{"report_id":"3a5d2817-2c31-4985-8c54-11d82cd606cb","version":6,"status":"done","tags":[],"date":"2026-05-27T01:03:30Z","url":{"schema":"https","addr":"popa-market.xyz/","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":0,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"title":"Popa","dom":{"size":72579,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3302)","md5":"92b9e52573c216ccf56edee96b96f01b","sha1":"0507daac1c0390cf3554a1d52fc1d6f0a3e231e8","sha256":"b9acbee3ca67d610ed9dd693d0edf25ff69db20e9435202eea632eb8195e4467","sha512":"294fa526eef4d4894422b62216855e0908e1375272f9a20af39ebf5def124445a0f90b85d02a09e74149fc505ceb4ee5a8e2db4961b5a3607f9d6119da1a5419","ssdeep":"1536:iQUbHvFBHGcIcZ6esEF9zK+1heC5nX0GZIfVgonzW8Ft+V/y:i8cIcZdF9egeOIzq/y","tlshash":"53634f2050f92936914381dbfb61ab1b3ea2e55bca4e0204babc1be45fd7cd2ed1711d","dom_hash":"domhash6797c8812b0a06b7dbba42c132a36aee","first_seen":"2026-05-27T01:03:35.274328Z","last_seen":"2026-05-27T01:03:35.274328Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"popa-market.xyz/","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":0,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-01T01:03:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-05-24T22:36:44.337416Z","alert_count":0,"request_count":2,"received_data":354436,"sent_data":891,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"telegram.org","ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":499,"first_seen":"2013-12-18T13:14:30Z","last_seen":"2026-05-20T19:57:53.058884Z","alert_count":0,"request_count":1,"received_data":116674,"sent_data":423,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"popa-market.xyz","ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-02-23","domain_rank":0,"first_seen":"2026-03-11T03:02:58.638568Z","last_seen":"2026-05-26T18:10:13.715832Z","alert_count":54,"request_count":27,"received_data":820426,"sent_data":12457,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn1.telesco.pe","ip":{"addr":"149.154.175.204","port":443,"asn":59930,"as":"Telegram Messenger Inc","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":3770649,"first_seen":"2017-07-25T15:34:44Z","last_seen":"2026-05-20T07:43:54.010919Z","alert_count":0,"request_count":4,"received_data":85425,"sent_data":3104,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"t.me","ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2010-05-20","domain_rank":146,"first_seen":"2015-06-29T19:03:15Z","last_seen":"2026-05-21T15:15:45.667703Z","alert_count":0,"request_count":4,"received_data":86104,"sent_data":1838,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"unpkg.com","ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-01-06","domain_rank":1093,"first_seen":"2016-01-07T23:26:01Z","last_seen":"2026-05-25T07:23:13.533444Z","alert_count":0,"request_count":2,"received_data":846915,"sent_data":889,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}]},{"fqdn":"cdn.socket.io","ip":{"addr":"3.167.2.78","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2010-04-18","domain_rank":199187,"first_seen":"2015-03-23T22:14:03Z","last_seen":"2026-05-21T22:30:53.275691Z","alert_count":0,"request_count":1,"received_data":50722,"sent_data":454,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"85830d811f7fd48c0c8adba10859381d","sha1":"7a0825c415eb3eb201d1dbe70be8d79717d1725d","sha256":"87c723c52d16d62b6142b75da75e61e2c8a4c5454cbefdf597e5c86eb2618731","sha512":"5e152eb6d93196cdc94725a6ba21a4352a80a3b263556cf42fb06d6aed8a00981753f920857fc24488bc498ce4e106fe20ea23e57a087d0a8771ce5d4e2efdfd","ssdeep":"","tlshash":"84313276288b6430c273f07f5f23f7856537b1277108d6963a9ea36d2fc07208515a9c","size":1583,"data":"","first_seen":"2026-03-11T03:03:03.021516Z","last_seen":"2026-05-27T01:03:35.334334Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.socket.io/4.7.5/socket.io.min.js","fqdn":"cdn.socket.io","domain":"socket.io","tld":"io"},"ip":{"addr":"3.167.2.78","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"777eb8fd4f8320b6e5cc9a7159bdec6a","sha1":"6b4032e88d0040182089fe3befdecee9346e8921","sha256":"73eba16bc895fdfa454e27ecb80def31ede8d861f99e175ff93b110eabec044f","sha512":"d75b7c43ebd8f49942aebf8fbde64a4d826af27eced3d6395ffa64fda31ddef26e812beee313ae9c6114cda003a8bdc8f1c64a13fa41c3009f5f30e4449876b1","ssdeep":"768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm","tlshash":"8123d8c8b291b06187e37175447f210ba27a682554c9c18cf634d9f5aebce8e7223f79","size":49993,"data":"","first_seen":"2024-04-04T13:35:53Z","last_seen":"2026-08-19T20:55:29.994764Z","times_seen":10459,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/telegram-web-app.js","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"e327f60ff0d85c31034e21c908154d57","sha1":"d83f8a3062b70f51147c1501891b4523db34674a","sha256":"bcc5e1ca219fbea9498e826e0f5648603582c7988ec8c3ce0b85c86a9eb6299c","sha512":"fb1a2abec070c64dcda00d503093d2d1d2c30cb2a0bba78bfd2fe117e7eb159079216370e560d13dbed2f614b1e9cf7a127bff4685a8f3cdda7b02009296dce9","ssdeep":"1536:pOpTpRdoKd4F0WN2ZbBcn9cF9KTfVjLo03ueLE+wFFz1NIVIB/MGYV7p/xHK8ITq:spTpRdfcKFU7Rx1v","tlshash":"aab33e4d6cb3612285b3b1bf8b5f925172719883301def20794d9b646f80e7c53eaad8","size":116341,"data":"","first_seen":"2026-04-05T10:46:58.564832Z","last_seen":"2026-08-16T11:26:19.734321Z","times_seen":2814,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed4af115ec90fdd1322bc4201477de6c","sha1":"1d68d9032be867824e708f69e52c16baf7501bfd","sha256":"4e01fd3232594e0c1a34f29d54ec63a6156e6941ba5034098fe34fe28a972bd5","sha512":"70d2897d266ee21a82c4f44f1a9ad3910a70c985ee73b97b8f1e2a68be30dbcb809a294d78ebbe1ad2e934c4d9f9c0dbc4f1bc9285b4fffb877e83607cbf0164","ssdeep":"","tlshash":"7341bc1e71f3253a5163333a0f9b7208a27291232945dd58bd5d83488fb29296ba5f78","size":2320,"data":"","first_seen":"2026-03-11T03:03:03.023953Z","last_seen":"2026-05-27T01:03:35.335407Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/webapp.js?v=717","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"21787c628bffc38e2926d557acef6ece","sha1":"36613969ab060a0244acb87f2eba8f943c301bbb","sha256":"8edb19018cd918c3e149f07052a569a88087d1c93670f3b09a404f0eeefd8806","sha512":"1277792418747464ba55228d75363562a0296301b7bd047a5d932ddb246de07c421610ce82a6e858402e00255417568523f19efb3c48aa460d15075ad720300d","ssdeep":"6144:RvPM4y6BkAMuIxO4cR5nUAGYQcDHoC/wfBIkVCVXUxwpifsLcVaudGqkEN:RvszAbRj5sxwpildGqkEN","tlshash":"d984d75a213610350872b3bbd717a619fe7780373602c354bdac86582fb2d6496beedc","size":379103,"data":"","first_seen":"2026-05-26T18:10:15.89957Z","last_seen":"2026-05-27T01:03:35.336383Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/@tonconnect/ui@latest/dist/tonconnect-ui.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8f492519285ba824f24f7b105826392","sha1":"fbce099fcf04754b562b03604020cde652b5a412","sha256":"ab1d010e9b9d9af37e98bdfa6248068eccdbeb7bbbee99d86364abd1d9a7611a","sha512":"c4edd582be3fe92dcb4a9035f50c5bf5c6a6e3c8a2003dc6b252f9bf63bfd517447cbd79f4ed8923035a0ab2df78d038758f4c29214559eec5ce2b40296e3960","ssdeep":"6144:1h5KZGz68jbJ9VnerZrCowVAwWJQxg4bxwAvxqG3B5Blr6071vDeWHzwk7tM6/9i:hfTMFKVAslxwAvljB0EvKWHq","tlshash":"c2944ad6b3c2b16017974ad940774522f3391dba380884b8f76d88867e705c9d27bfba","size":422763,"data":"","first_seen":"2026-03-31T13:25:34.976724Z","last_seen":"2026-07-29T14:57:18.901461Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/lottie-web/5.12.2/lottie.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"55bf86203909151984bef8cbe4739d64","sha1":"543e646b2ff86405b77bd2514b1aede8a8b4cbd8","sha256":"a0757321f974527bda3cc2593bf56cc7ffe4578421249ced6ae49ffb1c529f90","sha512":"8c49ee0edea37de7028ed850009f9e774313540fbee592a69547260c606fdaf508fd1127e85b88762c4b367413faf2aeb04da18539368acddc16fbf9c00f9282","ssdeep":"3072:xnEwejqNqAvPSIoPayIYzfq526QGK2y0mbsZmml+39xzKMTlB6k:xUjqNqAvPSIoPayIYzfq52tU1l4fRRBl","tlshash":"a85419597254343805c540a9806f0a4bb736292e246ac49cb76cf4ffacbde8d31beb75","size":305543,"data":"","first_seen":"2023-07-18T12:10:25Z","last_seen":"2026-08-20T06:42:03.859944Z","times_seen":2374,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ddaa7bb0bfeed9990535495a13fad63c","sha1":"c86ca8278441484dca97b35b61ae75f05489c2ab","sha256":"b42e4dca1b2cf3d5ce61a5d5fb1405e8837adbb6467f401ebbd701190e245bb1","sha512":"df94237a8bc5e161f3a9fa39b14c297204b3bc9b7c158457b07c12fd77d3e03e12a451d18e0cf6122a05e9d7929f63d5a71489f86d8669d744be1e55c7369098","ssdeep":"","tlshash":"f6b0123197eb441283500875432bf221d7083163401064447331e32437e00636e0b54b","size":90,"data":"","first_seen":"2026-03-11T03:03:03.027103Z","last_seen":"2026-05-27T01:03:35.337329Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/tonconnect-balance.js?v=39","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"77fd84b2f19b832074f6e401489b7619","sha1":"914db2b43b1fa38735ef272334a1b9ffe033a17c","sha256":"8133808c690c83465e17b8b7b2c383738a54939bbc0beeafd04de61342f3ce0c","sha512":"49dee97f0a83fb8265d17d23bea28524faa74172e4795dcec7b16a3fbafab1a608e40778cef43cd68307bf0556ad00adbca80ff59e5dc7fbce41b59986fd4fbe","ssdeep":"384:Bndg90fFY5WQ/BE8N0J9c3iQweUu590WW+kWUzbRT5sgzyHh2th8+L2PFNPLscbO:BnG51bXcX0A+ho6d9rLqv","tlshash":"48f2953537182112077263baab871726f5716513b602929239bd86252ff2e90d9f3ecf","size":35043,"data":"","first_seen":"2026-05-26T18:10:15.874244Z","last_seen":"2026-05-27T01:03:35.302717Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"efc0f089535ff7165d08c810a1105ecf","sha1":"c3824849a6c83ffd64fbfa8f44e9898d38b8e537","sha256":"94b7a70f605820562128865c1ae6454b2a743ffa75dca4c1d69b0dbb21532e06","sha512":"474d8b0ad4f53fabcd30a5d73b7f961bfa5117c9a6b52a97e102c0cd75e326a2eb84a55542ef15d6b1493dac6a8797b81450572e46a1017c50c57638e5f66cf5","ssdeep":"","tlshash":"3401b82960b1b03a0c37607bd71f2788783070ef3e01ac843a4c47990feb5255e2298e","size":834,"data":"","first_seen":"2026-03-11T03:03:03.034106Z","last_seen":"2026-05-27T01:03:35.3382Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/pako/2.1.0/pako.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e647868246b70926c4d716f7640bd51a","sha1":"c64471d33f9a3d20b5d9219159fe102d8763adcb","sha256":"ede2693a4a6a5126b9d35669062b358ecab6ae7b9b86a1cf302feb45a8514907","sha512":"8364de016c3918f9d7ef3d0a9fc9c56d87de1dcbc0bbfb71e9dea6acb7bff749a40b13be45ca6dc98a64b14cf7e443b7dfb17cddb6707265321e21da9aca647e","ssdeep":"768:fXHw8wA4ZIlEf4WLNiAAAAAA84YrI9OVsLMeu/pJCU5ejR9PNB57szzsE1s1A1m9:yeBomKTCsJ6b3","tlshash":"3423f8b221f754691bd01cd880970ba162b091722c4655f8e77c9ce538b0adbf0bfabd","size":46859,"data":"","first_seen":"2023-09-10T07:22:30Z","last_seen":"2026-08-20T05:31:26.32955Z","times_seen":2415,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCCX","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCCX HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccess-control-allow-credentials: true\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":118,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f1037636ed5c294a503cb51802741ad3","sha1":"e01d2985a3b2f5739234e75d7140fd09a6f15edc","sha256":"0e05f58b54fbbd90a57222dec02e480b382d27ed20213a85d5123cc2d55bbf96","sha512":"49af8136eb206c46e2321d1e5a4e0461cf5ebfbbfc76d6a21f00350adeb97a7f4b2e85b5c4218f32f01218eaf8d3553c239aeb5f1306e3c026fb0b1692443df0","ssdeep":"","tlshash":"11b092c4955d97c6ee30b2c4b1e7aa096da8bc6f9ac545ad226848cc8a4b5243412b3b","first_seen":"2026-05-27T01:03:35.279112Z","last_seen":"2026-05-27T01:03:35.279112Z","times_seen":1,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=websocket\u0026sid=xjtxPYiIdfIDXcMQAAAz","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.539Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=websocket\u0026sid=xjtxPYiIdfIDXcMQAAAz HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://popa-market.xyz\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: SDrn8mDSvpNGCicRJkiLyQ==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: z4TASyMTQBxo/Nep0/uJ2RqWJjU=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":1,"connect":36,"send":0,"wait":31,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn1.telesco.pe/file/DL5ThBIOWZXo8lcOiTdCYmcWfU9-wzWB1GvJhcKxHDbJPOyM_XGxQtIyRBcIOX74742m-sPvES-bnLu-B2qWarSGowa81n0gVJKnBgOlUnhkGRAeEtgQ2ONJSVqeDbW1FUOJ0WmW4HEto6eDPNMbxDlrSts2WcnZ0kteJLH52Jy7tO8f2L_vigokt8TgfrwLqSzbK1Brbx-8_JQrZItRtwAwCN9PE4W9eixpAVu8qpUPesY4nC_B-YFpIlA-nVbZMW0PO0MVPOFZNHTaCndWbPvyaXc-HQ0qY7mtU0H87FN-sCu-y6xFFTvGU68uyU2D1AxTCSY60H3Qmn7Ppbaf3g.jpg","fqdn":"cdn1.telesco.pe","domain":"telesco.pe","tld":"pe"},"ip":{"addr":"149.154.175.204","port":443,"asn":59930,"as":"Telegram Messenger Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:03:04.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telesco.pe","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:08 GMT","end":"Sun, 13 Dec 2026 15:14:08 GMT"},"fingerprint":{"sha1":"C8:B7:EE:0C:41:13:71:AA:B4:69:B4:2B:EE:EF:79:F2:1D:49:37:9A","sha256":"2E:8C:0C:6F:B4:A0:E5:EB:6D:C5:3E:78:51:7B:E3:75:51:D5:DC:6F:95:AC:5C:68:4F:BA:09:91:35:E0:3D:2F"}}},"request":{"raw":"GET /file/DL5ThBIOWZXo8lcOiTdCYmcWfU9-wzWB1GvJhcKxHDbJPOyM_XGxQtIyRBcIOX74742m-sPvES-bnLu-B2qWarSGowa81n0gVJKnBgOlUnhkGRAeEtgQ2ONJSVqeDbW1FUOJ0WmW4HEto6eDPNMbxDlrSts2WcnZ0kteJLH52Jy7tO8f2L_vigokt8TgfrwLqSzbK1Brbx-8_JQrZItRtwAwCN9PE4W9eixpAVu8qpUPesY4nC_B-YFpIlA-nVbZMW0PO0MVPOFZNHTaCndWbPvyaXc-HQ0qY7mtU0H87FN-sCu-y6xFFTvGU68uyU2D1AxTCSY60H3Qmn7Ppbaf3g.jpg HTTP/1.1\r\nHost: cdn1.telesco.pe\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:03:04 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 38889\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'none'; sandbox\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\naccess-control-expose-headers: Accept-Ranges, Content-Range, Content-Length\r\ncache-control: max-age=10800, must-revalidate\r\nexpires: Wed, 27 May 2026 04:03:04 GMT\r\netag: \"2dfbe1a5a73735a40eda26fbfcfd65f6ad84b2d1\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38889,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 320x320, components 3","md5":"79f7770d81036497957a51fcf40d1f3b","sha1":"6919893b7ebdf556b80603998d0d056ca8a6ef01","sha256":"d71f68ecb9fb07477cb93fca282df7f31ce9010d6f5f5a26216043e9a6d533c6","sha512":"c87afdf6a8fcca49786c72000ed81ceff5b6241a58fe43ce6f3f06d4dcf01fe9cb58ba963a1b5670e4f5c93f24fe9b3dab60d170fdbad2113ee8de269f4802b8","ssdeep":"768:x2zSA5EqBtWJMcwoh8uf4WQFlN0zC+Yv/fvVcGSb8JQFW6eOCN3qc:iS63BtWJMcwVEY1mczac","tlshash":"a503f1a34221a9e48c0484e8cc25a68fa31edde14b3f7751d96170fbee6d387b42d6d1","first_seen":"2026-03-11T03:03:03.010787Z","last_seen":"2026-05-27T01:03:35.284215Z","times_seen":3,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":152,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/balance?user_id=demo_b809e066","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.650Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/balance?user_id=demo_b809e066 HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/json\r\nContent-Length: 36\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f9ca0bec8dd2e4407aa90b588a92fbc1","sha1":"0f87f704bbb4c1b4ae89a271dece272cd1d8ac9d","sha256":"61ca0baff7a777623de14c4f51695396b50d8ea37a9b3383bf1a01627f35d407","sha512":"e535d4d2253e7cdb98b3cc0f038352f0773b166e977170137f67c249c41553ae3431d8f08892f2ceca5ad1a8bf0d2bff521af7f28483a1fbfe32328a49e91122","ssdeep":"","tlshash":"528004c14fc40c4fd74101d5410111500113f71507510c05c430747001403d4d35d0d5","first_seen":"2026-03-11T03:03:02.986639Z","last_seen":"2026-05-27T01:03:35.285496Z","times_seen":6,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t.me/i/userpic/320/hunter_on_gifts.jpg","fqdn":"t.me","domain":"t.me","tld":"me"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.t.me","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 21 Oct 2025 19:17:28 GMT","end":"Sun, 22 Nov 2026 19:17:28 GMT"},"fingerprint":{"sha1":"C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC","sha256":"02:29:2C:40:8E:4B:65:6A:8B:6D:DD:92:BC:E3:97:F3:76:D9:86:33:FD:33:51:BF:5D:88:9D:31:57:AE:EE:0C"}}},"request":{"raw":"GET /i/userpic/320/hunter_on_gifts.jpg HTTP/1.1\r\nHost: t.me\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:57 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 20\r\nlocation: https://cdn1.telesco.pe/file/mu64lIDj4M-vxSQTybw_AN0ffKbRJ2RKN5up4c4ANehgGHn8oDXr3JVj9CQl9_J3DZBhNF2Cx66wZ5CBohul2ICA57X_2OL0_gXqkbU5C8HabKvu9xySTziQd_gxCWCWJKf0FX-dvwewJuXzzc6gWJ-q2Edf1cmIlzss4_Zu3gmBZ6GPWT7d4D-uN_uOc1fUpt0nnZM-fUh3SGTsAZoGD3txmQrCF2I7JwMO3v3f5yjuA5JpcOMuBPtN24JG28_aQ_zqz48ke_u7INm0JAPtxn3Lm3hLxy02zgreM4XBczZwj0uGv9jUqZC3FUcjU4dvs96RR8H3b0H_rUGLr1ZCcw.jpg\r\nset-cookie: stel_ssid=b22441f44a04611c74_251584435044414342; expires=Thu, 28 May 2026 01:02:57 GMT; path=/; samesite=None; secure; HttpOnly\r\ncache-control: max-age=3600, public\r\nexpires: Wed, 27 May 2026 02:02:57 GMT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=35768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19909,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":492,"timings":{"blocked":224,"dns":24,"connect":29,"send":0,"wait":34,"receive":0,"ssl":172},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/ton-blue.svg","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/ton-blue.svg HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 808\r\nConnection: keep-alive\r\nlast-modified: Sat, 17 Jan 2026 23:00:47 GMT\r\netag: \"d5ad090e9a1a8799812a92210d6a8098\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3f26a4968e7bd522daab3b7a71309bb7","sha1":"feedef31ecd11c0473ab2bb2af23a32b90634626","sha256":"453cf5649b76d7eb5b0648bd83aca1c5958cb042d75d89e81b0f0ce6201a66a6","sha512":"3333cc6363bd95447403fc146be17f4295994259f160c9528f9ec0bbdea5e219f0f5f71297e402bf8c3d92040943ea724bb25d3d03f561d4ef67fd715994132a","ssdeep":"","tlshash":"6f01120583815f5a6814861073ac55d2b3f5f4c7e170a9cc81d6343af64c8d41688bcd","first_seen":"2025-05-23T11:37:09.503981Z","last_seen":"2026-08-16T14:58:11.451013Z","times_seen":583,"resource_available":false,"data":null}},"time_used":390,"timings":{"blocked":342,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/state","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/state HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/json\r\nContent-Length: 5639\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5639,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d5bed54c863647049a87edf69066eae6","sha1":"b72cf5b42212c92fcb93a893400fd70433c459a0","sha256":"1aacd841d1e6f2c32562f27a044cc4a33f410bb0468d97ce9b7bf989eefd60f6","sha512":"7af2a73d3ca2e217b0b900d27a677e338f08423344084f62a8e6288c5c0a1d8a19f1a48c693bc4baa47906de928233f451bc3a7957ef5ff884920b05811d0021","ssdeep":"96:Xbr04cZk4HqqaqJ4LIrHgrs6fjt139j0jRDRk49ob7PxW44KxD:Xbr0rkY6qJ7P6fjt139j0lS3Zxb","tlshash":"83c1447bb67301bf87a3a9f9741cf6e431afc0ea21708b6998b85b4447ed2160147a17","first_seen":"2026-05-27T01:03:35.289047Z","last_seen":"2026-05-27T01:03:35.289047Z","times_seen":1,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/hugs.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/hugs.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 8090\r\nConnection: keep-alive\r\nlast-modified: Sat, 25 Oct 2025 05:08:36 GMT\r\netag: \"a148edb77301310f78803e8216dda7a8\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8090,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"184494100b4199761876d10f99cc3b39","sha1":"c06d3a1512e44df80c72dc70e25e23b942e6d25c","sha256":"e70c37901baa74c8c5f5ee27658d089b913b7844139abb4c2aa2b8e915e957d6","sha512":"b0467681df67c6fe25dcb364d2bc05a28158635bb1162b63ad208d4f87b158c23d13abdbf5113ecc2a3f1c95d0539a5a71bbde9b389bb91c09aaff7e30b48d90","ssdeep":"192:pyO3HAgHJHY2rMFmq7eGs9U1zh+aql9Zc4yQ/wgTn2EZfvkbyLKutd:4O3gOHPrMFP7eR9U1VolI4yQ/j2EZfvZ","tlshash":"45f1ae1370e6c2e9dd0cdd38ecb412faa286cb2b5b0b1124bddf50698875595f87a108","first_seen":"2026-03-11T03:03:02.995598Z","last_seen":"2026-05-27T01:03:35.291099Z","times_seen":6,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/money%20bag.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/money%20bag.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 19896\r\nConnection: keep-alive\r\nlast-modified: Tue, 28 Oct 2025 07:24:54 GMT\r\netag: \"442e33fc8f1241986f144f779ea04799\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19896,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"01e624d796b623048842ad359b7d0867","sha1":"f0cc1505cca24052d19919ef7391c08efd0da4e4","sha256":"4e0faaeb46ac6935bdde54b9b286cecf4327b308a49c4a8c1f75d2cce3357165","sha512":"5c4ad449e59785fc3f2fcb6dd7e1397690ee87780c39fb02f5a97ebc7f2ccd7fc340ce0615b27a07980947877e3b5b5e153b2befdd061c0824e040227e09de97","ssdeep":"384:gw8y/7b530aLhB3hzZ0Oq29G9Bm+mHL1HtTZUdOevcmq:J8yj130sB3ht6Bm/BHJZUdrvcmq","tlshash":"7692c0a8107dd1fc3eeda4e56891b823c516afe24573e0120c2cfca139595a09df9f60","first_seen":"2024-08-20T15:28:37.826231Z","last_seen":"2026-05-27T01:03:35.291929Z","times_seen":7,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":38,"dns":0,"connect":0,"send":0,"wait":32,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/@tonconnect/ui@2.4.4/dist/tonconnect-ui.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 13 May 2026 17:38:50 GMT","end":"Tue, 11 Aug 2026 18:38:47 GMT"},"fingerprint":{"sha1":"85:3A:E3:4D:41:9A:40:A5:EA:4D:21:21:BC:8B:AF:E9:9B:B2:27:3A","sha256":"41:2C:5C:27:2E:1B:0A:16:BA:4A:09:22:08:86:E9:EC:B5:B9:C4:CF:94:00:3A:8F:52:77:35:8C:F9:C4:FC:A4"}}},"request":{"raw":"GET /@tonconnect/ui@2.4.4/dist/tonconnect-ui.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 27 May 2026 01:02:56 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncf-ray: a02118d39a0456be-OSL\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\naccess-control-allow-origin: *\r\nage: 1135939\r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 27 May 2027 01:02:56 GMT\r\nlast-modified: Mon, 04 May 2026 01:23:55 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: accept-encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncontent-digest: sha256=:qx0BDpudmvN+mL36YkgGjszb63u77pnYY2Sr0dmnYRo=:\r\nfly-request-id: 01KPZDF8WN7SRAX7E307D05WS7-fra\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}],"data":{"size":422763,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c8f492519285ba824f24f7b105826392","sha1":"fbce099fcf04754b562b03604020cde652b5a412","sha256":"ab1d010e9b9d9af37e98bdfa6248068eccdbeb7bbbee99d86364abd1d9a7611a","sha512":"c4edd582be3fe92dcb4a9035f50c5bf5c6a6e3c8a2003dc6b252f9bf63bfd517447cbd79f4ed8923035a0ab2df78d038758f4c29214559eec5ce2b40296e3960","ssdeep":"6144:1h5KZGz68jbJ9VnerZrCowVAwWJQxg4bxwAvxqG3B5Blr6071vDeWHzwk7tM6/9i:hfTMFKVAslxwAvljB0EvKWHq","tlshash":"c2944ad6b3c2b16017974ad940774522f3391dba380884b8f76d88867e705c9d27bfba","first_seen":"2026-03-31T13:25:34.976724Z","last_seen":"2026-07-29T14:57:18.901461Z","times_seen":10,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCF3\u0026sid=xjtxPYiIdfIDXcMQAAAz","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"POST /socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCF3\u0026sid=xjtxPYiIdfIDXcMQAAAz HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nContent-type: text/plain;charset=UTF-8\r\nContent-Length: 2\r\nOrigin: https://popa-market.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"40"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: text/plain\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccess-control-allow-origin: https://popa-market.xyz\r\naccess-control-allow-credentials: true\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"e0aa021e21dddbd6d8cecec71e9cf564","sha1":"9ce3bd4224c8c1780db56b4125ecf3f24bf748b7","sha256":"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3","sha512":"900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874","ssdeep":"","tlshash":"c710000000000000000000030000000030000000000000000c000000c0000000000000","first_seen":"2023-03-09T09:04:49Z","last_seen":"2026-08-20T06:25:19.629035Z","times_seen":367257,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t.me/i/userpic/320/wasdshnik777.jpg","fqdn":"t.me","domain":"t.me","tld":"me"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.t.me","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 21 Oct 2025 19:17:28 GMT","end":"Sun, 22 Nov 2026 19:17:28 GMT"},"fingerprint":{"sha1":"C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC","sha256":"02:29:2C:40:8E:4B:65:6A:8B:6D:DD:92:BC:E3:97:F3:76:D9:86:33:FD:33:51:BF:5D:88:9D:31:57:AE:EE:0C"}}},"request":{"raw":"GET /i/userpic/320/wasdshnik777.jpg HTTP/1.1\r\nHost: t.me\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:57 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 20\r\nlocation: https://cdn1.telesco.pe/file/tKP5DINj-YrLBhjoK_Uc9mH09_KMVwuj_AQt6kviczQA4T4hmkCaNRF1ZgOXpk7DxBpTYe-wOqUL1sZHsR6qQeRpyLHnpIQ6pV8JL00YamrRq_tukZ8ArBDqmsnAFkHlrb8MC6zTaJAWgDzZ3fBG7EmYCsnYKoS-W6GFBR89v8NOsG--iFQKIafGwlA8nmBZNLieSQK3evSarsQSMRs2kdI-t72HVXOaZVibGyeVZErjtto761HsVNC8JnYjK0qvazspNBuIu7yL1j3jCk--Y4s1EvKdlM65iTm49ojlvQ4bcWTeXQzalaMyLWLWxgY9ZbNY4f1XpFgHSw_x26loMw.jpg\r\nset-cookie: stel_ssid=113c2dc5d895f952c9_16404287873434764572; expires=Thu, 28 May 2026 01:02:57 GMT; path=/; samesite=None; secure; HttpOnly\r\ncache-control: max-age=3600, public\r\nexpires: Wed, 27 May 2026 02:02:57 GMT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=35768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9271,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":474,"timings":{"blocked":215,"dns":22,"connect":29,"send":0,"wait":35,"receive":0,"ssl":166},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/ton-black.png","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/ton-black.png HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: image/png\r\nContent-Length: 14723\r\nConnection: keep-alive\r\nlast-modified: Sat, 17 Jan 2026 23:05:02 GMT\r\netag: \"3ada4a9f5e78796c1e4074cfcc46d6f3\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14723,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"4d9528c8a7a160f8c42037eedc5aece1","sha1":"c37273dcb413d5453d032d127f8cdbbaa347b5c1","sha256":"0755b4dee876b5b35aa798f01dddf3792101b2ee78617896bb4a6d2b3a35062a","sha512":"f83d30b326347ceb42cbcb6d8acc59903a0bca968a3e3a542a7d966721ded8f4d6843371e9c56f891c087e6e9bca7e02014e8aebba58d61232d8525e4410dd61","ssdeep":"384:ICVcSHsxI3By32X2MitTpUbpxWmvddNoG:I+Mm3By1vtNUdl","tlshash":"4262d01646dcd25ec4b3177cfef060645b6ad033e8db9cc338e5351891089ad36adada","first_seen":"2026-03-11T03:03:02.989914Z","last_seen":"2026-05-27T01:03:35.296169Z","times_seen":6,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":339,"dns":0,"connect":0,"send":0,"wait":43,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t.me/i/userpic/320/Gifts_lover777.jpg","fqdn":"t.me","domain":"t.me","tld":"me"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.t.me","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 21 Oct 2025 19:17:28 GMT","end":"Sun, 22 Nov 2026 19:17:28 GMT"},"fingerprint":{"sha1":"C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC","sha256":"02:29:2C:40:8E:4B:65:6A:8B:6D:DD:92:BC:E3:97:F3:76:D9:86:33:FD:33:51:BF:5D:88:9D:31:57:AE:EE:0C"}}},"request":{"raw":"GET /i/userpic/320/Gifts_lover777.jpg HTTP/1.1\r\nHost: t.me\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:57 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 20\r\nlocation: https://cdn1.telesco.pe/file/loLyYb4si8d35NrPRHiR1FawMEM3udV3IEI2ViKie4pVHYjd9Mqnq_Yb12GuZ4prd8hvsk19nYRH6q0PaWDT1vZgJr6Vm_qX2lkiNzFrcyA7bIglQ9nfXU0thdlh33ZcoDNJF77SRKkaSL6vWIe_k04orTVpH6u7TLZL0hvreM00mweBqicf72LZjvuDtU2Q22Xi02K85MQpC0JM-jAqZChDY9mFWkoFaJYqd1HTxYgZgzrJGHK1y4OiYjaz-YqziLDykIwfdgbHFPUK0xORXcTXO-LCo4P3YFvJRupwTIDlBxmYX7gpoTNbZKrA-m-sgwaSVirDN7F_-axRQpfMKw.jpg\r\nset-cookie: stel_ssid=80e16fe788aa1df632_1062373013238657790; expires=Thu, 28 May 2026 01:02:57 GMT; path=/; samesite=None; secure; HttpOnly\r\ncache-control: max-age=3600, public\r\nexpires: Wed, 27 May 2026 02:02:57 GMT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=35768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14841,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":437,"timings":{"blocked":196,"dns":28,"connect":29,"send":0,"wait":34,"receive":0,"ssl":146},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/confetti.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/confetti.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 4868\r\nConnection: keep-alive\r\nlast-modified: Tue, 28 Oct 2025 07:25:58 GMT\r\netag: \"f038bb4c56459b58280fa4ee1f93a910\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4868,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"9045189fe16f3d8b486fdb9cd60b3fda","sha1":"5ddf7dda6da0719f839a5165a696a47172a32690","sha256":"75dbe708b3abad799c55bef4c5d9c8d6d73a333d06d28b5e39738868df7ba955","sha512":"51e87d57d7397abe70f7ab6a584e3793d4d6b17af654e1a9ac8c7e88ef2ad910bea6c14ba3dc686db3efb7b0050b179e1bd9c41d0fff25fdb6eef76960754abb","ssdeep":"96:gGpN72jrrh9BPgKGzPolglu+/hdxPduOX2HR7ljWShfRI33udsd0vI4:gGpNkr/BPgKGz/thdn3O8ShpI3GsdV4","tlshash":"93a18f781957fad8c9fa96ce5ca186dc2514b85132326ef338fd88a0d0a6048f0fd0f5","first_seen":"2026-03-11T03:03:02.97926Z","last_seen":"2026-05-27T01:03:35.296891Z","times_seen":6,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCLZ\u0026sid=xjtxPYiIdfIDXcMQAAAz","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCLZ\u0026sid=xjtxPYiIdfIDXcMQAAAz HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccess-control-allow-credentials: true\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"very short file (no magic)","md5":"1679091c5a880faf6fb5e6087eb1b2dc","sha1":"c1dfd96eea8cc2b62785275bca38ac261256e278","sha256":"e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683","sha512":"3c9ad55147a7144f6067327c3b82ea70e7c5426add9ceea4d07dc2902239bf9e049b88625eb65d014a7718f79354608cab0921782c643f0208983fffa3582e40","ssdeep":"","tlshash":"c700000000030000c00000300000000000000000000c00000000000000000000000000","first_seen":"2023-03-07T01:10:09Z","last_seen":"2026-08-20T06:45:28.843201Z","times_seen":12134,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t.me/i/userpic/320/superichy666.jpg","fqdn":"t.me","domain":"t.me","tld":"me"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:03:03.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.t.me","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 21 Oct 2025 19:17:28 GMT","end":"Sun, 22 Nov 2026 19:17:28 GMT"},"fingerprint":{"sha1":"C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC","sha256":"02:29:2C:40:8E:4B:65:6A:8B:6D:DD:92:BC:E3:97:F3:76:D9:86:33:FD:33:51:BF:5D:88:9D:31:57:AE:EE:0C"}}},"request":{"raw":"GET /i/userpic/320/superichy666.jpg HTTP/1.1\r\nHost: t.me\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: stel_ssid=b22441f44a04611c74_251584435044414342\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:03:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 20\r\nlocation: https://cdn1.telesco.pe/file/DL5ThBIOWZXo8lcOiTdCYmcWfU9-wzWB1GvJhcKxHDbJPOyM_XGxQtIyRBcIOX74742m-sPvES-bnLu-B2qWarSGowa81n0gVJKnBgOlUnhkGRAeEtgQ2ONJSVqeDbW1FUOJ0WmW4HEto6eDPNMbxDlrSts2WcnZ0kteJLH52Jy7tO8f2L_vigokt8TgfrwLqSzbK1Brbx-8_JQrZItRtwAwCN9PE4W9eixpAVu8qpUPesY4nC_B-YFpIlA-nVbZMW0PO0MVPOFZNHTaCndWbPvyaXc-HQ0qY7mtU0H87FN-sCu-y6xFFTvGU68uyU2D1AxTCSY60H3Qmn7Ppbaf3g.jpg\r\ncache-control: max-age=3600, public\r\nexpires: Wed, 27 May 2026 02:03:03 GMT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=35768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38889,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/fire.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/fire.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 26099\r\nConnection: keep-alive\r\nlast-modified: Mon, 27 Oct 2025 07:56:18 GMT\r\netag: \"124ca582f1aedf55d186af03d3816011\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26099,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"2741fa020897403a75b17663cfe3ed1c","sha1":"21157b4658cecc8ce58fcb4fd0df56ee6489cd0d","sha256":"59e6f1788ea259b01a21e6484b1293a50645c8e4a97abace7cf06194267f4f4e","sha512":"1a91f98ab2badbdd445e5770b0ff6610bf17dc2e4dc3e18d2fd911a799827c3b290af2dedf2f221e4c3531aa84cde24a30260b4fbe4d5e02f207390eb61a0f08","ssdeep":"384:qhyteo0WmzenfF2OdkANH1AlAzjLX9Xivv98AXtexag4BcrnUwsuU7RQvYpp7pMq:+yth0Z9OdRBYiX9XinHimBcrj6QKHNh","tlshash":"0ec2f13e2e40d4690280bbc48429cd52b6d7057893b47f7964e4ae9d5876b6f04b21fb","first_seen":"2023-10-16T20:44:12Z","last_seen":"2026-05-27T01:03:35.298658Z","times_seen":9,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T01:02:55.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1470,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"be6e6df072f2fa712840b451de3c8c2f","sha1":"e43608c5e1bb7f49a12c07524680a739e256f4b9","sha256":"3b69fed0d4c20e19cdfbacb54eefddc80c84a2ce489ee4ae4d94af0439bc281b","sha512":"bd613aac354ad7bcc0fcc2a215475b03b22a592ef363d4fc02028ee8090134cc4ac69a7e5142487b139f863150a152668deebd044a7fca7d89e7b5a1e2546107","ssdeep":"","tlshash":"fa31720b5c425142f19380802eb3a7187162e91f57c6ca3039dd6008cf4c2e94ebfbe8","first_seen":"2026-03-11T04:05:03.772486Z","last_seen":"2026-05-27T01:03:35.299412Z","times_seen":5,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":203,"dns":113,"connect":32,"send":0,"wait":33,"receive":0,"ssl":60},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/style.css?v=702","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/style.css?v=702 HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 126686\r\nConnection: keep-alive\r\nlast-modified: Mon, 16 Mar 2026 22:36:04 GMT\r\netag: \"0ce6b778ec77e6a933a7f86289ef1c3f\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":126686,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"53cf64f9d6738a4949092c9b2872616d","sha1":"0d1a7848e2a24cbbcfbc1efe45600245cb6b8646","sha256":"e71a257eb4f75343397277440f37a05ca83fa1c6b0f58d6e305e927a9d3bd526","sha512":"9ae935f14e2006f0c516a41efe1ec36dc3f31ad584f6c0c444e6204e95e753b813c48a2e6a38809310e0fec65df0114be6bdd1bb7a9c5c2d77da5dafe6f5f75e","ssdeep":"1536:GgpI9zVDMSrEibumr5QcjLpdWVgGOpyFFiayFFizneO:GisWiWAyFFiayFFiH","tlshash":"7dc39599a20551147737db70fb928b5ab7ac91529b03137dbff0204c938a2ae9635fcc","first_seen":"2026-03-11T03:03:02.984212Z","last_seen":"2026-05-27T01:03:35.300171Z","times_seen":6,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":28,"dns":0,"connect":0,"send":0,"wait":63,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.socket.io/4.7.5/socket.io.min.js","fqdn":"cdn.socket.io","domain":"socket.io","tld":"io"},"ip":{"addr":"3.167.2.78","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.socket.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:31:34:3C:FE:6A:94:47:2E:CD:E0:26:D6:4D:DE:E6:D9:31:A7:E3","sha256":"C2:34:E7:66:CF:D6:AF:AA:30:42:B0:50:F9:74:CE:BC:8E:BA:E3:A4:6E:8D:7D:A2:7C:10:10:F5:12:12:6A:A6"}}},"request":{"raw":"GET /4.7.5/socket.io.min.js HTTP/1.1\r\nHost: cdn.socket.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nOrigin: https://popa-market.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"socket.io.min.js\"\r\ncontent-encoding: gzip\r\ndate: Fri, 19 Sep 2025 06:12:02 GMT\r\netag: W/\"777eb8fd4f8320b6e5cc9a7159bdec6a\"\r\nlast-modified: Fri, 19 Sep 2025 06:12:02 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: fra1::vxghv-1758262322630-0e9bb973c4ea\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 ca0f77e7d535ced1a10fc8b8f87def9a.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: YzRoZYI6Q52OciTlLx6KATpoEqeDbL0FKHuf4Yq5wE_9Y6KUI5XuhQ==\r\nage: 21581454\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":49993,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (49854)","md5":"777eb8fd4f8320b6e5cc9a7159bdec6a","sha1":"6b4032e88d0040182089fe3befdecee9346e8921","sha256":"73eba16bc895fdfa454e27ecb80def31ede8d861f99e175ff93b110eabec044f","sha512":"d75b7c43ebd8f49942aebf8fbde64a4d826af27eced3d6395ffa64fda31ddef26e812beee313ae9c6114cda003a8bdc8f1c64a13fa41c3009f5f30e4449876b1","ssdeep":"768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm","tlshash":"8123d8c8b291b06187e37175447f210ba27a682554c9c18cf634d9f5aebce8e7223f79","first_seen":"2024-04-04T13:35:53Z","last_seen":"2026-08-19T20:55:29.994764Z","times_seen":10459,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":95,"dns":54,"connect":8,"send":0,"wait":14,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/@tonconnect/ui@latest/dist/tonconnect-ui.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 13 May 2026 17:38:50 GMT","end":"Tue, 11 Aug 2026 18:38:47 GMT"},"fingerprint":{"sha1":"85:3A:E3:4D:41:9A:40:A5:EA:4D:21:21:BC:8B:AF:E9:9B:B2:27:3A","sha256":"41:2C:5C:27:2E:1B:0A:16:BA:4A:09:22:08:86:E9:EC:B5:B9:C4:CF:94:00:3A:8F:52:77:35:8C:F9:C4:FC:A4"}}},"request":{"raw":"GET /@tonconnect/ui@latest/dist/tonconnect-ui.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Wed, 27 May 2026 01:02:56 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 62\r\nlocation: /@tonconnect/ui@2.4.4/dist/tonconnect-ui.min.js\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: a02118d29d49b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":422763,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T06:30:39.570772Z","times_seen":17985828,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":48,"dns":1,"connect":10,"send":0,"wait":40,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/star-black.png","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/star-black.png HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: image/png\r\nContent-Length: 14089\r\nConnection: keep-alive\r\nlast-modified: Sat, 25 Oct 2025 21:15:37 GMT\r\netag: \"023ea9ab6a00e60511a5f706df087117\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14089,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"9f95254b98247efcccb8816f28f3c614","sha1":"3bdbb9bf82bbb02fb58ca4fa09e34a2ea056c1ef","sha256":"2ef4ee353cd9cd5e5cb6dbdf122b976dbdbcc03cdf3a4f763119028870e62a87","sha512":"791366dd85714da6fbd61f3e1821ace1f72ba39584b214163c6f84106b4706b23efb73c226a9647593051f4673977bc7d8ee666d1412fe0f780db29cd4c1a58d","ssdeep":"384:YkrVIgDMt5klSiAOq/hNVSPp1Zi3cUK1NU:pZI9HklSiiZAp13U","tlshash":"3952c0214891b4bb47d27841a098313a7dc20262e3d73670a6bffe51f52b8d9a7d7191","first_seen":"2026-03-11T03:03:02.998424Z","last_seen":"2026-05-27T01:03:35.301878Z","times_seen":6,"resource_available":false,"data":null}},"time_used":386,"timings":{"blocked":341,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/tonconnect-balance.js?v=39","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/tonconnect-balance.js?v=39 HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 35183\r\nConnection: keep-alive\r\nlast-modified: Wed, 11 Mar 2026 13:59:02 GMT\r\netag: \"ac65e638abc21f418892f9d82f6473c6\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35183,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"77fd84b2f19b832074f6e401489b7619","sha1":"914db2b43b1fa38735ef272334a1b9ffe033a17c","sha256":"8133808c690c83465e17b8b7b2c383738a54939bbc0beeafd04de61342f3ce0c","sha512":"49dee97f0a83fb8265d17d23bea28524faa74172e4795dcec7b16a3fbafab1a608e40778cef43cd68307bf0556ad00adbca80ff59e5dc7fbce41b59986fd4fbe","ssdeep":"384:Bndg90fFY5WQ/BE8N0J9c3iQweUu590WW+kWUzbRT5sgzyHh2th8+L2PFNPLscbO:BnG51bXcX0A+ho6d9rLqv","tlshash":"48f2953537182112077263baab871726f5716513b602929239bd86252ff2e90d9f3ecf","first_seen":"2026-05-26T18:10:15.874244Z","last_seen":"2026-05-27T01:03:35.302717Z","times_seen":4,"resource_available":true,"data":null}},"time_used":312,"timings":{"blocked":123,"dns":0,"connect":0,"send":0,"wait":56,"receive":33,"ssl":100},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/inventory?user_id=demo","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/inventory?user_id=demo HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/json\r\nContent-Length: 29\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ce4e967b6b0162a36ee9f52d4e0d09d9","sha1":"8a88ffc9e741a4e4fd1b663b1d14439457f5a7e7","sha256":"a8d396c2682c277273405f5f525ede386820209baaa5e7edd077d087ff6dc2dc","sha512":"0c16ba857ee33e8a860fa76132b626d851277434cf035144157d3ef5fd808553863839836e6dfd1efb054a83d6bd2542357a6ba107f3ef283ac4a0061ebf3b5b","ssdeep":"","tlshash":"92800028a00300e0338a300a880c0a0828880000c32828380e3888a202080020ef803c","first_seen":"2026-03-11T03:03:03.016228Z","last_seen":"2026-05-27T01:03:35.303534Z","times_seen":6,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/giftred.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/giftred.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 60272\r\nConnection: keep-alive\r\nlast-modified: Wed, 10 Dec 2025 21:12:46 GMT\r\netag: \"425f6ab95318a514c4bdc892ed033fc3\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60272,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"80798b4f3ceca7c775a20a067fc9dd83","sha1":"0e42006924bd5d81902665a82f208fe009e1fd03","sha256":"991ff9c7fff34d448c622304cc7a860d2353146f604f863a6214a2c29cf170f7","sha512":"2c2a7dd434b60db5e35187fade606ad7ab37d7537f193c32b7d4f011520a0154cb046234bf2a15dcfc57469bb103889aa9c8f381984f78da46a1e9c8078bda9b","ssdeep":"768:Y4mgk0/rAqe7gbJ9jDJ8TANg6aFSHKdSblx+OAzwCF6+y1x4oMPKa2fCHgNNDZwr:agk05sOzjDK6aoFxRAcCFgvL1wkSxf","tlshash":"c643f18739ab26198020edc4e367c6513bb263fa8878b4b15fd95c1a6484916db13cff","first_seen":"2026-03-11T03:03:02.973915Z","last_seen":"2026-05-27T01:03:35.304437Z","times_seen":6,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/lottie-web/5.12.2/lottie.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/lottie-web/5.12.2/lottie.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 27 May 2026 01:02:56 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 63677\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"659c9856-f8bd\"\r\nlast-modified: Tue, 09 Jan 2024 01:50:30 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1555388\r\nexpires: Mon, 17 May 2027 01:02:56 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lR1G2f5e0nRCQnMOi1IFVU8HLt9Ckmp%2BKy1l9IE85gMDf34zOMnulCXYOJBs0dsPQ80xKjhHNi6lsOvBonUvDQgoOM7tlxzDbkwBE5Vkst2yCvFaUJ38UzaF%2B8t35X%2Bs15G3OfvD\"}]}\r\ncf-ray: a02118d29add8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":305543,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"55bf86203909151984bef8cbe4739d64","sha1":"543e646b2ff86405b77bd2514b1aede8a8b4cbd8","sha256":"a0757321f974527bda3cc2593bf56cc7ffe4578421249ced6ae49ffb1c529f90","sha512":"8c49ee0edea37de7028ed850009f9e774313540fbee592a69547260c606fdaf508fd1127e85b88762c4b367413faf2aeb04da18539368acddc16fbf9c00f9282","ssdeep":"3072:xnEwejqNqAvPSIoPayIYzfq526QGK2y0mbsZmml+39xzKMTlB6k:xUjqNqAvPSIoPayIYzfq52tU1l4fRRBl","tlshash":"a85419597254343805c540a9806f0a4bb736292e246ac49cb76cf4ffacbde8d31beb75","first_seen":"2023-07-18T12:10:25Z","last_seen":"2026-08-20T06:42:03.859944Z","times_seen":2374,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":48,"dns":0,"connect":8,"send":0,"wait":14,"receive":11,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/pako/2.1.0/pako.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/pako/2.1.0/pako.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 27 May 2026 01:02:56 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 13233\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"636858ed-33b1\"\r\nlast-modified: Mon, 07 Nov 2022 01:01:33 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1640730\r\nexpires: Mon, 17 May 2027 01:02:56 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5ofTCijwVJ1WyVmFNod7NAurkalQOar39r2FhWnRgZhfooKe5b2Rp1F5WeQlmbV374%2F%2B3qCoO6CC%2BIuGs%2Bv0HzFv6EEaLVRP9LKuZzPZ4sY9ru0X5IMstdkV8dlKsHo%2FROH%2FFgMb\"}]}\r\ncf-ray: a02118d29ad08deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46859,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (46785)","md5":"e647868246b70926c4d716f7640bd51a","sha1":"c64471d33f9a3d20b5d9219159fe102d8763adcb","sha256":"ede2693a4a6a5126b9d35669062b358ecab6ae7b9b86a1cf302feb45a8514907","sha512":"8364de016c3918f9d7ef3d0a9fc9c56d87de1dcbc0bbfb71e9dea6acb7bff749a40b13be45ca6dc98a64b14cf7e443b7dfb17cddb6707265321e21da9aca647e","ssdeep":"768:fXHw8wA4ZIlEf4WLNiAAAAAA84YrI9OVsLMeu/pJCU5ejR9PNB57szzsE1s1A1m9:yeBomKTCsJ6b3","tlshash":"3423f8b221f754691bd01cd880970ba162b091722c4655f8e77c9ce538b0adbf0bfabd","first_seen":"2023-09-10T07:22:30Z","last_seen":"2026-08-20T05:31:26.32955Z","times_seen":2415,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":45,"dns":0,"connect":8,"send":0,"wait":17,"receive":1,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/Additional%20pnges/black%20star%20for%20solo%20button.png","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/Additional%20pnges/black%20star%20for%20solo%20button.png HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: image/png\r\nContent-Length: 14089\r\nConnection: keep-alive\r\nlast-modified: Sun, 26 Oct 2025 07:15:36 GMT\r\netag: \"8209855fdf589b24514bb999b329eedb\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14089,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"9f95254b98247efcccb8816f28f3c614","sha1":"3bdbb9bf82bbb02fb58ca4fa09e34a2ea056c1ef","sha256":"2ef4ee353cd9cd5e5cb6dbdf122b976dbdbcc03cdf3a4f763119028870e62a87","sha512":"791366dd85714da6fbd61f3e1821ace1f72ba39584b214163c6f84106b4706b23efb73c226a9647593051f4673977bc7d8ee666d1412fe0f780db29cd4c1a58d","ssdeep":"384:YkrVIgDMt5klSiAOq/hNVSPp1Zi3cUK1NU:pZI9HklSiiZAp13U","tlshash":"3952c0214891b4bb47d27841a098313a7dc20262e3d73670a6bffe51f52b8d9a7d7191","first_seen":"2026-03-11T03:03:02.998424Z","last_seen":"2026-05-27T01:03:35.301878Z","times_seen":6,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/stickers","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/stickers HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/json\r\nContent-Length: 474\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":474,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"243a6411a0ba229e05f4555b216c9f4e","sha1":"622b45b940d78ab1bbb0c0a1c9957066a7b37978","sha256":"15fd4520ff98c3324fc294df2aab4031e4e953257e6370886208bbc40c2cbaa0","sha512":"46290fb43517bfd9124ad0e9b2c884ccd7d2f33879326685717cbad8dab406cbdc1498845fb04fb5fa765e9e8e1f47b3df988ec90f3c9c981b2b6032ba55e660","ssdeep":"","tlshash":"c8f0596c6f90a6c60b73a0f1628f9535cce6803118b4d9c4e32798bf436c46d92fde25","first_seen":"2026-03-11T03:03:02.991689Z","last_seen":"2026-05-27T01:03:35.307702Z","times_seen":6,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCHE\u0026sid=xjtxPYiIdfIDXcMQAAAz","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCHE\u0026sid=xjtxPYiIdfIDXcMQAAAz HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccess-control-allow-credentials: true\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"very short file (no magic)","md5":"1679091c5a880faf6fb5e6087eb1b2dc","sha1":"c1dfd96eea8cc2b62785275bca38ac261256e278","sha256":"e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683","sha512":"3c9ad55147a7144f6067327c3b82ea70e7c5426add9ceea4d07dc2902239bf9e049b88625eb65d014a7718f79354608cab0921782c643f0208983fffa3582e40","ssdeep":"","tlshash":"c700000000030000c00000300000000000000000000c00000000000000000000000000","first_seen":"2023-03-07T01:10:09Z","last_seen":"2026-08-20T06:45:28.843201Z","times_seen":12134,"resource_available":true,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn1.telesco.pe/file/loLyYb4si8d35NrPRHiR1FawMEM3udV3IEI2ViKie4pVHYjd9Mqnq_Yb12GuZ4prd8hvsk19nYRH6q0PaWDT1vZgJr6Vm_qX2lkiNzFrcyA7bIglQ9nfXU0thdlh33ZcoDNJF77SRKkaSL6vWIe_k04orTVpH6u7TLZL0hvreM00mweBqicf72LZjvuDtU2Q22Xi02K85MQpC0JM-jAqZChDY9mFWkoFaJYqd1HTxYgZgzrJGHK1y4OiYjaz-YqziLDykIwfdgbHFPUK0xORXcTXO-LCo4P3YFvJRupwTIDlBxmYX7gpoTNbZKrA-m-sgwaSVirDN7F_-axRQpfMKw.jpg","fqdn":"cdn1.telesco.pe","domain":"telesco.pe","tld":"pe"},"ip":{"addr":"149.154.175.204","port":443,"asn":59930,"as":"Telegram Messenger Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telesco.pe","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:08 GMT","end":"Sun, 13 Dec 2026 15:14:08 GMT"},"fingerprint":{"sha1":"C8:B7:EE:0C:41:13:71:AA:B4:69:B4:2B:EE:EF:79:F2:1D:49:37:9A","sha256":"2E:8C:0C:6F:B4:A0:E5:EB:6D:C5:3E:78:51:7B:E3:75:51:D5:DC:6F:95:AC:5C:68:4F:BA:09:91:35:E0:3D:2F"}}},"request":{"raw":"GET /file/loLyYb4si8d35NrPRHiR1FawMEM3udV3IEI2ViKie4pVHYjd9Mqnq_Yb12GuZ4prd8hvsk19nYRH6q0PaWDT1vZgJr6Vm_qX2lkiNzFrcyA7bIglQ9nfXU0thdlh33ZcoDNJF77SRKkaSL6vWIe_k04orTVpH6u7TLZL0hvreM00mweBqicf72LZjvuDtU2Q22Xi02K85MQpC0JM-jAqZChDY9mFWkoFaJYqd1HTxYgZgzrJGHK1y4OiYjaz-YqziLDykIwfdgbHFPUK0xORXcTXO-LCo4P3YFvJRupwTIDlBxmYX7gpoTNbZKrA-m-sgwaSVirDN7F_-axRQpfMKw.jpg HTTP/1.1\r\nHost: cdn1.telesco.pe\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 14841\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'none'; sandbox\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\naccess-control-expose-headers: Accept-Ranges, Content-Range, Content-Length\r\ncache-control: max-age=10800, must-revalidate\r\nexpires: Wed, 27 May 2026 04:02:58 GMT\r\netag: \"dd05e639452868d4e6383c7876a52b7cbdef3fc4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14841,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 320x320, components 3","md5":"001965790683d1f2d5b243a96943382c","sha1":"332f92c07b2f102a67e123cca798f204d981178e","sha256":"9677bb5c0ad09bd02565f91b54c6245fbffb1b423e405a7b1d7c6fb8a5f489db","sha512":"e4d926317a5fca8473aa3563506d46e8ffe72f7978f014df9ca680ab91fb2db88c986baa3a0e439ec59e8fd75152870c9d574bbced5dd940255f147e425e2547","ssdeep":"384:Wqn1EvlaUOiDPVJkA4qpkuEOQxXU3nF9JXheiOMM:WzvlaUVfkA4qiFxEXPJvTM","tlshash":"c762d032a6091e35d55a7a61ccedcfd4bf20ee178db014afb61d1624bb80ae3885cf15","first_seen":"2026-05-26T20:27:54.799756Z","last_seen":"2026-05-27T01:03:35.308588Z","times_seen":2,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":339,"dns":19,"connect":125,"send":0,"wait":268,"receive":1,"ssl":193},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn1.telesco.pe/file/mu64lIDj4M-vxSQTybw_AN0ffKbRJ2RKN5up4c4ANehgGHn8oDXr3JVj9CQl9_J3DZBhNF2Cx66wZ5CBohul2ICA57X_2OL0_gXqkbU5C8HabKvu9xySTziQd_gxCWCWJKf0FX-dvwewJuXzzc6gWJ-q2Edf1cmIlzss4_Zu3gmBZ6GPWT7d4D-uN_uOc1fUpt0nnZM-fUh3SGTsAZoGD3txmQrCF2I7JwMO3v3f5yjuA5JpcOMuBPtN24JG28_aQ_zqz48ke_u7INm0JAPtxn3Lm3hLxy02zgreM4XBczZwj0uGv9jUqZC3FUcjU4dvs96RR8H3b0H_rUGLr1ZCcw.jpg","fqdn":"cdn1.telesco.pe","domain":"telesco.pe","tld":"pe"},"ip":{"addr":"149.154.175.204","port":443,"asn":59930,"as":"Telegram Messenger Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telesco.pe","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:08 GMT","end":"Sun, 13 Dec 2026 15:14:08 GMT"},"fingerprint":{"sha1":"C8:B7:EE:0C:41:13:71:AA:B4:69:B4:2B:EE:EF:79:F2:1D:49:37:9A","sha256":"2E:8C:0C:6F:B4:A0:E5:EB:6D:C5:3E:78:51:7B:E3:75:51:D5:DC:6F:95:AC:5C:68:4F:BA:09:91:35:E0:3D:2F"}}},"request":{"raw":"GET /file/mu64lIDj4M-vxSQTybw_AN0ffKbRJ2RKN5up4c4ANehgGHn8oDXr3JVj9CQl9_J3DZBhNF2Cx66wZ5CBohul2ICA57X_2OL0_gXqkbU5C8HabKvu9xySTziQd_gxCWCWJKf0FX-dvwewJuXzzc6gWJ-q2Edf1cmIlzss4_Zu3gmBZ6GPWT7d4D-uN_uOc1fUpt0nnZM-fUh3SGTsAZoGD3txmQrCF2I7JwMO3v3f5yjuA5JpcOMuBPtN24JG28_aQ_zqz48ke_u7INm0JAPtxn3Lm3hLxy02zgreM4XBczZwj0uGv9jUqZC3FUcjU4dvs96RR8H3b0H_rUGLr1ZCcw.jpg HTTP/1.1\r\nHost: cdn1.telesco.pe\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 19909\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'none'; sandbox\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\naccess-control-expose-headers: Accept-Ranges, Content-Range, Content-Length\r\ncache-control: max-age=10800, must-revalidate\r\nexpires: Wed, 27 May 2026 04:02:58 GMT\r\netag: \"5e6158d6e69b8c0fe24e3fe160c6f17337a1bc03\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19909,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x320, components 3","md5":"13ee94fe1be4068cce0e6a5f19de1876","sha1":"3ee71683610ed2db24f8f4852eff755bd347e485","sha256":"10650d87ddeadfc5c7e6b850be9fe706166db7651b35327441b96a05b27a71c7","sha512":"a5f6c3661e9941111a35de22760d96162d370883041be2db361b0afe9d66aa72369c3a867d8bc27c6b1c060e83d1889f0d715f50421a900f0414280ee69710f6","ssdeep":"384:JLanzXgm33+DTK9Y8JX13U7NaPGULVayhuNcX/1RXPGJMt6V3EjcRVVpVM:JLarzOG27NaxLxuubXOJMtM3EjcbVpVM","tlshash":"3892e1477777d282a3e11ad4ce20bd437b53dafa4bf6bb927caaa72d212705d4714400","first_seen":"2026-05-26T22:45:38.787148Z","last_seen":"2026-05-27T01:03:35.310511Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1006,"timings":{"blocked":327,"dns":0,"connect":125,"send":0,"wait":260,"receive":85,"ssl":205},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCF5\u0026sid=xjtxPYiIdfIDXcMQAAAz","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=polling\u0026t=PvczCF5\u0026sid=xjtxPYiIdfIDXcMQAAAz HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\naccess-control-allow-credentials: true\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5730,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"data","md5":"d2fbd6de11835c22c95041d46e91e5b4","sha1":"cbf72a00b476a22b2eb93f5cd8868dfccf59f0ab","sha256":"e6995b29dbe23b31261eecb67fe3f9c37423f1ad71d6c404d014b74be6579658","sha512":"572e5d4c5fc7752103533db04b21d6686b8e266fe324cf9b525f90a850193dc706b51361e40d77d25b403177aae2313f665dbf2659c24778318f5aadaf913a2b","ssdeep":"96:fbr04cZk4HsqaqJ4LIrH0rs6fjt139j0jRjRk49ob7Pxl44Kxi4:fbr0rkYQqJ7z6fjt139j0ly3ZWq4","tlshash":"93c133bbb67201bf86e3a9f9641dfae421afc0ea2170c76994b85b4447ed2460006a17","first_seen":"2026-05-27T01:03:35.323065Z","last_seen":"2026-05-27T01:03:35.323065Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/stickers%20animated/loopa.tgs","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/stickers%20animated/loopa.tgs HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:57 GMT\r\nContent-Type: application/x-tgsticker\r\nContent-Length: 12475\r\nConnection: keep-alive\r\nlast-modified: Mon, 27 Oct 2025 08:34:28 GMT\r\netag: \"6d2e35a3cf2a10c0e58e5d087d5d4c0d\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12475,"size_decoded":0,"mime_type":"application/x-tgsticker","magic":"gzip compressed data, max compression, from Unix","md5":"107862dfd4b5860087254517d55f8b4c","sha1":"792bce7e3ad7b512578b4a40f747d2b4a47ab118","sha256":"165e1f86f980adc9044057f43f2af441e0dcb1547e7356f1cba536175885033c","sha512":"7295d63559a5b50996d54bb74b1606d4a9c60785cf95d95957a49ec2409aa5a40de390f1ec3a444808131b63cc47255aba013379e9718ac6d1be52d5168f20c2","ssdeep":"192:ZkTZ43euhQMY01bOCJ4hDRsncAgsWgFq7Q7Pg2/4l/2HNob2HCOPyEvUrqwD:MWxe+z4JCBAAT4dG6iHHPRMj","tlshash":"aa42d0a764882322be9d7db0d013c20d419456f6bfb417ec77fe99785bad8148007a3d","first_seen":"2026-03-11T03:03:03.007659Z","last_seen":"2026-05-27T01:03:35.325974Z","times_seen":6,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn1.telesco.pe/file/tKP5DINj-YrLBhjoK_Uc9mH09_KMVwuj_AQt6kviczQA4T4hmkCaNRF1ZgOXpk7DxBpTYe-wOqUL1sZHsR6qQeRpyLHnpIQ6pV8JL00YamrRq_tukZ8ArBDqmsnAFkHlrb8MC6zTaJAWgDzZ3fBG7EmYCsnYKoS-W6GFBR89v8NOsG--iFQKIafGwlA8nmBZNLieSQK3evSarsQSMRs2kdI-t72HVXOaZVibGyeVZErjtto761HsVNC8JnYjK0qvazspNBuIu7yL1j3jCk--Y4s1EvKdlM65iTm49ojlvQ4bcWTeXQzalaMyLWLWxgY9ZbNY4f1XpFgHSw_x26loMw.jpg","fqdn":"cdn1.telesco.pe","domain":"telesco.pe","tld":"pe"},"ip":{"addr":"149.154.175.204","port":443,"asn":59930,"as":"Telegram Messenger Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:57.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telesco.pe","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:08 GMT","end":"Sun, 13 Dec 2026 15:14:08 GMT"},"fingerprint":{"sha1":"C8:B7:EE:0C:41:13:71:AA:B4:69:B4:2B:EE:EF:79:F2:1D:49:37:9A","sha256":"2E:8C:0C:6F:B4:A0:E5:EB:6D:C5:3E:78:51:7B:E3:75:51:D5:DC:6F:95:AC:5C:68:4F:BA:09:91:35:E0:3D:2F"}}},"request":{"raw":"GET /file/tKP5DINj-YrLBhjoK_Uc9mH09_KMVwuj_AQt6kviczQA4T4hmkCaNRF1ZgOXpk7DxBpTYe-wOqUL1sZHsR6qQeRpyLHnpIQ6pV8JL00YamrRq_tukZ8ArBDqmsnAFkHlrb8MC6zTaJAWgDzZ3fBG7EmYCsnYKoS-W6GFBR89v8NOsG--iFQKIafGwlA8nmBZNLieSQK3evSarsQSMRs2kdI-t72HVXOaZVibGyeVZErjtto761HsVNC8JnYjK0qvazspNBuIu7yL1j3jCk--Y4s1EvKdlM65iTm49ojlvQ4bcWTeXQzalaMyLWLWxgY9ZbNY4f1XpFgHSw_x26loMw.jpg HTTP/1.1\r\nHost: cdn1.telesco.pe\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 9271\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'none'; sandbox\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\naccess-control-expose-headers: Accept-Ranges, Content-Range, Content-Length\r\ncache-control: max-age=10800, must-revalidate\r\nexpires: Wed, 27 May 2026 04:02:58 GMT\r\netag: \"42c18befa005f272ca0edf1233f3350c0d174c21\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9271,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 320x320, components 3","md5":"e18f73c3a5cbc05003398dea37b5db50","sha1":"55fdba437cb2e89722979f005ad992c785c423fe","sha256":"5f8ef1d99b5150a25c94ed036c57a62bbabf43db266406563d68c83f1a0f799a","sha512":"e11571e42ab84895d6de7705f9cb32850a191e323d469959ac7f71afccb3955d313b080ca7e7baefd4e16dbec30d9869969346dda493a9ef1dfd8e19e5a7f4f4","ssdeep":"192:E/DZEZl83ajEAYllkUHxBevL1sGuYsZCctSI0ftj2bek5R+JY:uEZl83at8hHevJsGL7kSIYmerJY","tlshash":"301206d56c8058809ede52f9cdd22643c70a9532ff73bdadac993ca6e141f2d0359384","first_seen":"2026-03-11T04:05:03.795379Z","last_seen":"2026-05-27T01:03:35.326993Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1006,"timings":{"blocked":329,"dns":1,"connect":125,"send":0,"wait":345,"receive":0,"ssl":203},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/state","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:03:02.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/state HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:03:02 GMT\r\nContent-Type: application/json\r\nContent-Length: 5639\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5639,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d5bed54c863647049a87edf69066eae6","sha1":"b72cf5b42212c92fcb93a893400fd70433c459a0","sha256":"1aacd841d1e6f2c32562f27a044cc4a33f410bb0468d97ce9b7bf989eefd60f6","sha512":"7af2a73d3ca2e217b0b900d27a677e338f08423344084f62a8e6288c5c0a1d8a19f1a48c693bc4baa47906de928233f451bc3a7957ef5ff884920b05811d0021","ssdeep":"96:Xbr04cZk4HqqaqJ4LIrHgrs6fjt139j0jRDRk49ob7PxW44KxD:Xbr0rkY6qJ7P6fjt139j0lS3Zxb","tlshash":"83c1447bb67301bf87a3a9f9741cf6e431afc0ea21708b6998b85b4447ed2160147a17","first_seen":"2026-05-27T01:03:35.289047Z","last_seen":"2026-05-27T01:03:35.289047Z","times_seen":1,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/api/state","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:03:07.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /api/state HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:03:07 GMT\r\nContent-Type: application/json\r\nContent-Length: 6965\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6965,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7f773f4371865702cb505c3400ce376f","sha1":"7e1ca11163dfc2c867ce2f2205f5378e57ac79e1","sha256":"96bd0f3d3162bb8b955c1b6e33270c3d50ce2c1c85916a3341602cd69e716335","sha512":"5ff5cb622905d371ffee602bb6244fa302b47152e8888e8ba406f6854a083cd816cb7a836736e972e1f7eff09bd1736a97d0c5f6f3c73ec0408ff6c087585e4b","ssdeep":"192:Xbr0rkY6qJ7k41lIiO6fjt139j0lS3Zxb:XfwNF1iOrHN0g","tlshash":"67e144bbb673017f87a36db9742cf6e421afc0ea6170cb6898b85b4447ec2160157a17","first_seen":"2026-05-27T01:03:35.327922Z","last_seen":"2026-05-27T01:03:35.327922Z","times_seen":1,"resource_available":false,"data":null}},"time_used":573,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":572,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/webapp","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T01:02:56.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /webapp HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 67399\r\nConnection: keep-alive\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":67399,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (639)","md5":"0bf2a03808a2d2aba20c3f3692848818","sha1":"459da6c61b49bd941650da57cd92124d149ba6b7","sha256":"a8d7d0ecc100f7b46fbf4bfeac37af4f17908c363d4c3f3491979d06d23ee83f","sha512":"845af8622f6b93a17de690865cbe05b2ffd7e5bf06557cfb2f989474fae0cf95ebeef8e94ad0a83daf3962caa0ef8e6717c6a8f70ac31058a8aa9ea1bd9ced5e","ssdeep":"1536:HcUSzvccIuZhhOqFozqc+GOo5nX0GZIfVVoGzW8Ft+//e:HbcIuZfFoOEOtBzQ/e","tlshash":"11633e2050f8253a914380dbbb65ab1b3ea1e597cb4e0305babc0be45fd3ca6dd1715c","first_seen":"2026-05-26T18:10:15.859321Z","last_seen":"2026-05-27T01:03:35.330194Z","times_seen":4,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/telegram-web-app.js","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /js/telegram-web-app.js HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.30.1\r\ndate: Wed, 27 May 2026 01:02:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 05 Apr 2026 10:29:48 GMT\r\netag: W/\"69d2399c-1c675\"\r\nexpires: Sun, 31 May 2026 01:02:56 GMT\r\ncache-control: max-age=345600\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116341,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (768)","md5":"e327f60ff0d85c31034e21c908154d57","sha1":"d83f8a3062b70f51147c1501891b4523db34674a","sha256":"bcc5e1ca219fbea9498e826e0f5648603582c7988ec8c3ce0b85c86a9eb6299c","sha512":"fb1a2abec070c64dcda00d503093d2d1d2c30cb2a0bba78bfd2fe117e7eb159079216370e560d13dbed2f614b1e9cf7a127bff4685a8f3cdda7b02009296dce9","ssdeep":"1536:pOpTpRdoKd4F0WN2ZbBcn9cF9KTfVjLo03ueLE+wFFz1NIVIB/MGYV7p/xHK8ITq:spTpRdfcKFU7Rx1v","tlshash":"aab33e4d6cb3612285b3b1bf8b5f925172719883301def20794d9b646f80e7c53eaad8","first_seen":"2026-04-05T10:46:58.564832Z","last_seen":"2026-08-16T11:26:19.734321Z","times_seen":2814,"resource_available":true,"data":null}},"time_used":683,"timings":{"blocked":303,"dns":19,"connect":28,"send":0,"wait":73,"receive":0,"ssl":256},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"popa-market.xyz/static/webapp.js?v=717","fqdn":"popa-market.xyz","domain":"popa-market.xyz","tld":"xyz"},"ip":{"addr":"84.200.89.74","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://popa-market.xyz/webapp","date":"2026-05-27T01:02:56.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"popa-market.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Apr 2026 17:06:11 GMT","end":"Sun, 19 Jul 2026 17:06:10 GMT"},"fingerprint":{"sha1":"D0:A6:14:19:C3:FB:88:B2:B7:89:B8:0B:DC:D9:F0:2D:86:FA:12:18","sha256":"D8:AE:76:AD:31:D4:A4:F9:74:97:79:93:4E:F4:A3:24:18:D5:0E:87:10:6C:01:14:F4:CD:A0:BF:31:27:AE:12"}}},"request":{"raw":"GET /static/webapp.js?v=717 HTTP/1.1\r\nHost: popa-market.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://popa-market.xyz/webapp\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Wed, 27 May 2026 01:02:56 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 379103\r\nConnection: keep-alive\r\nlast-modified: Mon, 16 Mar 2026 23:02:27 GMT\r\netag: \"63b8f5a85b4a178f596702f5efd6afd5\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":379103,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"34d5fd850e8ea929d07f1f9498d3cbcf","sha1":"fadd8e953ae5d51511efaccf4c5db9633c7c3cc3","sha256":"ed2b8111eeca06d687647570944477b470256c89d43d58e4dfc2c660c6725dbe","sha512":"82a7af0d13a99641b65e2f67de1e2d2e0f0fa09b4a8da4df002804274f8a6b56686348c7239418af5280317a83d1bb0ade36dbfacddee7ac7f461fdf94e6ec2a","ssdeep":"6144:RvPM4y6BkAMuIxO4cR5nUAGYQcDHoC/wfBIkVCVXUxwpifxXQtDDjSdGqXEN:RvszAbRj5sxwpiED2dGqXEN","tlshash":"0a84d75a213510350872a3bbd717a619fe77c0373602c394bdac86582ff2d6496baedc","first_seen":"2026-05-27T01:03:35.332045Z","last_seen":"2026-05-27T01:03:35.332045Z","times_seen":1,"resource_available":false,"data":null}},"time_used":464,"timings":{"blocked":124,"dns":0,"connect":0,"send":0,"wait":55,"receive":179,"ssl":106},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"popa-market.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}