":"02f18fef681b2c65434fcba8f7a817c6b2d02d224b896bd884a174c9eb1ed80d51d743","first_seen":"2026-07-10T09:52:41.368102Z","last_seen":"2026-07-12T20:41:40.084933Z","times_seen":2,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-13.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.077Z","timestamp":1783888862077,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-13.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 66599\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:39 GMT\r\netag: \"d6ced9633307f79522a1e87025efa982\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":66599,"size_decoded":66846,"mime_type":"image/png","magic":"PNG image data, 369 x 190, 8-bit/color RGB, non-interlaced","md5":"1ab757c44aee4b0fd37345592b6e317d","sha1":"137ec07ce9cc0e8ca63242dae17d209589649cf8","sha256":"2afd1095ec84abec3b42b2d5b981e98b24ea67f7f936d70b69c7c906bcfc141b","sha512":"2b44aaafdac2a1477f2193df8edd329ff4694fb4c61d891648043ca30aa71ae838960cbacbe421347b195ee88c4447c56537174bf929274d68c34d34e7bad959","ssdeep":"1536:FZB2Wtnh4w/QTDHLpwQz9tRc24ZLTqEMB6g6fjpXq7jFzL7YHV+ZO:nkwhFQnLpwAmHLTqEwyulM1iO","tlshash":"475302f25489388bd2bc8eb2e12faa163870fe7f15b34062061761e74f3a35251b7544","first_seen":"2026-07-10T09:52:41.437296Z","last_seen":"2026-07-12T20:41:40.086146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":563,"timings":{"blocked":327,"dns":0,"connect":0,"send":0,"wait":73,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_inventory.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.113Z","timestamp":1783888862113,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_inventory.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 191830\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:06 GMT\r\netag: \"04fab87d2ece2009574a92da834c44cb\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":191830,"size_decoded":192078,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"098f39b681f7a28ec895961ad70dccc5","sha1":"debc5edfd2afb51d63f06cff5b8716fa4a2b1343","sha256":"681184724e2aa07b42a78344bc944b086ffe594cc7ece55b298983ac0dfdcede","sha512":"e2803a7e849a99965745053e48f47f5080cb14f32873397ae54026a40b021a5dd53913f5993625e192bd32e94d03022e56cad1df6ea2e39796b7bef0256c07aa","ssdeep":"3072:MDhIhUykA+dbqbGPNqw3NRQDyz+oaRvRhrkq2ux6TT9G2z:MEmobGEOZyLTrsuxk","tlshash":"a21402ac1617c930ec1ef6ac83e8606fd1980a53c83c1fd24d76b12adae461f57da647","first_seen":"2026-07-10T09:52:41.386423Z","last_seen":"2026-07-12T20:41:40.087284Z","times_seen":2,"resource_available":false,"data":null}},"time_used":666,"timings":{"blocked":593,"dns":0,"connect":0,"send":0,"wait":26,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/contract_choose_items.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.121Z","timestamp":1783888862121,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/contract_choose_items.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 119330\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:01 GMT\r\netag: \"63992ccf68c84d66dc271eb6ec05c9c0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":119330,"size_decoded":119578,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"0aab64c171ba679b2e58f088feb1e489","sha1":"62488876d04c0a392d64f36edbee14e67933291c","sha256":"f00bd8122d19507ee5a0b72c3fa3393fab0dec46363a6a481efbde901d5e8e10","sha512":"b7d29285cae879e0c5a9316c685f9596f72708cd479186aeeee64fbcff6e6baaae070593c804d6a061341c4a3a5fdb797dcfa8a6fba20af820b7a9a982767393","ssdeep":"3072:RrEq/vXxaNIY8LuoaE9DCi7VrGLUguD+LbVMITH/:RrJRaNf8SK9pByg+Lr/","tlshash":"37c301994cf7cb10e8ef16f671f2cde7242c397e42e1a7b065ec6a9197248a4013db52","first_seen":"2026-07-10T09:52:41.421661Z","last_seen":"2026-07-12T20:41:40.089629Z","times_seen":2,"resource_available":false,"data":null}},"time_used":937,"timings":{"blocked":745,"dns":0,"connect":0,"send":0,"wait":49,"receive":143,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_ban_checker.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.128Z","timestamp":1783888862128,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_ban_checker.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 125331\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:05 GMT\r\netag: \"872cf613b2104a17995d170dbd1a43e1\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":125331,"size_decoded":125579,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"bce69a33c16062354a5fd55e567ad576","sha1":"1e76e81a2ca3af5b867d2dc699acb5f92d363469","sha256":"f66f355ab703f083bd4e1d91b8246df87bbb8f3874ed8058f8a153924baace63","sha512":"37a53d5a3083870c8c861021154dfe628b8154a8a46d082281433be575c4a42557d7aa818386926979bf364005db7fd2836ad30d1193f37ac5e25c4f6e78a94a","ssdeep":"3072:tkHvMdYUNohkkb/xdl5AWS35TgYDoizvXV:RYLhlb/xCtJsYxvl","tlshash":"6bc302f5961bcca0cd0f057e91d54c260a12433ea8720d75387a103ef6dbb9afa5f2a1","first_seen":"2026-07-10T09:52:41.376909Z","last_seen":"2026-07-12T20:41:40.093264Z","times_seen":2,"resource_available":false,"data":null}},"time_used":889,"timings":{"blocked":839,"dns":0,"connect":0,"send":0,"wait":25,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-11.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.073Z","timestamp":1783888862073,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-11.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 113194\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:38 GMT\r\netag: \"16c94f8d57166fd54d5b6e3f6270a517\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":113194,"size_decoded":113442,"mime_type":"image/png","magic":"PNG image data, 399 x 423, 8-bit/color RGB, non-interlaced","md5":"e8b50e9c55e7109740df99169e0dd17b","sha1":"957ce5ea775bc7578b3bc53b1d823e44d4221722","sha256":"6b90f54f4c4da0d3f5b158c48ab783873505b7dcc7d37c5ecf65edd21ccb1b75","sha512":"b67971fe58722472fd9a9725cf585d6d92919aded5e02cac1a820a1557bf719c376a8b0c9b5de41272150079f2d374bef8c3787734201986e4d8530bbfd6c4e8","ssdeep":"3072:UDMG5u8XPqRH1/2Eh0tCQdFK886cvqm++dhto+DG2:5GNqCtpGjD++rr","tlshash":"1ab3023ea211502cff929a71d1a717f26b7c77b3e26d426bd204519634ab880c1bdf71","first_seen":"2026-07-10T09:52:41.415156Z","last_seen":"2026-07-12T20:41:40.094574Z","times_seen":2,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":287,"dns":0,"connect":0,"send":0,"wait":24,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-14.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.079Z","timestamp":1783888862079,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-14.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 57305\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:39 GMT\r\netag: \"9e441148e87c8cdcb95f9ad243b2916a\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57305,"size_decoded":57552,"mime_type":"image/png","magic":"PNG image data, 672 x 360, 8-bit/color RGB, non-interlaced","md5":"8ea2fee2dbb6ebe395f122050057ea36","sha1":"9275cdcfd288b7b916d09d1abc5d2d3f4cda5600","sha256":"0a94e59a110180ce1050bc80379a9e3867cfbf4dfe6d674e2a93f28182070a60","sha512":"0074d1f02ceeb9d223ff30cc8285acdfad746608267724d6e4c9ac54c62bb42a2c77e55172d85acadee2f1c74398baf4b3f558972417fca8c7f59ed14dcd53c4","ssdeep":"1536:/O/Q2Bi0J+wGO7wa1qKK2fVutEj8sXFcbNd:/O/Q2Q0kwGa11AIVuWTXFmz","tlshash":"0743f281177d4de6fa91aa6de1218823303ae666fd92f4611bc59cff814cc907e7d832","first_seen":"2026-07-10T09:52:41.360612Z","last_seen":"2026-07-12T20:41:40.095778Z","times_seen":2,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":335,"dns":0,"connect":0,"send":0,"wait":25,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/podkachka/swap-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.132Z","timestamp":1783888862132,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /podkachka/swap-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 19925\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:45 GMT\r\netag: \"6c1c4e7812c8aac9b15156171e36799f\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":19925,"size_decoded":20172,"mime_type":"image/png","magic":"PNG image data, 412 x 486, 8-bit/color RGBA, non-interlaced","md5":"b3e4e60f54a75ba1e80794c2d97d4ebd","sha1":"eb1b6fc534788f9c18264ba64fb9dcf8b828b0f9","sha256":"4123b907084c6ecd6c7690f72f09942e5204a0cb695f915e5ca1e9ab73cfe06b","sha512":"66e9e0f17a054d3818d3521630f3715fa5a6fc313a41b08c64beda30c6b5c330371d4a81157f83489e49b65a147d47a5f632ba6bad7bff3b63a770a8636dd17c","ssdeep":"384:fXLSrNEE0MNYca/+yK/BOR+0yXwSyIgq8f4cJ2VZsh/h:f7b0N7/lqUXnPsAcEP+/h","tlshash":"8792bfcede96148c5651642c5e955c23b1ee8758cbb93372473ab8f12422d7c21cf032","first_seen":"2026-07-10T09:52:41.387549Z","last_seen":"2026-07-12T20:41:40.098077Z","times_seen":2,"resource_available":false,"data":null}},"time_used":880,"timings":{"blocked":856,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.151Z","timestamp":1783888862151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 10 Jul 2026 18:22:21 GMT\r\nexpires: Sat, 10 Jul 2027 18:22:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 181121\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-13T13:40:37.68665Z","times_seen":10721,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":116,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-4.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.032Z","timestamp":1783888862032,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-4.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 6444\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:52 GMT\r\netag: \"42ec1658bad483fb01092115eb8951e1\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":6444,"size_decoded":6690,"mime_type":"image/png","magic":"PNG image data, 409 x 282, 8-bit/color RGB, non-interlaced","md5":"51873df513d4b5bde0619b7fe3804fe4","sha1":"69200db270dee72f11b24d40a5c8ee324a84a078","sha256":"a23139f2ea8992a4883dcdf6897f9d2870ad53f57919fea712e8b73e9d788aac","sha512":"95f8bfa1ceba1015852495c007856392610aea2026fbb6bf150a9b99943775308efc87965a9bed0d77f13282a74d2614956e94b8b613722d1567bfe688fc2033","ssdeep":"192:C7USQji9hgPNrJkroj8VMm61OPucy+E4+gb:gTQji9eJkrlVMVk55E4+gb","tlshash":"52d16cdef361ab5622f30d522454b7a6743616fc4d845182e3bfce143ad0a0997f2817","first_seen":"2026-07-10T09:52:41.434377Z","last_seen":"2026-07-12T20:41:40.100404Z","times_seen":2,"resource_available":false,"data":null}},"time_used":187,"timings":{"blocked":136,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steam/image-1.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.992Z","timestamp":1783888861992,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steam/image-1.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 368762\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:58 GMT\r\netag: \"237b2c7acd310f9214b580347f09e073\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":368762,"size_decoded":369010,"mime_type":"image/png","magic":"PNG image data, 1920 x 952, 8-bit/color RGBA, non-interlaced","md5":"31885ee7f135ad556dcdad832226f9f2","sha1":"c13e7ea1a4a2a17516b0831b5d31669943575e8f","sha256":"bda698824a99b5954a43c86f8606f0b458c532881e095324edff5e54850c2249","sha512":"97cffd739c8f8ab33d80f194f372202b04b04f3072f68b98e450de9a47b67d4ef379f82437c42dadff49e37fbd254669cf77bfda70dff0e7fbe8dcf0a99e1931","ssdeep":"6144:vHqYjLdAXWr88v78XVKNDOJSVtzolWngjfm7tbWQ5A5g6FOGwft7YFEmJ:vq+dAmr8CmtlWn0fmOg6MXftUFEmJ","tlshash":"c974f1a0613bd08c9ccf067d9b542f7a43a2e1bbc9e22671a5b0169ddc18d52dd0debc","first_seen":"2026-07-10T09:52:41.432017Z","last_seen":"2026-07-12T20:41:40.102684Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":208,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steam/image-4.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.012Z","timestamp":1783888862012,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steam/image-4.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 102756\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:58 GMT\r\netag: \"62a3af476e674b90b10d574d0cf4c975\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":102756,"size_decoded":103004,"mime_type":"image/png","magic":"PNG image data, 720 x 551, 8-bit/color RGBA, non-interlaced","md5":"3258bd885a9adfed216865458095b1ec","sha1":"240bda2fff3798af9ea6fc3de50b4f44b29045e6","sha256":"1d91aa8e3e5a34a8ed0d09f10b27b9801abf20a48511b103dc98a858fe7b198d","sha512":"073541f076cff11c3fe79a6d6bf903d196d2922d37d628f0515947c777bb6756a3744f21c80fdeb31a566e9dca3cf31f0f2f7f52e2a80c0657c4fd91b2f6efa4","ssdeep":"3072:FBY1+MCyi7U2HhHBMNbpaFr62Qxdzz5DEU:FBYc/yi7UqhMNbpqUdXtEU","tlshash":"34a312f4196ff98ab74630f5890dd11b82a0832f5f6e639ccec6b19b1b826f1e415384","first_seen":"2026-07-10T09:52:41.37285Z","last_seen":"2026-07-12T20:41:40.104689Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":71,"receive":90,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steam/image-5.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.018Z","timestamp":1783888862018,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steam/image-5.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 257104\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:59 GMT\r\netag: \"7a04ff67946585bbaa8dcb3be793e3b8\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":257104,"size_decoded":257352,"mime_type":"image/png","magic":"PNG image data, 1008 x 323, 8-bit/color RGBA, non-interlaced","md5":"ca047a18a3ee0c4d6e86c19d9d1ba261","sha1":"a4cd4ec728f60b50f08ddfe627dc27afa5580e9f","sha256":"2bc7ee0cf5d1ce720e9a70d11e7106807915ef23e25e4aada5a19c87afb0b26b","sha512":"cb0c85b95a9dab99dfb4b1bf772cb7be841221ca7dd34c4f6df5877f4bc64275c5d00c2338c2b0a043f4f5993426b4fc67c16dd29a1151921a4a61b80cdf7a99","ssdeep":"6144:ehjVAuekhOJCeH43ozFJUgO8KFMReFa2Nc09o073aLrGngsI/Uwge:ehNeCeYsSgUa6DC8aLih6Uwl","tlshash":"2544236ffbb0126b18b3892c86e2607124d3981ebcfdb6c284bf5d1c45a93e87d76550","first_seen":"2026-07-10T09:52:41.377993Z","last_seen":"2026-07-12T20:41:40.107485Z","times_seen":2,"resource_available":false,"data":null}},"time_used":597,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":86,"receive":459,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-6.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.066Z","timestamp":1783888862066,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-6.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 200985\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:42 GMT\r\netag: \"4fde5fc6c3023246e243b1daa5cae58d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":200985,"size_decoded":201233,"mime_type":"image/png","magic":"PNG image data, 792 x 773, 8-bit/color RGBA, non-interlaced","md5":"4b310bd46da2bb1dd84d4196f8947a4a","sha1":"7b5bcbaebeacc0959cc08756682badfe82ae2401","sha256":"0e56805ab52996d36842003a6668a05aaf15082abd3be81c2873c8055853b514","sha512":"bacba678e7573ec235c3272b7fd473c696511c3a373a13cd4dafdb59392a07182c5689b3dbca120257bf6bf90050df236c98f1c0fd124f9cb907945cdc700b60","ssdeep":"6144:eJ/IUUYf/NLUH8/MNXsAIoSmvBwCMnymXK:CwUUuFYHigIaLMnG","tlshash":"e71412e13443c16ade8f18f7f6f4934a6250f6d41eb14a23721d6ebbd45a2c4b85888f","first_seen":"2026-07-10T09:52:41.356545Z","last_seen":"2026-07-12T20:41:40.110398Z","times_seen":2,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":213,"dns":0,"connect":0,"send":0,"wait":28,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-9.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.095Z","timestamp":1783888862095,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-9.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 10050\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:50 GMT\r\netag: \"74ae30b1d540518191ca525f9b277d39\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10050,"size_decoded":10297,"mime_type":"image/png","magic":"PNG image data, 283 x 77, 8-bit/color RGBA, non-interlaced","md5":"f7c46e92459fe42bbaca481396af4c4d","sha1":"831d0de5d18a747f9e2d056208a0b0eb993fffdd","sha256":"d570b07af44e70a132b538c5865bf14049bf6fb541a778da00a9d087a49657e3","sha512":"bf17bc0928ba7c1e166fcd4ae8dc666a63157a881262cc1fbc2ee3c206e0241d02ea2cc2dffc7ec1329f207b7be01a1a0da8bb84ecaa03efdd729eaa4eb79e18","ssdeep":"192:t+byVwZ6ksRIc2wtL7jvyT1fItbD306WsQojIN2Xz1N4GvU1+c:gW05whvSNIJIf4eu7c","tlshash":"da22b0cd885148767c7e743de11a1078e9dfc69070e827bead1db60981e24d2f2a13d5","first_seen":"2026-07-10T09:52:41.402412Z","last_seen":"2026-07-12T20:41:40.112089Z","times_seen":2,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":447,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/trade_sender_choose_items.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.118Z","timestamp":1783888862118,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/trade_sender_choose_items.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 117429\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:08 GMT\r\netag: \"126c0c56e860de1c363f2d118c3801ba\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117429,"size_decoded":117677,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"12a77a4d82d6faf1cc216bc5d87b3dab","sha1":"413eaea3e3ccd03c2fa16cde6787eb439329d835","sha256":"cf967837791f04ac5a911dc6fb3a9ceb8259f6a71dcbac9f5ad4547311f0cfd0","sha512":"05e50d0067fd2467bdc76e108cb76633788da75e16fe477c7f559c59edd14e087314b613ab76556006069ea9957fc9e24f7af8b836aec163675cd6477a08fa19","ssdeep":"3072:9G7FeCE96Z51YvFxUrNuP78o9rP2lvyDrcr:87Fe16Z51wquP780rP2JyDm","tlshash":"1eb3019ee657d295ee8e40e454cc2d4b1985c812c7487074337d7eadcd2f28b7ab82ac","first_seen":"2026-07-10T09:52:41.425985Z","last_seen":"2026-07-12T20:41:40.113642Z","times_seen":2,"resource_available":false,"data":null}},"time_used":764,"timings":{"blocked":715,"dns":0,"connect":0,"send":0,"wait":26,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/fenix_logo.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:03.121Z","timestamp":1783888863121,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /fenix_logo.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 100117\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:32 GMT\r\netag: \"7fd98d69bb5e3980f53f5d984d17f66e\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100117,"size_decoded":100365,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d859bea6cfc74c7391a035dd5041cf8d","sha1":"e9be42dcf410574687347bdf4558a80ad6eab817","sha256":"0f463efc6bf62a3de630eebaf255ecbb6e5ae9322ee92ad3601babc3d45f86b9","sha512":"9b13f3599747085721c15597578fa0d4773b73632e0b09707936bb5286a35a5fc4bfd6a1e7429017095df8f213943bbc40d463e72bef26893441666b857cf01e","ssdeep":"3072:Ymn2/eRsyPgRxAINXBAc6we7/FYfHaQZnavqd:Ym2Wg/rNHd6QGqd","tlshash":"5ca3024cdc8d3ae0fe8329a093d5f970db6f0b9589837494a18a807ae1553dbe255cf4","first_seen":"2026-07-10T09:52:41.359747Z","last_seen":"2026-07-12T20:41:40.115236Z","times_seen":2,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":220,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-16.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.082Z","timestamp":1783888862082,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-16.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 66340\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:40 GMT\r\netag: \"4b5cb01dd722c331d6d26284cd5cd410\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":66340,"size_decoded":66587,"mime_type":"image/png","magic":"PNG image data, 617 x 103, 8-bit/color RGBA, non-interlaced","md5":"59f728eda88be8f66985c7cf58327514","sha1":"59fe3bdfbdc6dc78199d77ceebab387d24579c4e","sha256":"25d365ceff3d304b420ce52f5fd9fc1a6b688b6d44f8fc49f6f10be907e0b9d9","sha512":"9654b69475c2a51543951876e087691bc526db09b1e5ff5bced53ff00ce04991f84ecd1704c4649cbfd90fe0a7340cb370397d3dc0baa67a36ea95710da6b4ab","ssdeep":"1536:zuD4qxvAbcKRAffWGncuIU/ylXGnIyor7qwFSAygaEyADM0g2:zucqyA39ncuXkXTyorXSAnaCDM/2","tlshash":"9c5312dc7fb302f9b69da23b3e404c19b1a13c35236b786a6f45f01dd96a14aa1d2c4d","first_seen":"2026-07-10T09:52:41.384457Z","last_seen":"2026-07-12T20:41:40.116733Z","times_seen":2,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":366,"dns":0,"connect":0,"send":0,"wait":26,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-4.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.099Z","timestamp":1783888862099,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-4.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 106973\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:48 GMT\r\netag: \"44ba4bc3e27bc72a809981bb7c1b12d1\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106973,"size_decoded":107221,"mime_type":"image/png","magic":"PNG image data, 749 x 360, 8-bit/color RGBA, non-interlaced","md5":"7c6920a0cca4d8ba4a071aea9a733c3a","sha1":"1f3b706f865073cdac531cb4eadb12803f194f6a","sha256":"748ff66d71ed2b29e36bdc3a6d4f8f0bcf341919fae58180c243717d98177ece","sha512":"a88848f533671bbca193830e12ce6eb4d2035dd4f99c7da2519b7162b9b2bdb48f441b64f0cfce5f0635a641f347b5910fe45bfb878d515316937dbdb3bdd7c5","ssdeep":"1536:FMlk8E838btZMQJf6SuGtFjuSRzxwCpdE/APB2vv6Nxx0l8YUlc5KFK8+ydNjIiE:0p8gQxDhzu8WCHbP4vqxq8YUvK8hjcfp","tlshash":"daa312cac0f152ca68d0317b48e25dde8b67364b404942b96e97b2f9781f97c25d8d0e","first_seen":"2026-07-10T09:52:41.41876Z","last_seen":"2026-07-12T20:41:40.122433Z","times_seen":2,"resource_available":false,"data":null}},"time_used":747,"timings":{"blocked":459,"dns":0,"connect":0,"send":0,"wait":73,"receive":215,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/podkachka/swap-3.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.135Z","timestamp":1783888862135,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /podkachka/swap-3.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 72892\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:45 GMT\r\netag: \"ff74321ad5419f85372bf3761a36edad\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":72892,"size_decoded":73139,"mime_type":"image/png","magic":"PNG image data, 396 x 523, 8-bit/color RGBA, non-interlaced","md5":"1c22db7f6b50b41e20b6e3c52dc42dac","sha1":"f032ee925ed274dff33a5bef6aff4d07aa9949d6","sha256":"02e000a928589c39a468d952002956b4d24390706f21937662924ccc0a7aef5a","sha512":"76d500bdfe904511dbf7157ec6a7a6369845393b00648f8df52856506bddddab9e3cabdf82db102125233a45bf3fb6016ccd2a625c9748988f128878280f3fd1","ssdeep":"1536:bPsOk0aN1zPkLMRboy6851+p5V86t6BOjOZY8TuCtFq2nq/W3YOS:bEOKN5jD5Y5elQGTuCrqO3YN","tlshash":"ad6302f604adfcb6a5c70375bc996f1154b1a1c8c86b513c238bb9e4de9e1063791e43","first_seen":"2026-07-10T09:52:41.404992Z","last_seen":"2026-07-12T20:41:40.124117Z","times_seen":2,"resource_available":false,"data":null}},"time_used":956,"timings":{"blocked":880,"dns":0,"connect":0,"send":0,"wait":27,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T20:41:00.682Z","timestamp":1783888860682,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:01 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:32 GMT\r\netag: W/\"ed41f7f4cc3c454c3f0fa449a9793327\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":494,"size_decoded":648,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"7f735e9447ec6e99b7ba5bed23dc0185","sha1":"c74fdf0e03cba3bb89c30c1af2c45f2a4c060006","sha256":"71879afaaafa82cba45f56a5413d46ebe955da0aa6920e63a6f5ad3cfc96600d","sha512":"09227f007f3d5147ac545e99a13a2b22cf7f081d8ad77fe9d0479080a5b0e7449d6947ce2c9b019fe50f6762d6592ff763681e0f2bb34d02fc4a7d51ff6ae8e7","ssdeep":"","tlshash":"d2f0d486d400cd0f83701360aec1f60450d7e758d386ae4565eb60bd54c5785ceff574","first_seen":"2026-07-10T09:52:41.349697Z","last_seen":"2026-07-12T20:41:40.125725Z","times_seen":2,"resource_available":true,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":230,"connect":24,"send":0,"wait":25,"receive":0,"ssl":59},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.055Z","timestamp":1783888862055,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 52344\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:41 GMT\r\netag: \"161fb12f73b4afe7fe56f20ac94ecf99\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":52344,"size_decoded":52591,"mime_type":"image/png","magic":"PNG image data, 600 x 271, 8-bit/color RGB, non-interlaced","md5":"9091e65afc42d998948b53bdeb155e05","sha1":"28283e955ce625114adc1aab6daa34d5534ad03a","sha256":"03fe3032e3583d3e0515ef35878892f5240f069140a9dd08c888387ff6a5fd15","sha512":"3250c64344b41632a7af695d66e9731031d910ab2d23b75eacff91428455b468d1cf8a4d866390f86c8605f9d0dc6f521e658e021b72eb8b04d186cd18e7332f","ssdeep":"1536:MvBp0xxUoKKIIra2CdXCBteNNo8hMxKQdN6:MYLKmTCdXVNNBMi","tlshash":"7533f11bd19b28b1c6b7fe3a69ab44bd01594b47b36f7819cbcc9e8958d06dc00bb310","first_seen":"2026-07-10T09:52:41.39543Z","last_seen":"2026-07-12T20:41:40.127347Z","times_seen":2,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":168,"dns":0,"connect":0,"send":0,"wait":34,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-3.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.060Z","timestamp":1783888862060,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-3.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 1856\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:41 GMT\r\netag: \"7385fe898b92bfc6665e7a80db0914bd\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1856,"size_decoded":2102,"mime_type":"image/png","magic":"PNG image data, 243 x 42, 8-bit/color RGB, non-interlaced","md5":"0e7bdfbcc96fd8395629e8e99003a84c","sha1":"209f4db9c66b59b64710a25d3a346e4f46a19fc3","sha256":"f1967d7acf358d03cc8df6f72d2d16cc7c00af8dc75234e9cb4d11670e5df1df","sha512":"2d6b137264baf1236b7f4455748d9bb18a2ed1f248741dbbc0ee9f43e9b0315266e020a6fd39e32c990765a3ea1d32585ef73a6e8284d9df2cb70994b5ce48ba","ssdeep":"","tlshash":"d43109fb3808a4e9431b28f6150c5286a3dcde36f926965a14c5702ed56ff8ba0dddc3","first_seen":"2026-07-10T09:52:41.396446Z","last_seen":"2026-07-12T20:41:40.128969Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":184,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-17.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.084Z","timestamp":1783888862084,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-17.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 14045\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:40 GMT\r\netag: \"529fecffe3dcc9ac93e9f7e0805987f5\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":14045,"size_decoded":14292,"mime_type":"image/png","magic":"PNG image data, 247 x 41, 8-bit/color RGBA, non-interlaced","md5":"0dbdecc9e49b9c4d079ff1ad62bd0e4e","sha1":"487a135b21790278708c1eda53faa6b26888d7b6","sha256":"292ce4221c3bbd0965be23d6212841ccc1c1eaffda56615f06812e824ab5bec7","sha512":"c9d7a039d0e64da30123e932915214d8b2df395cddd21431c9d4d3db0073e4dc078499afdb1a520a59c2ea208698556b310c7ee0753bcb12d9af7ae28ed8c142","ssdeep":"192:ZX56wy3CXpIaUFheMB0YFN8zfQJX9fRCkjPk0ufi9mIO7QvAwalQswTWOKQ8iBXk:ZXHy3XdFO29Ikdqi9TO0AwaWCVc5d4cy","tlshash":"1752cfdc388fd3a6b9e62a43a9246630104c8a0a51e53e67cf55befb399f45437830cd","first_seen":"2026-07-10T09:52:41.364574Z","last_seen":"2026-07-12T20:41:40.130423Z","times_seen":2,"resource_available":false,"data":null}},"time_used":411,"timings":{"blocked":383,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/2x2/image-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.092Z","timestamp":1783888862092,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /2x2/image-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 9772\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:34 GMT\r\netag: \"31e8b7ae214c2c882116f651d1e26025\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9772,"size_decoded":10018,"mime_type":"image/png","magic":"PNG image data, 276 x 362, 8-bit/color RGBA, non-interlaced","md5":"f24a6a0c6cee3fc29b77108378948ffe","sha1":"d180332471cc64634a7afccaf4cb1e02a1a8d5db","sha256":"1922304717b38da0b008a580476629f1dd92722dcc4d3d528b2757c53f336662","sha512":"7ae71933bb6e9509f08745d7200d174066b36512737f11a98123fac3543ac219ebd5aa4cf5490a246b0114539c9ba1ba378c0f29f6ba247052200ac796147ed8","ssdeep":"192:vRdxMl7ue36S4oiwSEuMilQWnHCLsfj6xRq+QqBAiwmwJZ:JoTxifEOiRjGiLwJZ","tlshash":"3e122a8cbdb9806db0a2d46532e6318d8885b617c3fd4613d16d7afcc1ca9185b23c77","first_seen":"2026-07-10T09:52:41.41644Z","last_seen":"2026-07-12T20:41:40.132004Z","times_seen":2,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":426,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_accounts.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.107Z","timestamp":1783888862107,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_accounts.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 85309\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:04 GMT\r\netag: \"4bae68b495f3ebd7ea8a071732ef81b0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":85309,"size_decoded":85556,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"cd396ec9fa57d23fc8c3d625f2794e80","sha1":"45a277f4e074ddc3a3e42939e5d12ea3c5c5950b","sha256":"c6e53aa130a243400677f420224564fd2b4a174a69ec63f54103a21b52d57785","sha512":"e61f1e01f9cc41a15fc3dd094f9fb7826028b20a6d0f005bd6a611ed6cedca86700d528fa59479461a5c62c093cf3fd9afe1ec2b4f08a36de610a01313fbd677","ssdeep":"1536:605XQzb33Ys7RARGUhMvC1jfSWaGxb3QnGTjFUD:N5ED3YqAROCdfSA3Q7","tlshash":"4183e0b7df0852a6c938563cc2eb17707fb61674e09a620a31399967844ee1efd338d1","first_seen":"2026-07-10T09:52:41.352975Z","last_seen":"2026-07-12T20:41:40.133493Z","times_seen":2,"resource_available":false,"data":null}},"time_used":641,"timings":{"blocked":525,"dns":0,"connect":0,"send":0,"wait":24,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_market.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.124Z","timestamp":1783888862124,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_market.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 101968\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:06 GMT\r\netag: \"f9dfc6e6af290020576fd0f31f16eb7d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":101968,"size_decoded":102216,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"49c9e5ec2df8b6a124f794ea4a655463","sha1":"a7c277f36fa01f24f932f4c8847f257a89949cde","sha256":"e89670202d5844757342ce089598dc6f66b40832a6139f59e4d46fa8a7743c9e","sha512":"930acb1c4d50c9e7cbc6cec1ddc4113df536a74bbd45068e847004f2d206b03295565d45ccfa9bb02ba2cc20a7ccf033921981ecb1b47221309b1736cd505c45","ssdeep":"3072:jCTxQtCgvk3KysPP94cosf48t5s/v/2OPdWwM:jCTxCvtyI4cnw8tK/vNdvM","tlshash":"e0a3f115a897c062cd1e4c7889186e29d647de2dfa511232fb78290ccaf457f3f3927a","first_seen":"2026-07-10T09:52:41.427468Z","last_seen":"2026-07-12T20:41:40.134888Z","times_seen":2,"resource_available":false,"data":null}},"time_used":856,"timings":{"blocked":805,"dns":0,"connect":0,"send":0,"wait":27,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/market_buy.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.125Z","timestamp":1783888862125,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/market_buy.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 99878\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:04 GMT\r\netag: \"f3b34ec45fa05f33683acb3e5f6991fe\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":99878,"size_decoded":100125,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"8367dddac9b3b864b6b07d7379626740","sha1":"d867ace955eb1440962d1395ce2063698b883458","sha256":"a6dcde5e4dc09eaaff94974df54008c9972d95641308c6f204c8b9e5cb9420a1","sha512":"407c8c1b384b53776ccb71225ffde274cd8bf6cff6c48ffce9a3a1fa62d71fc60f98f466de8c2070c40c809b971769d7e59757c2a5a056e25a796803c67aa6ed","ssdeep":"1536:tH3BmdKz12RvoyDKbfI1Gv6FIyBRyGHqUFL2BpcO3WHhOW+D699hPhicLWS0qZkN:Lmu12RvB4f0GS+MyEhL6pqYiwhG9zi3","tlshash":"1ea3e0c7c267d0d2ec4f123a89e21f57a459e8193da4143632bd383ca1cb94b6e7d789","first_seen":"2026-07-10T09:52:41.429369Z","last_seen":"2026-07-12T20:41:40.136251Z","times_seen":2,"resource_available":false,"data":null}},"time_used":881,"timings":{"blocked":807,"dns":0,"connect":0,"send":0,"wait":27,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/steammanager/page_contracts.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.121Z","timestamp":1783888862121,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /steammanager/page_contracts.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 83260\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:39:05 GMT\r\netag: \"756082338588ab976bf10e02915f6ddd\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83260,"size_decoded":83507,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"d1f7a5f3a8bf1ddc3c4981988b69746d","sha1":"219f1669c070e38847fbadb6a92996a262ecf403","sha256":"c27f25f13d23d09354f1c9d946b2a7be42272afd047ec036db632f93830b1043","sha512":"4cdbc75e939d5279f3ae3ee23f7be70c7970f40ce446ab434fba9f9d47f48fdcc8936e30f9ff677547b3303d432c7f6c1d9016c6fd2defda200ece6e25c49bc3","ssdeep":"1536:oZg6ZZqtrcU42DjyHO56Fdz/B2vGx2qrXSc1OdPFwwBiXKJ6:oZg6ZktDrjyu5akQLPiNPqG6","tlshash":"6183d056d3f7dc70ecefd87822056cea790811c92df505b32ab2455dc8b602ea7753a4","first_seen":"2026-07-10T09:52:41.358624Z","last_seen":"2026-07-12T20:41:40.137724Z","times_seen":2,"resource_available":false,"data":null}},"time_used":808,"timings":{"blocked":734,"dns":0,"connect":0,"send":0,"wait":26,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/podkachka/swap-2.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.134Z","timestamp":1783888862134,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /podkachka/swap-2.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:03 GMT\r\nContent-Type: image/png\r\nContent-Length: 19462\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:45 GMT\r\netag: \"663ce52d889f28a8c5ade279b99dc9c8\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19462,"size_decoded":19709,"mime_type":"image/png","magic":"PNG image data, 419 x 620, 8-bit/color RGBA, non-interlaced","md5":"690d4463c376c5241d45f514f02586a3","sha1":"c9f508c3633b27dca5c4c6b167646e44e1dbfed2","sha256":"92f35f1a7702a62c13c058a1448a8807aed2db981f93f1008b5c5ab6da937036","sha512":"324fc96c760ad0f45d9e86af5b26b6afc6c41bcf8744cc5a9cd25d821fe548ce07520419e0a54a5a0d9750e7b07b4f542ea4a734d07506dd517754c2743e32f6","ssdeep":"384:buUCYcC8jI3PPZ53IpAdfR0eLuTDh79HEwAJd9DVrdsU1UR:bTC7Cv3XZJNUeKXHE9JbEv","tlshash":"21929ddc5b9c7b50e7b66090d706fb8491b99dd9dcce336ac06ae2a33f2c9700ca0142","first_seen":"2026-07-10T09:52:41.398293Z","last_seen":"2026-07-12T20:41:40.139302Z","times_seen":2,"resource_available":false,"data":null}},"time_used":907,"timings":{"blocked":880,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.154Z","timestamp":1783888862154,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 10 Jul 2026 18:22:21 GMT\r\nexpires: Sat, 10 Jul 2027 18:22:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 181121\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-13T13:40:37.68665Z","times_seen":10721,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":58,"dns":0,"connect":0,"send":0,"wait":110,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.155Z","timestamp":1783888862155,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 327140\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-13T13:18:03.385751Z","times_seen":233479,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":58,"dns":0,"connect":0,"send":0,"wait":79,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.750Z","timestamp":1783888861750,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 12 Jul 2026 20:41:01 GMT\r\ndate: Sun, 12 Jul 2026 20:41:01 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12635,"size_decoded":1486,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"f04de8ad1ef740d940ec0f534a8f6474","sha1":"3b31756e84c8887867417c7d6cc64501c9d9193c","sha256":"2f1ac0c31bc3ede8317cf72e9d28051ec727c9a0014aa69cff495abd6256bb4e","sha512":"69afede137c125294044274e463f30c02594f379ec879285e0b3ee41097f503dfb8272487759870f547e4dc4cf8828a2c1efaa806deb2f3124b7f6d67c638783","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:8KYXuM0p2+4","tlshash":"28427892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:44:19.218006Z","last_seen":"2026-07-13T13:06:27.084371Z","times_seen":26439,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":34,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/fenix_logo.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:01.989Z","timestamp":1783888861989,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /fenix_logo.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 100117\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:32 GMT\r\netag: \"7fd98d69bb5e3980f53f5d984d17f66e\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100117,"size_decoded":100365,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d859bea6cfc74c7391a035dd5041cf8d","sha1":"e9be42dcf410574687347bdf4558a80ad6eab817","sha256":"0f463efc6bf62a3de630eebaf255ecbb6e5ae9322ee92ad3601babc3d45f86b9","sha512":"9b13f3599747085721c15597578fa0d4773b73632e0b09707936bb5286a35a5fc4bfd6a1e7429017095df8f213943bbc40d463e72bef26893441666b857cf01e","ssdeep":"3072:Ymn2/eRsyPgRxAINXBAc6we7/FYfHaQZnavqd:Ym2Wg/rNHd6QGqd","tlshash":"5ca3024cdc8d3ae0fe8329a093d5f970db6f0b9589837494a18a807ae1553dbe255cf4","first_seen":"2026-07-10T09:52:41.359747Z","last_seen":"2026-07-12T20:41:40.115236Z","times_seen":2,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":113,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/sda/step-5.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.040Z","timestamp":1783888862040,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /sda/step-5.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 18040\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:53 GMT\r\netag: \"37c6e39b5c7d24aaad3e251b029ce362\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18040,"size_decoded":18287,"mime_type":"image/png","magic":"PNG image data, 336 x 493, 8-bit/color RGBA, non-interlaced","md5":"81cb0c7488493239c9b9427c9f28b165","sha1":"e4640e9af1f7f3b4b1b91c365b39b97884b88751","sha256":"d536826ee01065895f9575ac50acbe378a823210bd542484f4daaf2e0ae000f0","sha512":"60951d396f6808fca7fbd463f95f314b20514366eb186dccd11c8e068cec00614d6ee94c22a0f8ebdcd28dffb2216de2cc3b17803c841673b7f5cf4c30ad7517","ssdeep":"384:1SeQm6Y3ge7UT/+hjEndBKRjjZx05FTFRTYtsR4froWGQBlmktD8XQ:Q7jcUT+Kcn3+TktsR4froWGQB9N","tlshash":"c982b062d1a6c4952de91d6e584e9d2d8ca7b1b083cf547fc505f8dc225af49704cc8f","first_seen":"2026-07-10T09:52:41.366985Z","last_seen":"2026-07-12T20:41:40.141779Z","times_seen":2,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":107,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-5.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.063Z","timestamp":1783888862063,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-5.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 193071\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:42 GMT\r\netag: \"4edac215bdeb2c9765c0456c412ef44e\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":193071,"size_decoded":193319,"mime_type":"image/png","magic":"PNG image data, 469 x 392, 8-bit/color RGB, non-interlaced","md5":"39ab753a54ff0363e468ac4da65dcde1","sha1":"479185e924bd6ed09477c48af35d09f57eb6f77d","sha256":"35e0a2a6cdb2369f50e1de30a1b906598bc78fd36a95432d9239a386d69034b2","sha512":"62b5ce67ada3b65eaf7a7d82e25493e87e3aca32b5f47aea8115a5d9f06e5de8b2e5b74dadeb09afdc17d33f66a8686eca01e47a19ea5c8db037b7df934c481d","ssdeep":"3072:qAaC6MgUMrxD6E1jKIrOZMqvholbPvgfVL3zK6pmds4w8R3QyGgoypSZZN:qAa/U+9jGfh2bPGCvq4Tyiov","tlshash":"08142216acc650edb81916be7711bb5cdcbb5aa0423ae2938ca85be16c0507d3fde344","first_seen":"2026-07-10T09:52:41.413749Z","last_seen":"2026-07-12T20:41:40.143177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":495,"timings":{"blocked":211,"dns":0,"connect":0,"send":0,"wait":25,"receive":259,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/farm/step-12.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.075Z","timestamp":1783888862075,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /farm/step-12.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 16935\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:38 GMT\r\netag: \"b0630e6045b4b9f4d5ce1f3fd76f8da5\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":16935,"size_decoded":17182,"mime_type":"image/png","magic":"PNG image data, 276 x 116, 8-bit/color RGB, non-interlaced","md5":"4d106929a8a9c2e198e33f78c1228c63","sha1":"ec9c06765e6ccd15202b70f42fef745e5535920a","sha256":"3a80d33c8a92782665221a4646a3d0da9ce3c560c257af46422fe62a5c9f5a23","sha512":"1dbb112b243a8ed9377d422470167c48d769eaf82d4d5d7999264d191be8d6bc43b740c22469d75ac2a5b02221b4865d9155156040e49625f94358efc60e8439","ssdeep":"384:jelyGNVDh8acUgUX2nM/uvQ5TWdtHbSVQdNDJ:jelrDh8BlnMmvU8bSCBJ","tlshash":"a672d00b7abf2c632ce46fdde34a3c3d84524752bd926f5326543b90d51a0628fb8508","first_seen":"2026-07-10T09:52:41.383442Z","last_seen":"2026-07-12T20:41:40.144547Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":310,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.146Z","timestamp":1783888862146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://phoenix-farm.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 10 Jul 2026 18:22:21 GMT\r\nexpires: Sat, 10 Jul 2027 18:22:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 181121\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-13T13:40:37.68665Z","times_seen":10721,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":120,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phoenix-farm.org/problems/image-3.png","fqdn":"phoenix-farm.org","domain":"phoenix-farm.org","tld":"org"},"ip":{"addr":"91.132.162.20","port":443,"asn":8100,"as":"ASN-QUADRANET-GLOBAL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phoenix-farm.org/","date":"2026-07-12T20:41:02.097Z","timestamp":1783888862097,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phoenix-farm.org","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 14:24:26 GMT","end":"Mon, 05 Oct 2026 14:24:25 GMT"},"fingerprint":{"sha1":"32:DE:6C:82:6A:09:54:21:C6:E5:0B:70:BD:AD:2E:77:CE:C4:8B:50","sha256":"2E:5C:CD:9A:87:1A:67:75:7C:7D:2C:0D:A6:6E:33:A5:6C:B7:C9:DB:FB:F6:0D:30:CF:3D:15:36:94:AB:51:93"}}},"request":{"raw":"GET /problems/image-3.png HTTP/1.1\r\nHost: phoenix-farm.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://phoenix-farm.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 12 Jul 2026 20:41:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 56245\r\nConnection: keep-alive\r\nlast-modified: Mon, 18 May 2026 13:38:48 GMT\r\netag: \"e58dc399138f83fd2fca810400975e1b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56245,"size_decoded":56492,"mime_type":"image/png","magic":"PNG image data, 753 x 139, 8-bit/color RGB, non-interlaced","md5":"51fbf063bea841de78ae841bd98cd6eb","sha1":"f614049564e0332a8180bf5a0d1d5ec36e80bb9f","sha256":"d8acb43107ed689d3f7908d637cb06dd8a71548f595dea229c2f43a51d59e4fe","sha512":"2291103ee3b22bc8fc4faada43c3283a6fdd35c994a1b26dab9de8a64c8b00fe091d8345a4c84dc91d9febaa50a40b0c08225e30be228a52921320435afba4a5","ssdeep":"768:QVSIdjFdnQXaR/RFragZVjPIcmHEWwcbnXSyiDAopzrDTHqprWaIFboD9zBn1mT3:QUesqMHlDxiDhjupAboD71mTWdePFbqq","tlshash":"e34302c467c8f8d58332064ef910f61fa8c3f4a7e585ac075219b9ee1a3dce90e2651e","first_seen":"2026-07-10T09:52:41.417631Z","last_seen":"2026-07-12T20:41:40.145983Z","times_seen":2,"resource_available":false,"data":null}},"time_used":523,"timings":{"blocked":450,"dns":0,"connect":0,"send":0,"wait":25,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"phoenix-farm.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}