{"report_id":"6e7ff197-ac25-4475-a56a-7dbe5ecf3548","version":6,"status":"done","tags":[],"date":"2026-06-06T23:29:59Z","url":{"schema":"http","addr":"oreprotocol-research.com","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":0,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"final":{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"title":"ORE Protocol — DNN Research","dom":{"size":7094,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"bda5c4383e67c06285ce6dbcacc75889","sha1":"60357da35fdd9fe85376353a4421f3427e7a4903","sha256":"d25372d92944be2c49234c3c876480a8ba4a190117f3280391c7756c2eda21d4","sha512":"23bbe2f2ad928d2bdb30ec019aac84fcfa2ecc7c270a15d45b88ea279d0cde4521e484f343059bf5eb3eec0da135a78a3ebaf63890814aa63f2a126fc6907436","ssdeep":"96:npbv8ryNBnUvFtFqsr9iesna0STwyBAnqz5Pe6FRYm4ED023D71blj:pr8rOpUvFtBrQelruq9Py237j","tlshash":"b6e1456a3ab30551f26381e47be3960632949513e00ec6947bdc6198cfc6fd8ea7368c","dom_hash":"domhash061665d3b431849e93e7291a7461cd9c","first_seen":"2026-06-06T23:30:15.34687Z","last_seen":"2026-06-06T23:30:15.34687Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"oreprotocol-research.com","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":0,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-11T23:29:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"oreprotocol-research.com","ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"domain_registered":"2026-06-01","domain_rank":0,"first_seen":"2026-06-06T23:30:02.736853Z","last_seen":"2026-06-06T23:30:02.736853Z","alert_count":134,"request_count":67,"received_data":9619148,"sent_data":34108,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-05-31T22:18:21.058888Z","alert_count":0,"request_count":10,"received_data":736374,"sent_data":5551,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-05-31T22:21:48.210615Z","alert_count":0,"request_count":2,"received_data":38029,"sent_data":1186,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"c3e3e350f78cf22bd7b335d70b41a58a","sha1":"cce22220b6a8dff76692755cc45439b4ec474a4d","sha256":"ee6bb81f4e9fc030a39a7c71affc4d1f2b900baa4b4c7af83361388d7c39599b","sha512":"15b6cbf8bd67e82a4952004138ebc95c44e4d373317826f1560eeec13416cc1d6a38d834609ef4b713e7a9c92d1b1bbf84de08e2e4061ed3d1e3891982c25b0a","ssdeep":"","tlshash":"3f90025ff2302063a756122b166f15456421626565550869123830eb4955148474265c","size":57,"data":"","first_seen":"2025-06-30T14:23:19.448274Z","last_seen":"2026-08-02T21:14:23.436494Z","times_seen":64797,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"1a6e1178e4bbf5730bd664a49dd3bc24","sha1":"17c3ae3273f9de6afbbdedf2e413dbb3a6722792","sha256":"3814cddd18b2095e01abb745a99e5ada90178e709c09879324c3b623f2d829ea","sha512":"cfb1aab0bf589e33fd12906f448ddbbf7163420a088de513b174304c9ba3a7abcd9b41c98bc4dd51edd0206c1fe4660db9857e3c6163d1bf50c670cefddee509","ssdeep":"","tlshash":"de9002b090c39c5890264186687100160b6c040c01080141132184d810115048e40d8e","size":43,"data":"","first_seen":"2023-03-13T01:07:12Z","last_seen":"2026-08-02T21:50:04.14434Z","times_seen":212114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"1e238cc276d579d4df7fd663bbfb79c0","sha1":"23fe0c757ccb5991cd9b864f264006adfc4adbfb","sha256":"c4d7af5656eef9ff6bbc4358c633616b2036edb7c83b319952ab16b3892d3509","sha512":"93bbc441f6f73a0ef2fa2f68e0e3b61058a427a0e5572d41654fb9d4bb78d0aca596803758e2d1b84db9777777221ea303b21a47d1062024b165e38bfb999c8e","ssdeep":"","tlshash":"4df08bacf308fac66932cf2b99a35d6014d8ec3c0130f399a49ece1d0131c7ea289440","size":560,"data":"","first_seen":"2026-06-06T23:30:15.442655Z","last_seen":"2026-06-06T23:30:15.442655Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/2619-3c9e02e22d10480a.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4cc3d3068e3a31f8f83d27813219bc68","sha1":"8dab60b372c3c71956d015ac2cb2ab43a0afbd58","sha256":"7fe044bde88179fcddab68e119ff3f40e55f3a0ecd8cec7fc420b14c9f350f9b","sha512":"2f514d4a1e1147bdeeaab99443bd61bb23f1192281a24f14bc17f7f2ac7684a921baa8bdbb2cd3da8b1677f3c9b1c034bef82156ac2cbbaf384bde7423dadbd8","ssdeep":"192:7YOHC0dwMcGWRYxxURMeobT9jZIc2c3GbWekT:7jimwMcGWuGMFIot","tlshash":"9202c8ea75e1f8e2836b0150443b100bf37e1db5181ea184e7a95ce6f9b046dd1f2f69","size":8538,"data":"","first_seen":"2025-08-29T10:45:07.911289Z","last_seen":"2026-08-02T22:11:32.794131Z","times_seen":2169,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/1255-a390e12b70b4a9fb.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"be738271ca5983daa35a92332b81c8d3","sha1":"ba687c6a550a40d9b6284dd61fa7ce9d512f3b23","sha256":"47ed13ce8be701da4f30f75a0921f7cdbf11310a54f9d837d8ff3ed104e0ce1e","sha512":"769e351e47d3c2dfa0aa30f68cde58f36f4e2d2d3c77dd824d558bac9267f45b15de4b94423510eaf3e989f52cbc318c553b2de23661216ae3be74ab44613889","ssdeep":"1536:7h7TN+Izz+cHr6U5eHM0db/7ZcyBPo7ecq0MEsiTtaocZXxreXRNIrky/SQhuzQP:NTN+UrFJ0NLwF5+4RN0z/SQuLi","tlshash":"7df3dab676d0f8e107a780e5843b400af3295c37146f74a0a3e6dcd975605dea1b3faa","size":172501,"data":"","first_seen":"2026-02-05T02:39:27.872328Z","last_seen":"2026-07-29T00:40:15.996022Z","times_seen":164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd8ba0870127fd5f579f2547c152633b","sha1":"b0de21091fd3080fc0e145ceb8708b7410b58479","sha256":"f26357c659feda167668881da57b85e1ec92f7feb0fc443d4f9079bc5c5d0872","sha512":"489f42285a1d34dfddcf6f94925a7be6b1a8ae3488268e9fa4e497333de1bf8e09332f138fbf253ce7163ae5284705591633d7ad2d6bcd422de9727a353c5576","ssdeep":"","tlshash":"31716b2e2405de8bedbe3d69027e9d3a50cd497f0791caf88699cf140a4247927eadc0","size":3775,"data":"","first_seen":"2026-06-06T23:30:15.443867Z","last_seen":"2026-06-06T23:30:15.443867Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"8ce07cb47e5558002f5828891c1a5205","sha1":"309811d5bf33a032bc1220a9d1b3cf5cbae39690","sha256":"029db9af34a73ec68a0640f73a48834a94fb47cc94717c55aad9db8a9db94ef2","sha512":"9043223b23f6749179283f906d3ab67dbebbeb03d4c748aaa333226aef39f742be6c03b53cb8f39983e781e8eda30460c0e220956fbf628849dbadac23519b58","ssdeep":"","tlshash":"8bd022919c43cc1cc3660f22283a1d2a21cdc9a8030645479c85da2c5981a7405b1ec9","size":202,"data":"","first_seen":"2025-09-20T07:52:44.154128Z","last_seen":"2026-07-12T10:47:05.520616Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#207","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"25cae79685878832636f99f499b4ef71","sha1":"366bfb11ae68a1d9dd7c631a3e941dcb0b330859","sha256":"ca4b8f1e9aedbf68891dc3a344489af3c64027623240abe9f5f018c4fdbe61bb","sha512":"8268f2ae4aa353b5f6f1392a2f175fbeb01c76543e594f058ecb8c17d3f0472f0e5e7e27417f8bb642b9e812f31478dd89074eed4332b8992d7b82e617afae50","ssdeep":"96:juPyJTXf61sZ1vR/wl//AO+oBwuS6nppYpfKlLy9GjVMB:ju6SmDJS5FyaYpylGkjVMB","tlshash":"9da16485f17217b3404709f62a2b606d91215003fa1ffe8c7e2dc1aa4fb66305a336fa","size":4830,"data":"","first_seen":"2026-06-06T23:30:15.446477Z","last_seen":"2026-06-06T23:30:15.446477Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/main-app-05a5fe279f4f6e20.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b4d6767c982f0055f00c6d65044e992","sha1":"92113bc786df1f2262c09ec57a9ed70bcf7a4649","sha256":"87b9a732ab18663476fa44da250cbf5826a514ffe1218fcb02065557c6d259a7","sha512":"c0bcf382c8783629fbc6a301d4433ec043bfd49e520113d0934a4343b61d377ae3f79d6808e9c3246f5e813a78bde6607cf9cba78a3822460205f94f417329a8","ssdeep":"","tlshash":"d7f0f45a8f0cf52f5c26ad64fe97ace2285f4175302b4e647914eea23c23bacd270409","size":560,"data":"","first_seen":"2025-09-15T02:14:26.454228Z","last_seen":"2026-08-02T04:15:59.52191Z","times_seen":148,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/app/r/%5Bid%5D/page-134d52df2ac5dbbd.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4696654880dcf9525e5f711a8ef687b8","sha1":"151ff4148d77a761a7bfcf7c4d6c2f3e9ae2478a","sha256":"bd657f71b8b464daa34fc0ab390931d8d048619d3b9292dd88dcc96c11adf2b9","sha512":"81628b87bf90c181e629effa5e26d9d751e90a2a290b0110e1948077d445df83c55f2a7819b982817dacc7b628685d966264e6cba5ec6abc69eb32ebad699139","ssdeep":"192:XHp4zk7lMjZccFdmsmVExuGfy6BsP8Ut64VVusT6:XHpUk7lMacDj+OuKy6BsPRNfus+","tlshash":"5502d710da50a690ff7746ecb3cf401c60ab362c159e89b87b75a43505e16f2722bbda","size":8427,"data":"","first_seen":"2026-06-06T23:30:15.375025Z","last_seen":"2026-06-06T23:30:15.375025Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"a280e7123f6e224694ae746946d57630","sha1":"dc412700de30b347387a92f714369fece2087a72","sha256":"40896243b64f6024a363a7bc20c0e6052d4b020e43f15fc6123455cf4203e15f","sha512":"64d110667310fb6c4109d554c8e7a608385f85422786aeb615ead49bdd62aea5858836a1a3d13c2c33d0355957def2202d98b409483ccedf9fde7f5d9cbeda32","ssdeep":"","tlshash":"a24108f2ed15de098bda5e24283a7cb4a0ccc3968195a15ff66cdd3881c7d3089f2652","size":2054,"data":"","first_seen":"2026-06-06T23:30:15.44779Z","last_seen":"2026-06-06T23:30:15.44779Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"20281e45103fdcedd0a42ece4b5d8566","sha1":"365152b9a541be927ed138e1b4a9eaeb8b0fe0de","sha256":"f158da4b9371d073bc1d9cca38044807cb946788682b45acc28a6cadbba77aba","sha512":"92f35e9bde5ccb7ebd0ed0d1d85bf89f719bc588aa9458453c0df76843d28470015e2616fbee4ee915659dd6fec41a9c4b52fb78ac3b5c09501b5a8b8d86b4c1","ssdeep":"","tlshash":"cb900470f1400c574431001314fc711115dcd14c04010d001f515f473c131557f0dd47","size":45,"data":"","first_seen":"2025-07-25T19:48:55.250327Z","last_seen":"2026-08-02T19:48:40.511631Z","times_seen":5946,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#203","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b2af48b095406d3f77c29122fdcc05a0","sha1":"0979bdac1391d4398ab0da861970d7f9957e1f9f","sha256":"609ad9ccb0faed827efbbc44034805f84dcc76022f3be936823e937d8421df00","sha512":"e3e666cc452c85d6f07ab76657542fb4d7b47c0e341a89ae5c0886b93db4bcfa5e78c53f8ab2bf76fa2debae2df470a6c7637484ac00d4d051734a5e7038a7f4","ssdeep":"192:Q+07JmoRXPewmRu3bdcHjcxZY30xoEB4Z:bPwP0/Ui0x7uZ","tlshash":"20e17552fbb738b314e3227b4fa742d422298013fa06c5d1beac87944f9eb5560767d8","size":7303,"data":"","first_seen":"2026-06-06T23:30:15.449696Z","last_seen":"2026-06-06T23:30:15.449696Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/7591-1163cd2384a5c934.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a58be6f3e0e0cde0f919857e4126c62","sha1":"c477f6a185f7283d9481f0e7b11969acfe9b5449","sha256":"0108cd7a95541c7cdb0cabd94256953518bbcc744b96b1bfd16e17b5d91a44dd","sha512":"d70faf0cf7ee9813e06321b9dc767cb4fab6d24e9446b296110b33053849b120c5db71a0259d5e9281a30cbbe5581fe73776ea9e4c86fe329fda3d4b6726df33","ssdeep":"768:UPMlPmigapBT+m3dakTkGfxtQW16IQ2VWVUBHENCPvJrUL/W325w:uMlPmkpN+m7626XRCBZ325w","tlshash":"c553d770a6823a84f05b865d76eb800d717a2754910e0af5fb679c3553c08f1baabfe4","size":64939,"data":"","first_seen":"2026-06-06T23:30:15.432539Z","last_seen":"2026-06-06T23:30:15.432539Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/4bd1b696-f785427dddbba9fb.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"7040f9644360f35f2b988c55e8ce4072","sha1":"87ad12f2bc364390c191172a9a9af6ad70b8e07c","sha256":"51a7146e32f6a18a96676813fd791cd1b0265c675292acb31196720ca9e79726","sha512":"9b801d74b75a094a73a2155b3d73d5344ee74cbcd27070ea57dafed253f73410770fcc2e7e4436636c7eb680743e717978f7f80a736bf8d691e9f9b2b96e7748","ssdeep":"1536:eWET9Lwegcl2MywYleojBFOQLfioEV7hNc7lFlgXGhJx4bzZc5zg5tgW/zAe6c0:S9LwzMyh1vLEE7RgXOQ5SIA1","tlshash":"def3f8ec3d99e611aeb342a700df28037378261b240d4d60a614fd9ea57845bb17bfde","size":173020,"data":"","first_seen":"2025-08-29T10:45:07.929156Z","last_seen":"2026-08-02T21:28:00.887779Z","times_seen":3579,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/webpack-b8e1e74fcc0052ca.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e285081c53552631a66df17c70a2fce","sha1":"1ef85fc9c0cab477ace702b2bb95d2b7e0c7b5db","sha256":"6c13ee589a2d721aec10dcac25ae29297c120b836049f20450bb3f1531279586","sha512":"65777105f4f823e9c5830d3963ed5a68053ccef9bd79308373fb5c2e106bac69afa80b32f4233c6e12c83bf3cc01296289257db1b815308b3ff083250e74ebf7","ssdeep":"","tlshash":"ca61b5a93625fab556f108c5887fc142f619603b051afca0e717dcb9b464aa10462ff3","size":3409,"data":"","first_seen":"2025-09-25T12:15:10.999909Z","last_seen":"2026-08-02T03:35:19.270982Z","times_seen":983,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"b3594c64cf924625c05a7010cafc018a","sha1":"0dfbc548122dea0a68476b400895ffa1eb22f645","sha256":"93268a0726ec1efaa676ae5171f84267e72b7c3d215b6190794cb4069d5f58d8","sha512":"8f1d3fdc6a2935557a199535e172a92c825bbd1b2ddf25cc9be3968fcd444cd0a4e023bd3eeb90c2c222588defbcb5f1ad05dfbd1f542eeb760769db532fd282","ssdeep":"","tlshash":"420156a9f32819da66d92fbfa06b570c7460203e380600319507edfa1700de021cbd8e","size":845,"data":"","first_seen":"2025-08-20T20:29:16.213676Z","last_seen":"2026-08-02T20:39:50.737728Z","times_seen":7162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#205","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f50e3da84a4074119975e41b09bf526","sha1":"2ba99af080ca93885b5997d165baae505c9a0cc0","sha256":"93e9bd8b77768dbf6e275fbf75d6687860d0e70d2e1376c76c460ee1efe0addf","sha512":"7db75f01db69778a9a6d5549380da90f2ca5644ab4b540726a359cfe089f2f4058798ee7769dee22d8c1743bfe32b0a9e482944104f812b2a092e232dc07c22c","ssdeep":"","tlshash":"5041afaaf5b76474e3ab62f66653711021a41212f40ac4d07a6c80855ff3f8d627f6c9","size":2000,"data":"","first_seen":"2026-06-06T23:30:15.451755Z","last_seen":"2026-06-06T23:30:15.451755Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/app/r/about/page-fb3267bd42b9580d.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"fbf3ea8947de47788ba4f3d84e2645bd","sha1":"b7ee8d2ea38b53bd55291d29e19e08633c8c3165","sha256":"3361cd6261144af13fb1fd2ce89b475ab3b45c8ac82734bd6837dd70e1f07621","sha512":"0393cae5a5506d8885b6fff9141ff08745c9591c9d46a5138562047c32c7f0843fc33d071f94aec675b2dc6a1b35dd38c7f11611778ea5aaa58a0f52a26caf72","ssdeep":"","tlshash":"a4c0229e22617a9ab82a1a68a8ba0c65358e402a391a988057014ca00062e588351c46","size":188,"data":"","first_seen":"2026-06-06T23:30:15.420475Z","last_seen":"2026-06-06T23:30:15.420475Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"f1d8410f129a659e882f6e80ef48b45d","sha1":"1d6480ba482cd0fcc0885d521778381d29e1b6d2","sha256":"8f1a66bb3132bd59867f5baedeb2e755bfbe69ce10d24878f5514897051fe90d","sha512":"2e54e53cbfdabdccce0dba0339a04be14d2c920eda6c5755914f646e83662898332fbacffdab854fe73d5d31dd4e4d469a06c89a4d8f48bad460bf2fd47403ce","ssdeep":"","tlshash":"cf6000300cc3000c000000c030000cc00c03f000300003300003030c0003cc0033300c","size":16,"data":"","first_seen":"2023-05-01T16:55:24Z","last_seen":"2026-08-02T20:39:50.739107Z","times_seen":10810,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/413542d481d40163.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/413542d481d40163.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1178 x 648, 8-bit/color RGBA, non-interlaced","md5":"9517e5f42a0e787607fc3de7312d2f60","sha1":"b585c3831ca5427ff00e34833262cf8f7f10e4af","sha256":"25785932896677b01af6adf03a62396078fd8bc53628ef549a9bec6d4152c18c","sha512":"d97fe14dc127c81339aaada0c1f4e16ca3f0b7f7aeda42c40a2f45e9be159c09c4709f482207888c6b35fb5818058a5b87c4ed1d7341f86da379c59b5763d750","ssdeep":"1536:K4ektdymoOa48C7IsvY+JSdr7hKgw7yp5Tw2kIej8LPkVcDrefG/E25d:XDt4mop48Clg+w7D5TnkIe8PwcSTOd","tlshash":"7d93e137e6315847c57423728e99876868349dcf94fd7388c4e87d26237e2ed3865c68","first_seen":"2026-06-06T23:30:15.353664Z","last_seen":"2026-06-06T23:30:15.353664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/f36f2ed5a4ae5816.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/f36f2ed5a4ae5816.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":328717,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2356 x 1296, 8-bit/color RGBA, non-interlaced","md5":"76f107b2e718675f7a6e46a531acb7f5","sha1":"861d6028ecd3cd67803bc1520943c44452536614","sha256":"0fb28bda58f4f838b023fe078df2410ae2dd589a9b75a3eb7a787fcc70c4e426","sha512":"c09df73fb60582113ed0fdc108a602b22aafeac901d1e59993a5dee5327103bf28c9c6ef8cbc8b33aa931b63b9e231656c7789fcdb6c8d6c022414f81568e21e","ssdeep":"6144:3VhyRhLSxA8UySw6zHvzaLa4k/YF8W3/I33xOx5Kf7fQy3HNDXznJAUKA1Jr/I:lkOAryAzbaLjF8WvI3xg0V3HNzzWw3I","tlshash":"a6644e13c972256f28bd641c670b29859533350fb011af5e8f3618fe3ea60b0edb5e99","first_seen":"2026-06-06T23:30:15.358244Z","last_seen":"2026-06-06T23:30:15.358244Z","times_seen":1,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/2b049436cdfdfd98.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/2b049436cdfdfd98.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":196882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1676 x 838, 8-bit/color RGBA, non-interlaced","md5":"7d2bdb977bd9f71393eb51e2a02029e1","sha1":"e7c921690109f302857327e5baf93279da42477d","sha256":"7c83e76da91187a6e8688746880d2d948d954d90552001f996c074100fbdc5ab","sha512":"ca271892d9cc0dc81b400a1bbc55a4ea33f8d23176d970c8bcd09a0f79c09a15d2b17fd62db010be2fb2563cf240c1a6790294ab175e306468f482a20b00df31","ssdeep":"3072:zakJtgc79EA+IiLGhO8Bgkm8NKafHA9psU+Y8DaYtJJ8hfJ9MZ6Ivxi:zaO97aXb8BP1NNHlLlJJ8hBgp5i","tlshash":"1c14df73de21687f16a55b512b437ad0c53d289ff43e6b4b8bc22b262b497c9f021918","first_seen":"2026-06-06T23:30:15.361779Z","last_seen":"2026-06-06T23:30:15.361779Z","times_seen":1,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 132000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 02 Jun 2026 06:22:59 GMT\r\nexpires: Wed, 02 Jun 2027 06:22:59 GMT\r\ncache-control: public, max-age=31536000\r\nage: 407196\r\nlast-modified: Mon, 08 Sep 2025 18:03:32 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":132000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 132000, version 1.0","md5":"f94a697b16502ea4c1ea76b541b93b30","sha1":"5d70b133857055167c6efd19eccdbc46d7cf328d","sha256":"6e4f2958c3a7c4a80acde4e5a679abe7e01bc1e30b92be3c7a8b696ef401d101","sha512":"1328672ab4c7021cd35d649e39e60e0a03c1fa72e0a2a69a5bb427d1de3afee51247f7080d8e747f3d3f44150777c39966f9464a710d14b9161ac1b20f7bd3b6","ssdeep":"3072:JMAwmOH7ouFuG6JdY7xvg5axaMgKLZBaOe5C+EoKkU:6mOHX+JAgsaduZBWKf","tlshash":"27d3125cf9d6170b980addab4c4aefd9da6e43f234790152a0e7eb799341c08bc8c275","first_seen":"2025-04-16T06:15:05.515218Z","last_seen":"2026-08-01T22:07:04.342309Z","times_seen":612,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/96cfdf703faa4dfb.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/96cfdf703faa4dfb.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/eb17795ed08f9d5d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/eb17795ed08f9d5d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cef83bb6dc56aada.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cef83bb6dc56aada.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107989,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1704 x 562, 8-bit/color RGBA, non-interlaced","md5":"12d3f16b29f47d591381e7c7b3d2f7fe","sha1":"4db0624ddd0d436dd5c02fbc9f9d905951268035","sha256":"e6c919ffd229d4ea1c246dbfa19535a505b2375eb51201e45bcb9600025d1dbe","sha512":"14a6e56e9e4f325fdc012e76c2a09bf71f74fb7d6c3407b0cebb8ce40b589fcb19fe3f796f8727f171c6c95123787662b9259f3a27795192abd24035e6a8486d","ssdeep":"1536:cwucxuLNInBjuGBrdby+Ych3k+aWCV9CN7hLL786HBGwajtkg:bvULNsyGBrdoaU53CvLxhGpkg","tlshash":"50b38a33c975656bcaa44b71075362c8993928ef397dbe4a5be4ad251f3f2ccf121808","first_seen":"2026-06-06T23:30:15.367224Z","last_seen":"2026-06-06T23:30:15.367224Z","times_seen":1,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/1b503e095542798d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.446Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/1b503e095542798d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60449,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1178 x 648, 8-bit/color RGBA, non-interlaced","md5":"6513d1a24cd1378f4eeddd6f7b4b09c3","sha1":"f7cbe77eb2250eb37ed06624cbe097a0c0f2ca5f","sha256":"a0fbc3dbf92890aae2a002c31d891de088fd8d4c388a1c6ebd931e66c22ecefd","sha512":"479568280a4c03a12799087831efef16cfb850dcfd213ceed0013cf31d5c10f8f5364a515fccceee9b858a03711ab90bcdd96808543840de2800a24b64151925","ssdeep":"768:Ly4Z7VnBHOnO3siJZoFvZQcGtnz/fwDUj4clIPIrwv1uq8dCUIYwWIhj3lbK1iGj:G4Z7VRJyvCcGtnznacOvv4qAIJ3lcEPc","tlshash":"6543cf2bdcca762f52010995a3877dd1f5b8216b79055f2f8fa2a4b32e272c0f670d24","first_seen":"2026-06-06T23:30:15.370189Z","last_seen":"2026-06-06T23:30:15.370189Z","times_seen":1,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/3401456c7636653e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/3401456c7636653e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/12998b0cdc0fdb10.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/12998b0cdc0fdb10.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/3c2b4eda88df0a9c.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/3c2b4eda88df0a9c.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":215386,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 1306, 8-bit/color RGBA, non-interlaced","md5":"b03688a6668bb8f4db01197fda15adbb","sha1":"8a7f0031570991ca5f5222321c1acd40065f7d21","sha256":"4cda14af36abc1bea35a67b8caa996e0ae46703d2059fbee95ed156b8abaf4d5","sha512":"18af23395fa85539d1279e6738361a4fcd05e515bef8e6084a45d486523832bc916057b65fd029106f7f1ee5b9a1c5daa65442f430951088f4c38e30c14ad3d1","ssdeep":"3072:mOUzLcu2aoTYsILBfXgbF2Y3/OocBFqpHAqg38zWArqUx8acP:mhwioTLINfXgbOoDgMz3rqUxHcP","tlshash":"202424a2ab50203a97c4cf805b576cd2e02d753ffc5f8a0a5b5b2b6739177cda86484c","first_seen":"2026-06-06T23:30:15.372609Z","last_seen":"2026-06-06T23:30:15.372609Z","times_seen":1,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/app/r/%5Bid%5D/page-134d52df2ac5dbbd.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/app/r/%5Bid%5D/page-134d52df2ac5dbbd.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"20eb-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8427,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8417), with no line terminators","md5":"4696654880dcf9525e5f711a8ef687b8","sha1":"151ff4148d77a761a7bfcf7c4d6c2f3e9ae2478a","sha256":"bd657f71b8b464daa34fc0ab390931d8d048619d3b9292dd88dcc96c11adf2b9","sha512":"81628b87bf90c181e629effa5e26d9d751e90a2a290b0110e1948077d445df83c55f2a7819b982817dacc7b628685d966264e6cba5ec6abc69eb32ebad699139","ssdeep":"192:XHp4zk7lMjZccFdmsmVExuGfy6BsP8Ut64VVusT6:XHpUk7lMacDj+OuKy6BsPRNfus+","tlshash":"5502d710da50a690ff7746ecb3cf401c60ab362c159e89b87b75a43505e16f2722bbda","first_seen":"2026-06-06T23:30:15.375025Z","last_seen":"2026-06-06T23:30:15.375025Z","times_seen":1,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/922b4474519528be.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/922b4474519528be.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cc5f61fe5aa16375.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cc5f61fe5aa16375.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":131410,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2356 x 1188, 8-bit/color RGBA, non-interlaced","md5":"b813a13eaf332ff3247eb07ea117b806","sha1":"64d24f0443b483f47abf1a0ff7b679d5955f48e0","sha256":"7d12c574ff4ade48903007299e57aec4dbae480c442b93790e96fb3d34a1c734","sha512":"af206856058d3e53fa3325c4e5ca65396ae9b096b5e82577b45be13ceff8d5a995490acd43a81f5d5b8335e2434744332fc5e1c0eb5b5157ba53434f05f7d9ad","ssdeep":"3072:H3Sy5RwjMUAXxcn0yI6DG9Tpm+ggvd8eYZZzuFv:jRu5AXxw3G9Tbg+QIv","tlshash":"abd3f346cb00243b76858a5577532897d5286c7bb91ace0a4bd3726f2b03ff9ec34c69","first_seen":"2026-06-06T23:30:15.377021Z","last_seen":"2026-06-06T23:30:15.377021Z","times_seen":1,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/d272d58f8e5f7c04.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/d272d58f8e5f7c04.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":205410,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 1174, 8-bit/color RGBA, non-interlaced","md5":"7e9b2d93bbe2657cf1334ebda3399065","sha1":"f7c26ece461e901df002911464af7c2e4dc9c0c9","sha256":"15e7f5962c93f7a1d3fd36a1ee529026d742c4aa91516b624287eced38a56c04","sha512":"00df7f560ed3130b267a541db0a44b92fcf2a9ba6324a83e475e095f494d8f337d10292554c18addd8212bce34383d60b588497bd9d36a43c38b9e2d5a7e3239","ssdeep":"6144:NBECLh2BOlZ7x7nkK8SH/quT8DpLJkdcMb:sDBONgKLixlNQ","tlshash":"5a145952db60203686e8db6157132dc0c03d34bffd2e6a4a4b535bbb3a1b7eca42195d","first_seen":"2026-06-06T23:30:15.378942Z","last_seen":"2026-06-06T23:30:15.378942Z","times_seen":1,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/db0d84dcd1e653bf.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/db0d84dcd1e653bf.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2849673,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1054 x 1492, 8-bit/color RGB, non-interlaced","md5":"7444c615ffa06959f1c170e5834ec61b","sha1":"8adbbb207646df1444e1b0fd26aca8f26116cce0","sha256":"af562ef6583ddfd3a7f34806c45c9a7908864329d59e6719e8d8357ba55f7e22","sha512":"78a24f33986a0b722644210e3fcef996626ed195dca2f0bdcfae904b03f2524f8d27003a4b233905f14c75a311d9c1e7c84556ceff1ba5e01475e7f0693ecb6c","ssdeep":"24576:kJPRZ+eYAoKdBlJsR22BR4qxUQdJsJ9Vrz1Zy3V4aKfEiWrA0E:+Pn+e8UfsnfI9z1E6fJWE","tlshash":"4f253336b6b478a7c901673089839a1ade03b7223a12dc19d3d2d767d6dcfd44246f2e","first_seen":"2026-06-06T23:30:15.385386Z","last_seen":"2026-06-06T23:30:15.385386Z","times_seen":1,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/jetbrainsmono/v24/tDbv2o-flEEny0FZhsfKu5WU4zr3E_BX0PnT8RD8yKwBNntkaToggR7BYRbKPxDcwg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/jetbrainsmono/v24/tDbv2o-flEEny0FZhsfKu5WU4zr3E_BX0PnT8RD8yKwBNntkaToggR7BYRbKPxDcwg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31432\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 06:00:46 GMT\r\nexpires: Fri, 04 Jun 2027 06:00:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235728\r\nlast-modified: Wed, 10 Sep 2025 16:52:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31432, version 1.0","md5":"b636a65da4f00129f08c7df6e5dd75ac","sha1":"4f27206c4b1caf8b7805597fcbc6922ff5805daa","sha256":"83c005d49d8a6a50474c73a5a36ac0468076e9c4a29da7bdb14995d80560a5be","sha512":"77ad92edddd5fc9ce47b8b329cf41b2fec895ea01a97b9122df3766163998fadcbe47c868631208636c4e587136ddd390d38e3e9da2743758c9da2c77a66f859","ssdeep":"768:a8+AGQwBrw24YHLKRG5lBF260n1e5vhjJKWWAD95I9Puggtx:B+AiBrw2fHL+GyvYtYADM9Pug0x","tlshash":"52e2f274ea41ca57676335ed4203e99d015fa318ebf6fd40869ccad2a506bcb7c4033a","first_seen":"2024-10-21T03:03:54.505463Z","last_seen":"2026-08-02T22:07:55.014518Z","times_seen":11907,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":85,"dns":1,"connect":14,"send":0,"wait":15,"receive":15,"ssl":67},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/23312ec563d34d02.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/23312ec563d34d02.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/467bcc5173daaa6b.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/467bcc5173daaa6b.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":182005,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1682 x 686, 8-bit/color RGBA, non-interlaced","md5":"511358063b96db5b04361cb1adc7ed83","sha1":"00a2da54cdb7e6ead74feef85daf1871cd069557","sha256":"a505344f12d0d2de0daa96b1f4a22ebd8f28ef5d9e031fc72bf16a1040f2dcf1","sha512":"6704b3c8ff6dc40f5d177b3bda458e480cbc5cd575600ff5a7181ad8f8feafdf6f8c0d15a0c11709616e036ded651937e9dd7adab32845db87b7aa7b52824378","ssdeep":"3072:oYsCJFs5qLBFzJrJGSDPf5cBa/bCQ8mSSYM0Bg2xjQ1dxH1+e8edBXxPR:oYVJ6YBFtPf59TB4SYMMcnxH1+kDXxp","tlshash":"4e04e083f344287a83d58f512bd71ac5c02c352ebe0f5bcaab1b97d26657f8ea09015d","first_seen":"2026-06-06T23:30:15.388933Z","last_seen":"2026-06-06T23:30:15.388933Z","times_seen":1,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/d73f492ede4387b9.svg","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/d73f492ede4387b9.svg HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/23312ec563d34d02.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/23312ec563d34d02.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":654671,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 2348, 8-bit/color RGBA, non-interlaced","md5":"899d4b513859e10559ae6b61588c34c2","sha1":"ea0b317b13c9789312601f1d0a47cbb80c6d13c5","sha256":"9d6282a9de2088b8e4b97385493696caf2725670c3a923b0fb2276e5702482b1","sha512":"6860f018f4e9992e8519d79b49d114e31aae7a68241d0068901debcb19163ecee4760fabdf86e31a1756401dc8c5516db93a36e90967fa1722f7aa0fe2e23a1b","ssdeep":"12288:ctdkM50KSU48xQyAqMbQdkeMRbQIhuPJEc4nPy:ctt50KSUlrAqMbQdYQIYhkPy","tlshash":"50d4cf23da5470bb2b928b505b931dd1d56c38afbd0f8a1e5f13126739133eee82198d","first_seen":"2026-06-06T23:30:15.39109Z","last_seen":"2026-06-06T23:30:15.39109Z","times_seen":1,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/714f977a049b61e8.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/714f977a049b61e8.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":268959,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 1426, 8-bit/color RGBA, non-interlaced","md5":"50c7e4a4f5b9a7a41334ae5c0ccbadc4","sha1":"5fca6453e6a41930056a2e3be9d192464f85e573","sha256":"4dfc93fdfeb850d01edf5960faa915c79299f7c247f06c2f066e543bfe50ad14","sha512":"d1b06f44a9b2bcab14ee5a3a163798563c493e5fbf2c61bea9b62b999c5aa6cb85ec251184f61d73c930c337a3262f7dad117ea0c376407544c361a084e53b37","ssdeep":"6144:hAUwGDVe+ClF3CH2PWqRYrsGJuhSwzC4x9dkWhHr:hzLZe+CTyH2OqRYsLhj9d7","tlshash":"6744ae13c994343b8a918b7907532bd0e17c64af786d1f6a4f461a663d2f2ecfc2194d","first_seen":"2026-06-06T23:30:15.393631Z","last_seen":"2026-06-06T23:30:15.393631Z","times_seen":1,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/922b4474519528be.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/922b4474519528be.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":313796,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 1396, 8-bit/color RGBA, non-interlaced","md5":"2dd46130adb2fc189580edb52925914c","sha1":"8027f513e87e92d3723168e9d34b6f5dc59acd9e","sha256":"8d72e962f257c059690c9bd6c7f686e8e775bb04707523acff0eaef8640a8f0a","sha512":"2fc5ef7134cf17834a78d000b258bd4bc34d639aa96540fcb9e50eca905af9ab95f8e53b0c883e88749e33fedcdcb06a63e04e1778a0ffc56bbddd41f67f6e0d","ssdeep":"6144:Wu1CPmSzdo0sbPxuGgE7UnD3cw+3ulF2GUku3J9IERdL/GU74S:83zdAoL3cLQ4GTC0ERdL/GUb","tlshash":"4e64ad53c891353b48ae6a296b532a84a5337547b154af2f8f5415f83e0b0f4fc72abc","first_seen":"2026-06-06T23:30:15.396601Z","last_seen":"2026-06-06T23:30:15.396601Z","times_seen":1,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/12998b0cdc0fdb10.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/12998b0cdc0fdb10.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":193764,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1669 x 824, 8-bit/color RGBA, non-interlaced","md5":"db58489d4200860cf82923b28e71181a","sha1":"05f8a25938547e18be57be30b8195936f978f10f","sha256":"b100e54c3e6b8ae669705512326520e2f56ec0a4d555e0c35310ee29fd98a033","sha512":"b200f395e2fc6541c6976fbdb18e7006ee547d390ea8abd15777644b0f01b96f826858ebf159f40251a3dcc420551ac8cba15f9b2574d3cea80b3876972b056a","ssdeep":"3072:i61GoijMT99zQRMnFViRmsmd/NwYh6Zk9E0rqhjSLvL4QW3LzFoSI6Uqh3jZQMfB:i98cRmsmtNbP9jkjSXGNoYO4P","tlshash":"94149c53ce6164abb41292552a877093d5750ea33109ee1e2ba378bf5b03bf2fd31d48","first_seen":"2026-06-06T23:30:15.400504Z","last_seen":"2026-06-06T23:30:15.400504Z","times_seen":1,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":317,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"moz-nullprincipal:{6da506d2-f985-49f6-9bab-4c4e2cfe268c}?https://oreprotocol-research.com","date":"2026-06-06T23:29:35.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: null\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 04:14:15 GMT\r\nexpires: Fri, 04 Jun 2027 04:14:15 GMT\r\ncache-control: public, max-age=31536000\r\nage: 242120\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-02T21:58:32.54766Z","times_seen":31741,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":41,"dns":0,"connect":0,"send":0,"wait":32,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/714f977a049b61e8.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/714f977a049b61e8.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/about?_rsc=111tw","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /r/about?_rsc=111tw HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nrsc: 1\r\nnext-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%22r%22%2C%7B%22children%22%3A%5B%5B%22id%22%2C%22cmplhcsui001joa01ozfoqswq%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%2Ctrue%5D\r\nnext-router-prefetch: 1\r\nnext-url: /r/cmplhcsui001joa01ozfoqswq\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: text/x-component\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1, 1\r\nx-nextjs-stale-time: 300\r\ncache-control: s-maxage=31536000\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9338,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (5242)","md5":"f23cc0eac09e4eee788570eee9c7009a","sha1":"c5e37cd9548a957a885d2bc2b1c5eaab4883e518","sha256":"a1fa4d9d2dc8dca3bef1b663bab7b3abf56f41cbdfc3464ca2d0bee2723203fc","sha512":"15ce69d992b1093e99b8de65b0fb1919aad0805a47a5bb9b469bec70b3bb73fbd7726e1e4379fe41b4bc1d9a3de739357ab0953a0e7040341544e340d2db5d50","ssdeep":"192:W3VIAz/HNoUodRKMvFxbxZVfuSefSx2q4WL/pD9f:W4dAUxtZ5/","tlshash":"8212ef36a704eab9bfaf11e0642fe24e628f563f63544df186ae8d6803c113929537d1","first_seen":"2026-06-06T23:30:15.40317Z","last_seen":"2026-06-06T23:30:15.40317Z","times_seen":1,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/1f427d13c3a57554.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.192Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/1f427d13c3a57554.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/eb17795ed08f9d5d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/eb17795ed08f9d5d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":128162,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2356 x 1296, 8-bit/color RGBA, non-interlaced","md5":"847faee9cc569ebf534499652dd50506","sha1":"f4dac953a39ffb15b6c4765c97af4096f2c52e20","sha256":"744ea6977cebbcfa2eec341c5ad99b70a4ecdb89312e55a2a99106eb8e7ac9b9","sha512":"83ceb85d49d8483f163adedb33ee4bf2ccba4d71cf9f611cc1fad005304a93ff5be3fbbb9346364225d23d94ef17d0f77ea3d70eeee41cdf33456b4c6eecd072","ssdeep":"3072:SZzGC7EwRc2p4RPuUHiQhDDDvb51IKhA/:kxRc2SLiQhDDDT51IV/","tlshash":"d7c3f246db46347bb5281218b653249790b19e773425ce0a2be7702f2b83fb0fc75da6","first_seen":"2026-06-06T23:30:15.404558Z","last_seen":"2026-06-06T23:30:15.404558Z","times_seen":1,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r?_rsc=111tw","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /r?_rsc=111tw HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nrsc: 1\r\nnext-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%22r%22%2C%7B%22children%22%3A%5B%5B%22id%22%2C%22cmplhcsui001joa01ozfoqswq%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%2Ctrue%5D\r\nnext-router-prefetch: 1\r\nnext-url: /r/cmplhcsui001joa01ozfoqswq\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: text/x-component\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":125,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"55eeaa3fc6e3d14c97a01e03d271a98b","sha1":"e9e27e1e81843a3aa849a42fedae35d788696a3e","sha256":"a894dab1d55015133582715af82cef596a1791ce65f596f93e8c8841b396b988","sha512":"1d6edf624431bf27f1a1ae82e6507b2f17595d1a04873858558b25f582b705f803ed5a18de2776f84ff94e3c58fafd9ce9cf16409ddd17a600dbda23f8f5da88","ssdeep":"","tlshash":"37b0926296506efe59bb38c9016dcaaf361e922f31d521f590e25880377e0306607688","first_seen":"2026-06-06T23:30:15.405758Z","last_seen":"2026-06-06T23:30:15.405758Z","times_seen":1,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600\u0026family=Inter:wght@400;500;600;700\u0026family=Newsreader:opsz,wght@6..72,400;6..72,500;6..72,600;6..72,700;6..72,800\u0026family=Playfair+Display:wght@600;700;800\u0026family=DM+Sans:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:22 GMT","end":"Mon, 10 Aug 2026 18:37:21 GMT"},"fingerprint":{"sha1":"09:D4:FC:2F:81:37:26:42:91:15:6F:27:1B:72:A7:D2:1A:FC:31:72","sha256":"E9:45:95:A3:A1:F2:6E:F0:08:73:C1:35:32:67:E6:72:BB:89:C7:27:C0:8F:D7:48:6F:0A:88:7E:8B:00:2F:B9"}}},"request":{"raw":"GET /css2?family=JetBrains+Mono:wght@400;500;600\u0026family=Inter:wght@400;500;600;700\u0026family=Newsreader:opsz,wght@6..72,400;6..72,500;6..72,600;6..72,700;6..72,800\u0026family=Playfair+Display:wght@600;700;800\u0026family=DM+Sans:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 06 Jun 2026 23:29:34 GMT\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32336,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"0bfe402f3d61c795d494fb79e49b40e0","sha1":"5b0ed610dd31d0506fa3beac0ab521dfcb292482","sha256":"c9ad602ee6c2a0cf9c514bc3969bd2049606fd934cd646ede95ed3887d4af1d9","sha512":"cc89632ce3d8c9378348055b5cd1ba50c7d3bbbbe50caacfe9b0763daa04d44c624f55fab0a255191a07be2dec3cdbedc4587b3969df4c84633edd7b7e53f99c","ssdeep":"384:Uis+/XuM0p2+QOGC6CIBUz2mF2R/Y2v52bp26E2R/J2vI2b426n2R/K2vT2bD2W:2aww50pAahwI047aywT0D9","tlshash":"03e2fd91002fa500eb831cc263cfbe36ad8e60556485d5b9affe1c89aceec26536475d","first_seen":"2026-06-06T23:30:15.408088Z","last_seen":"2026-06-06T23:30:15.408088Z","times_seen":1,"resource_available":false,"data":null}},"time_used":735,"timings":{"blocked":343,"dns":138,"connect":28,"send":0,"wait":48,"receive":0,"ssl":175},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cffaf33e018b5fda.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cffaf33e018b5fda.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/jetbrainsmono/v24/tDbv2o-flEEny0FZhsfKu5WU4zr3E_BX0PnT8RD8yKwBNntkaToggR7BYRbKPxDcwg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/jetbrainsmono/v24/tDbv2o-flEEny0FZhsfKu5WU4zr3E_BX0PnT8RD8yKwBNntkaToggR7BYRbKPxDcwg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31432\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 06:00:46 GMT\r\nexpires: Fri, 04 Jun 2027 06:00:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235729\r\nlast-modified: Wed, 10 Sep 2025 16:52:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31432, version 1.0","md5":"b636a65da4f00129f08c7df6e5dd75ac","sha1":"4f27206c4b1caf8b7805597fcbc6922ff5805daa","sha256":"83c005d49d8a6a50474c73a5a36ac0468076e9c4a29da7bdb14995d80560a5be","sha512":"77ad92edddd5fc9ce47b8b329cf41b2fec895ea01a97b9122df3766163998fadcbe47c868631208636c4e587136ddd390d38e3e9da2743758c9da2c77a66f859","ssdeep":"768:a8+AGQwBrw24YHLKRG5lBF260n1e5vhjJKWWAD95I9Puggtx:B+AiBrw2fHL+GyvYtYADM9Pug0x","tlshash":"52e2f274ea41ca57676335ed4203e99d015fa318ebf6fd40869ccad2a506bcb7c4033a","first_seen":"2024-10-21T03:03:54.505463Z","last_seen":"2026-08-02T22:07:55.014518Z","times_seen":11907,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"moz-nullprincipal:{6da506d2-f985-49f6-9bab-4c4e2cfe268c}?https://oreprotocol-research.com","date":"2026-06-06T23:29:35.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: null\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 04:14:15 GMT\r\nexpires: Fri, 04 Jun 2027 04:14:15 GMT\r\ncache-control: public, max-age=31536000\r\nage: 242120\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-02T21:58:32.54766Z","times_seen":31741,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/2619-3c9e02e22d10480a.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.248Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/2619-3c9e02e22d10480a.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"215a-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8538,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (8538), with no line terminators","md5":"4cc3d3068e3a31f8f83d27813219bc68","sha1":"8dab60b372c3c71956d015ac2cb2ab43a0afbd58","sha256":"7fe044bde88179fcddab68e119ff3f40e55f3a0ecd8cec7fc420b14c9f350f9b","sha512":"2f514d4a1e1147bdeeaab99443bd61bb23f1192281a24f14bc17f7f2ac7684a921baa8bdbb2cd3da8b1677f3c9b1c034bef82156ac2cbbaf384bde7423dadbd8","ssdeep":"192:7YOHC0dwMcGWRYxxURMeobT9jZIc2c3GbWekT:7jimwMcGWuGMFIot","tlshash":"9202c8ea75e1f8e2836b0150443b100bf37e1db5181ea184e7a95ce6f9b046dd1f2f69","first_seen":"2025-08-29T10:45:07.911289Z","last_seen":"2026-08-02T22:11:32.794131Z","times_seen":2169,"resource_available":true,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/237e788a8a679ed6.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/237e788a8a679ed6.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/799a05f59425302d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/799a05f59425302d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156979,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2356 x 1296, 8-bit/color RGBA, non-interlaced","md5":"da8848e043fefaa4712eae44c43caa68","sha1":"67d2dd5fe9416c1d51ef64c75883521e38a97fdd","sha256":"5f0d16c208b99469db2243814d241844bb8fb69a6e3c5cb00fc24f5e2d42563e","sha512":"db192f1f256b454e3c7f78ac60bfba09fcca13ded89c40572cecbd40f2c138feb80b58bf1c6357717b7066e0ff5d9068c6b2ad02f4c5d01a860fbcf9db1b37cb","ssdeep":"3072:2rbpDz2rNOy/mPeijh8SblBPowUa4l1GaZpK6+8lzXSW:2rblOsHeijiSblBwwaldblzn","tlshash":"66e35816cb01617b72504a58ba43688385692c3bb90ace0b1fe7722f6b07ff8ed74d54","first_seen":"2026-06-06T23:30:15.410721Z","last_seen":"2026-06-06T23:30:15.410721Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/78deb0576d3e404e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/78deb0576d3e404e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102644,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2356 x 1296, 8-bit/color RGBA, non-interlaced","md5":"ed0685b08dcaeb0452baa60dc7f706ad","sha1":"4a8369ac4dbb27193e52d77207ec971c82eec002","sha256":"6a17b8459c5aca9153339f03ea5da4ad399a51298fcee3d08a281019d32eb4e7","sha512":"c58692fa70fa8a05cdf0b5c7a15dd2f891c497224489c5590bdad47e9f5ebe3e7e31671aa6dcb600b523f94c61c42e2bd54e78cb4408d4ccdcde95f0fdcd3d97","ssdeep":"1536:kFB9BqB3o6yozM5qRiwjE4XkNZJJd3qqSqFRPYvWjjskLHquCNFK+2221r8UeEgk:kHoo6M5dw3XuZTdJSbWhHqFp222b6TgL","tlshash":"95a3032ac3a28cf3ba194666b0522457085b4c773239ce1614cbf51f63ebf701eb5e5a","first_seen":"2026-06-06T23:30:15.412389Z","last_seen":"2026-06-06T23:30:15.412389Z","times_seen":1,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":324,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/d272d58f8e5f7c04.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/d272d58f8e5f7c04.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/3401456c7636653e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.426Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/3401456c7636653e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1180916,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 979 x 712, 8-bit/color RGB, non-interlaced","md5":"bf3ffe02054002947a6a29bad35b5a42","sha1":"1aed75620f2016e760721b06ee9fca5240c2dbe8","sha256":"551feb0aaf4cd44efaf4556df078a3ecc53b3532231b70035fbd14f05b9183a4","sha512":"3200f8987deeb73b72793c5cdae37a22f18c88be3e50c95ad96411794ca49c3a9631646c0ba6cc7406249f3ad55e24182f0cd02fc21589b7310a3844090e335c","ssdeep":"24576:hUBHcY7OuevSxL0oaqBNnOYTeiLdzFe/E2K3zJxKnxsmmUuD:uOYjevuagNndLdzFeTK3zLKSRUU","tlshash":"6a25339fdd610272bc7fe88d363c9c8e0a689315793d58565eb98054a3e833fa75c8c1","first_seen":"2026-06-06T23:30:15.413837Z","last_seen":"2026-06-06T23:30:15.413837Z","times_seen":1,"resource_available":false,"data":null}},"time_used":341,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-06T23:29:33.727Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /r HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:33 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nlink: \u003c/_next/static/css/5c9641db5dbd84d6.css\u003e; rel=preload; as=\"style\"\r\nlocation: /r/cmplhcsui001joa01ozfoqswq\r\nx-powered-by: Next.js\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-06T23:29:33.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /r/cmplhcsui001joa01ozfoqswq HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:33 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-powered-by: Next.js\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (10596)","md5":"c854e16072c77cdab086b3a3ab218d41","sha1":"c2a17fd62067248fe86a18f658b176e3e021e82b","sha256":"f89dde0352aebeb42331beafc54ddf6dbda4a2b20e2e595341a46e9b95d346de","sha512":"7ecaed61f10d1f95b63ae8dfd4390891871dbbdec3843dd4a5031182459d1677de712e1c9ba562e734e639c12e23dad0179570c19c753a2ff7bfb7711329f60f","ssdeep":"192:IsUO0nvhTLugnqzcpmfbblYtuXzAE+8hFrq7:I9OEpT+CuXzAE+8hFrq7","tlshash":"17326467ad04ce4adeba6d78103ebc3850ccc57b8264c9a9e69cce184582db557e7e80","first_seen":"2026-06-06T23:30:15.415354Z","last_seen":"2026-06-06T23:30:15.415354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/css/5c9641db5dbd84d6.css","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/css/5c9641db5dbd84d6.css HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: text/css; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"a3c-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2620,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (2620), with no line terminators","md5":"a3afdf3e481305cc4a30f5c73b48433b","sha1":"bffcdaa46ac19101f63bda6ffeecb0d80b3859cc","sha256":"d37ab5a2668a6b72ef9477e5a634acca7fc0f2f94575bb1a0e82b0e856e8374b","sha512":"6e5138ad3062479a4fe1902bb516f6ea61dfa23a0fce949890991886df5737a09d0e365634560d4ff3df306a6c8ce547ffd78b56c783b42c044b5237bc4ecb0c","ssdeep":"","tlshash":"0c51a5a3f185e16854839d0aa5a7333f700951136a819ae4d520b771eacf2efd232707","first_seen":"2026-06-06T23:30:15.416779Z","last_seen":"2026-06-06T23:30:15.416779Z","times_seen":1,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/main-app-05a5fe279f4f6e20.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/main-app-05a5fe279f4f6e20.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 560\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"230-19e992f3b70\"\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":560,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (560), with no line terminators","md5":"7b4d6767c982f0055f00c6d65044e992","sha1":"92113bc786df1f2262c09ec57a9ed70bcf7a4649","sha256":"87b9a732ab18663476fa44da250cbf5826a514ffe1218fcb02065557c6d259a7","sha512":"c0bcf382c8783629fbc6a301d4433ec043bfd49e520113d0934a4343b61d377ae3f79d6808e9c3246f5e813a78bde6607cf9cba78a3822460205f94f417329a8","ssdeep":"","tlshash":"d7f0f45a8f0cf52f5c26ad64fe97ace2285f4175302b4e647914eea23c23bacd270409","first_seen":"2025-09-15T02:14:26.454228Z","last_seen":"2026-08-02T04:15:59.52191Z","times_seen":148,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/app/r/about/page-fb3267bd42b9580d.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/app/r/about/page-fb3267bd42b9580d.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 188\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"bc-19e992f3b70\"\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":188,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"fbf3ea8947de47788ba4f3d84e2645bd","sha1":"b7ee8d2ea38b53bd55291d29e19e08633c8c3165","sha256":"3361cd6261144af13fb1fd2ce89b475ab3b45c8ac82734bd6837dd70e1f07621","sha512":"0393cae5a5506d8885b6fff9141ff08745c9591c9d46a5138562047c32c7f0843fc33d071f94aec675b2dc6a1b35dd38c7f11611778ea5aaa58a0f52a26caf72","ssdeep":"","tlshash":"a4c0229e22617a9ab82a1a68a8ba0c65358e402a391a988057014ca00062e588351c46","first_seen":"2026-06-06T23:30:15.420475Z","last_seen":"2026-06-06T23:30:15.420475Z","times_seen":1,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/favicon.ico","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1, 1\r\nx-nextjs-stale-time: 300\r\nx-powered-by: Next.js\r\netag: \"9bpdaqnm476yw\"\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9032,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (9032), with no line terminators","md5":"f58eb16c2d1147cfac16d51b0888d092","sha1":"3541a8f6f450dd577a91625314c2b4aebfdb8c7d","sha256":"9d73ef2228da5383f798be54696107f6842203e69c57347766a6e72710437707","sha512":"ad61bc20638e06bac618205045c46a54e6e67ebba497433346d0a45d34dd85b5a7461c8e204e465945cdab4dad61f3608480367fe43bbb853028b59337817cef","ssdeep":"192:dsUO+nvWSzHkUWhgnqzcpmaYH4XVsEa8BFrb:d9O6vWTY84XVsEa8BFrb","tlshash":"cc123277ad04cd0ee9796838103fbc3950cdc66b8394da69e78cce5849c29b657f2e81","first_seen":"2026-06-06T23:30:15.422603Z","last_seen":"2026-06-06T23:30:15.422603Z","times_seen":1,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/688b1db7f48bb499.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/688b1db7f48bb499.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/3c2b4eda88df0a9c.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/3c2b4eda88df0a9c.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cffaf33e018b5fda.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cffaf33e018b5fda.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":431460,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1358 x 1180, 8-bit/color RGBA, non-interlaced","md5":"ec71bd7285211186681dd602cece8d86","sha1":"e9ab49d3c0f34baddf6a9d56861dc1167d578ff0","sha256":"fa49aa46b98c37bbd875d58780e3a1329870a33fa5e601be042cf6a943bebe3e","sha512":"d9e11844ef4c49db5d36b3cc1d236d2ebc2856c39517d027371c4ab3558bbe6a0e6026803aa70407881736a0ccb4c9563d87418715fbb38138921b4de79c0445","ssdeep":"12288:SWk8kFVnqLLj7m1obUifkodQulY9vRshzydc:SvFVnoLO1obUifpS9ps4dc","tlshash":"2494124b63a0d9b181f8eb3265c6cd3cd00dcd68a22d54b40b635bdb38d9f957a929cc","first_seen":"2026-06-06T23:30:15.424118Z","last_seen":"2026-06-06T23:30:15.424118Z","times_seen":1,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/688b1db7f48bb499.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/688b1db7f48bb499.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":184378,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2560 x 1440, 8-bit/color RGBA, non-interlaced","md5":"743356cc9e3ed3b661e78e357c2d786a","sha1":"db7fa0a530007cd24bb8bd5165cddf906eecaeeb","sha256":"3caa2ad3b6dcb974d9cb655144f499df505b3fbf153736008698526acb164abb","sha512":"bce4383f557f5758b72c046944d6d838b40338f98e708f35a7c2da2a32c45344a674b1dbd21203c65ffb602ecbc01323049ed4077c61f4d3ebdecb45f656c5c5","ssdeep":"3072:yt4azlA9eFbiFmuUFbLIuK4sfx4MgnticR8nO/+vDnuZwGVcyqjT+rre:y2cA9QiFPEsfvgtizrvAQT+rK","tlshash":"f4048b46db41607b72888a54b62328d3c8692d3b7905de1a4bc7722f2b53ff4ec71d98","first_seen":"2026-06-06T23:30:15.425504Z","last_seen":"2026-06-06T23:30:15.425504Z","times_seen":1,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 132000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 02 Jun 2026 06:22:59 GMT\r\nexpires: Wed, 02 Jun 2027 06:22:59 GMT\r\ncache-control: public, max-age=31536000\r\nage: 407196\r\nlast-modified: Mon, 08 Sep 2025 18:03:32 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":132000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 132000, version 1.0","md5":"f94a697b16502ea4c1ea76b541b93b30","sha1":"5d70b133857055167c6efd19eccdbc46d7cf328d","sha256":"6e4f2958c3a7c4a80acde4e5a679abe7e01bc1e30b92be3c7a8b696ef401d101","sha512":"1328672ab4c7021cd35d649e39e60e0a03c1fa72e0a2a69a5bb427d1de3afee51247f7080d8e747f3d3f44150777c39966f9464a710d14b9161ac1b20f7bd3b6","ssdeep":"3072:JMAwmOH7ouFuG6JdY7xvg5axaMgKLZBaOe5C+EoKkU:6mOHX+JAgsaduZBWKf","tlshash":"27d3125cf9d6170b980addab4c4aefd9da6e43f234790152a0e7eb799341c08bc8c275","first_seen":"2025-04-16T06:15:05.515218Z","last_seen":"2026-08-01T22:07:04.342309Z","times_seen":612,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 132000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 02 Jun 2026 06:22:59 GMT\r\nexpires: Wed, 02 Jun 2027 06:22:59 GMT\r\ncache-control: public, max-age=31536000\r\nage: 407196\r\nlast-modified: Mon, 08 Sep 2025 18:03:32 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":132000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 132000, version 1.0","md5":"f94a697b16502ea4c1ea76b541b93b30","sha1":"5d70b133857055167c6efd19eccdbc46d7cf328d","sha256":"6e4f2958c3a7c4a80acde4e5a679abe7e01bc1e30b92be3c7a8b696ef401d101","sha512":"1328672ab4c7021cd35d649e39e60e0a03c1fa72e0a2a69a5bb427d1de3afee51247f7080d8e747f3d3f44150777c39966f9464a710d14b9161ac1b20f7bd3b6","ssdeep":"3072:JMAwmOH7ouFuG6JdY7xvg5axaMgKLZBaOe5C+EoKkU:6mOHX+JAgsaduZBWKf","tlshash":"27d3125cf9d6170b980addab4c4aefd9da6e43f234790152a0e7eb799341c08bc8c275","first_seen":"2025-04-16T06:15:05.515218Z","last_seen":"2026-08-01T22:07:04.342309Z","times_seen":612,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/newsreader/v26/cY9AfjOCX1hbuyalUrK4397yjA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 132000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 02 Jun 2026 06:22:59 GMT\r\nexpires: Wed, 02 Jun 2027 06:22:59 GMT\r\ncache-control: public, max-age=31536000\r\nage: 407196\r\nlast-modified: Mon, 08 Sep 2025 18:03:32 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":132000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 132000, version 1.0","md5":"f94a697b16502ea4c1ea76b541b93b30","sha1":"5d70b133857055167c6efd19eccdbc46d7cf328d","sha256":"6e4f2958c3a7c4a80acde4e5a679abe7e01bc1e30b92be3c7a8b696ef401d101","sha512":"1328672ab4c7021cd35d649e39e60e0a03c1fa72e0a2a69a5bb427d1de3afee51247f7080d8e747f3d3f44150777c39966f9464a710d14b9161ac1b20f7bd3b6","ssdeep":"3072:JMAwmOH7ouFuG6JdY7xvg5axaMgKLZBaOe5C+EoKkU:6mOHX+JAgsaduZBWKf","tlshash":"27d3125cf9d6170b980addab4c4aefd9da6e43f234790152a0e7eb799341c08bc8c275","first_seen":"2025-04-16T06:15:05.515218Z","last_seen":"2026-08-01T22:07:04.342309Z","times_seen":612,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/799a05f59425302d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.280Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/799a05f59425302d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/2b049436cdfdfd98.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/2b049436cdfdfd98.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/fcd33ec3f761ef66.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/fcd33ec3f761ef66.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80441,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1472 x 588, 8-bit/color RGBA, non-interlaced","md5":"6208e8e4f5d6f0ed4c5f7ea3829b2e32","sha1":"cd70dc4a6daa9f78337a219a1c65d93e2d1bb848","sha256":"d100b9c18c7268790d5e18d17f28de9521763cee78504ee783e0b38d5b1594d4","sha512":"6d75986ada057e76e49f7e97a4cbcbba025cc1c87719d2a07074d69c2b9f1f7142a6a815f10ade569adecb18d32434e8976dcebe0ffa06cdbff93de23cb9b923","ssdeep":"1536:cbAraVruCH8/VhvvzREFdrVH2D7t9znR8I1KWDWtT5i:kAezH8HvW75HSB9znT3q5i","tlshash":"4d731763c994716f85bc622123573ad5d476345ba129af1f8f9024f82f5b0f9f830ea8","first_seen":"2026-06-06T23:30:15.426707Z","last_seen":"2026-06-06T23:30:15.426707Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Mono:wght@400;500\u0026family=DM+Sans:wght@300;400;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"moz-nullprincipal:{6da506d2-f985-49f6-9bab-4c4e2cfe268c}?https://oreprotocol-research.com","date":"2026-06-06T23:29:35.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:22 GMT","end":"Mon, 10 Aug 2026 18:37:21 GMT"},"fingerprint":{"sha1":"09:D4:FC:2F:81:37:26:42:91:15:6F:27:1B:72:A7:D2:1A:FC:31:72","sha256":"E9:45:95:A3:A1:F2:6E:F0:08:73:C1:35:32:67:E6:72:BB:89:C7:27:C0:8F:D7:48:6F:0A:88:7E:8B:00:2F:B9"}}},"request":{"raw":"GET /css2?family=DM+Mono:wght@400;500\u0026family=DM+Sans:wght@300;400;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 06 Jun 2026 23:29:35 GMT\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4341,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3a17377e156021c7385bcbf1ff6c3b6d","sha1":"e73590bba2f48741fe21dcbf3ff17799caace4f6","sha256":"300387dfd05a30178d22e125a7860210d755d9969cbc241ed671ac9bae5568ba","sha512":"2a2601a13445d2c01d61bfa84f3cbd356a78b9cadfbdefc99ef51bfe027fc7cc81f07aa6055d9a01e18666c5410707981f37add0d462e81341b28e7572511a3a","ssdeep":"96:zOEaoJc+u3OEagNgOXaAJc+u3OXagNkO1aXsXJc+ufO1aX+L0NkOEaXsXJc+ufOj:kMXH0wFwi+EwD+rw8+3","tlshash":"b391ef81046ba110eb931cc522cdbe32ef1fa15564549974abfe188cbc6bd3e4362b4d","first_seen":"2026-05-03T06:37:15.005325Z","last_seen":"2026-07-02T11:39:57.68366Z","times_seen":11,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmmono/v16/aFTU7PB1QTsUX8KYthqQBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"moz-nullprincipal:{6da506d2-f985-49f6-9bab-4c4e2cfe268c}?https://oreprotocol-research.com","date":"2026-06-06T23:29:35.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/dmmono/v16/aFTU7PB1QTsUX8KYthqQBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: null\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14820\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 31 May 2026 11:01:32 GMT\r\nexpires: Mon, 31 May 2027 11:01:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 563283\r\nlast-modified: Mon, 15 Sep 2025 17:10:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14820,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14820, version 1.0","md5":"e1ed461ac183567c761537bf3eb4a574","sha1":"1a0430d40513f1eb6d4596c552b4f58761a1a0fd","sha256":"e1896b13b2b1bb112fac2f9571bd6c40e118746e77a4511edbf43fbb41bf3e1e","sha512":"02c5f74e2a41d205b7c44981bd69a8539038668c4ffab49679825178da648d8b7a870c9c147671f92753d6fd4f55baac3f0d737a9882f6c72e296a116cb7d3c0","ssdeep":"384:ZJRKFL7Wd/jIlLKEDiqGK0qvWoLlqAJB4XJ:fR6MZqGevbBVJOZ","tlshash":"f462c0fcbabc52f7c61b2a5a11482d32201660ce7271c5109aff541ceef928ad619f66","first_seen":"2025-06-03T07:55:52.433002Z","last_seen":"2026-08-02T15:38:07.604238Z","times_seen":3479,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/public/reports/cmplhcsui001joa01ozfoqswq","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/public/reports/cmplhcsui001joa01ozfoqswq HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/json\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":72207,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"20db19b3236ac1f0655e64a77c5f955a","sha1":"b43bd3a9612e17ea831ab1f80870b30cee0abc5b","sha256":"801abf6c465bdd492baf1315a224662602a56597df16fff10edcd1ad0c98922b","sha512":"15fee6dbb8239496318d1c9751f6c7e35dc3b84f1f3eb30d1e4f8459f9b8014706d1d7cf4a41332f2dbdbb2d8f3ac0ac13c1034d264ce33b04b5fb71eca5299e","ssdeep":"768:Gxxds4NjQCHVzslG0r/qnn0j0TVI8SwVob9csh7FKLnXU/6TMjlg8n137sKVnVr8:ods4vVzy+obb7FKLnrIZggx8","tlshash":"0a63291a766402b585968fd51feb16c6626c3127f3120a6cba8ccb2543ce9b4f7731ce","first_seen":"2026-06-06T23:30:15.429449Z","last_seen":"2026-06-06T23:30:15.429449Z","times_seen":1,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/e3671dcc4c10b27e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/e3671dcc4c10b27e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/78deb0576d3e404e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.308Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/78deb0576d3e404e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/e3671dcc4c10b27e.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/e3671dcc4c10b27e.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":216712,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2500 x 1260, 8-bit/color RGBA, non-interlaced","md5":"01df819615592f36b993d847bc1b1343","sha1":"eb55233e0857a3d1f41a94c96d62aa91b0a2957e","sha256":"ab3e0aa9f934c241a4df3b3bb04fbeb7d9d62048faef20e7bc8e568d6c7ec4b5","sha512":"aa2e557047c4ddce599ddbf85c87256bda635dd037c6fcc16255dc403f56c8afbc5ff314b5ba035d2ed167772cd01db0d1853d910474e5d96787507cf7911d48","ssdeep":"3072:OZSxzWjOdjrFdwZHAm6vFGtFfVl/d22jbIkr4FPw5qErm5:OZSxzWjcnFWBZV5PIkQmqErw","tlshash":"d724e203de26307ba151055967a332c681b08c7b7411df1f6fa666beaa63be0fc32c55","first_seen":"2026-06-06T23:30:15.430563Z","last_seen":"2026-06-06T23:30:15.430563Z","times_seen":1,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:21 GMT","end":"Mon, 10 Aug 2026 18:37:20 GMT"},"fingerprint":{"sha1":"C7:04:EC:03:CB:34:6A:7A:0E:8D:12:AC:D9:6E:0C:1E:55:11:32:16","sha256":"0F:52:5C:58:54:41:2C:98:66:96:39:47:DA:6E:60:9C:3B:CB:A3:E8:B6:42:AB:BD:CB:29:94:AA:03:FE:9D:54"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oreprotocol-research.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 01:46:47 GMT\r\nexpires: Fri, 04 Jun 2027 01:46:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 250968\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-02T21:48:21.639875Z","times_seen":251347,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/413542d481d40163.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/413542d481d40163.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/7591-1163cd2384a5c934.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.250Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/7591-1163cd2384a5c934.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"fdab-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64939,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64907), with no line terminators","md5":"7a58be6f3e0e0cde0f919857e4126c62","sha1":"c477f6a185f7283d9481f0e7b11969acfe9b5449","sha256":"0108cd7a95541c7cdb0cabd94256953518bbcc744b96b1bfd16e17b5d91a44dd","sha512":"d70faf0cf7ee9813e06321b9dc767cb4fab6d24e9446b296110b33053849b120c5db71a0259d5e9281a30cbbe5581fe73776ea9e4c86fe329fda3d4b6726df33","ssdeep":"768:UPMlPmigapBT+m3dakTkGfxtQW16IQ2VWVUBHENCPvJrUL/W325w:uMlPmkpN+m7626XRCBZ325w","tlshash":"c553d770a6823a84f05b865d76eb800d717a2754910e0af5fb679c3553c08f1baabfe4","first_seen":"2026-06-06T23:30:15.432539Z","last_seen":"2026-06-06T23:30:15.432539Z","times_seen":1,"resource_available":true,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cef83bb6dc56aada.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cef83bb6dc56aada.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/cc5f61fe5aa16375.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/cc5f61fe5aa16375.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/96cfdf703faa4dfb.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/96cfdf703faa4dfb.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":321067,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2504 x 906, 8-bit/color RGBA, non-interlaced","md5":"d2d625e6a83a0839f75e1cd2b23c0986","sha1":"0aef023f8e707cf98b257cbc48a266d3fb37cfc2","sha256":"08305a0b561105d9f79058d819e059469f80db39f343425d0b4f94c43291229a","sha512":"502724ba9dc9871317e02db73c6694c2807ec80891c352abdac98115abc645ef77a028e8fc35f951b7b730384d08185d195e4a16bae3380fd1eb9c14718b98cc","ssdeep":"6144:zKHXOUYG6zLrRBQwXazihY7IZtzeBSlVct7y8sX786mxMHjpkTx9W6+B:W3QLrfQwqzWkmCa87Vsr86mmHjH6+B","tlshash":"e864124759011431477acf1cbfc309cad8195887b69a8b6a2f7b525e998fed0f423e8c","first_seen":"2026-06-06T23:30:15.433913Z","last_seen":"2026-06-06T23:30:15.433913Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/fcd33ec3f761ef66.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/fcd33ec3f761ef66.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-06T23:29:33.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:33 GMT\r\nlocation: /r\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":637,"timings":{"blocked":267,"dns":57,"connect":99,"send":0,"wait":102,"receive":0,"ssl":108},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/webpack-b8e1e74fcc0052ca.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/webpack-b8e1e74fcc0052ca.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"d51-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3409,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (3409), with no line terminators","md5":"5e285081c53552631a66df17c70a2fce","sha1":"1ef85fc9c0cab477ace702b2bb95d2b7e0c7b5db","sha256":"6c13ee589a2d721aec10dcac25ae29297c120b836049f20450bb3f1531279586","sha512":"65777105f4f823e9c5830d3963ed5a68053ccef9bd79308373fb5c2e106bac69afa80b32f4233c6e12c83bf3cc01296289257db1b815308b3ff083250e74ebf7","ssdeep":"","tlshash":"ca61b5a93625fab556f108c5887fc142f619603b051afca0e717dcb9b464aa10462ff3","first_seen":"2025-09-25T12:15:10.999909Z","last_seen":"2026-08-02T03:35:19.270982Z","times_seen":983,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/467bcc5173daaa6b.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/467bcc5173daaa6b.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/1b503e095542798d.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/1b503e095542798d.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/f36f2ed5a4ae5816.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/f36f2ed5a4ae5816.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T21:49:42.320851Z","times_seen":17679082,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/d73f492ede4387b9.svg","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/d73f492ede4387b9.svg HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/svg+xml\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9920,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4b7f809c39d674beb8c0ce448a318fa6","sha1":"dafc15964b6940bac3a7fa5342816a14dec8070c","sha256":"abac33829b39936a7213ec060ebef56dd00b9b9d88a035d49e42326e7239de55","sha512":"cceac1d04e290d4ddeae85983d3d7675305af53846ff4e682e0db02f66cee26714951c6fb989ebba77a79e99c2398d81e003aa25ce654be9928b4fa4bcc647bf","ssdeep":"192:bW0M+b+X+bnHAQ6EaBM0jS17MD8vvp/8dA9DvPKIDJAeTJ+ftyrIA8M9wypYKnOk:R/dBL","tlshash":"ae22a1c3b3c95a34f5088f28a309f6afb24dd9ddaa5bcd18f155440278c69cb85db28d","first_seen":"2026-06-06T23:30:15.436059Z","last_seen":"2026-06-06T23:30:15.436059Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/1f427d13c3a57554.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/1f427d13c3a57554.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237879,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1302 x 1108, 8-bit/color RGBA, non-interlaced","md5":"c1b59ae1715276026f3792e60f9af343","sha1":"83730a76b0e4fb222eb2211d96faa6cb871968fc","sha256":"00064b853a0d87688ff5d963f42fc0c6f7234fe26ab6ee0d811909def575ab04","sha512":"052728c54d0c0e4d34b9253c64c8a88059462817cdd2cfc36c1923f9990587c0cd7486e74b56cd1816c7db7002eaebe5066d2d37e902b745146d8fcde18b8695","ssdeep":"6144:sO9UjkITxS6rwNhAQtdDV0uFUsVBkgfHq65hRv:J9UjnTxS60NeQXmuFUWBkuJb","tlshash":"0134d0269262607a97e4cf214b075fc6c06eb8bffe3f6464838b67467667bdd210580c","first_seen":"2026-06-06T23:30:15.437392Z","last_seen":"2026-06-06T23:30:15.437392Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/4bd1b696-f785427dddbba9fb.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/4bd1b696-f785427dddbba9fb.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"2a3dc-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":173020,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7040f9644360f35f2b988c55e8ce4072","sha1":"87ad12f2bc364390c191172a9a9af6ad70b8e07c","sha256":"51a7146e32f6a18a96676813fd791cd1b0265c675292acb31196720ca9e79726","sha512":"9b801d74b75a094a73a2155b3d73d5344ee74cbcd27070ea57dafed253f73410770fcc2e7e4436636c7eb680743e717978f7f80a736bf8d691e9f9b2b96e7748","ssdeep":"1536:eWET9Lwegcl2MywYleojBFOQLfioEV7hNc7lFlgXGhJx4bzZc5zg5tgW/zAe6c0:S9LwzMyh1vLEE7RgXOQ5SIA1","tlshash":"def3f8ec3d99e611aeb342a700df28037378261b240d4d60a614fd9ea57845bb17bfde","first_seen":"2025-08-29T10:45:07.929156Z","last_seen":"2026-08-02T21:28:00.887779Z","times_seen":3579,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/_next/static/chunks/1255-a390e12b70b4a9fb.js","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:34.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /_next/static/chunks/1255-a390e12b70b4a9fb.js HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:34 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Fri, 05 Jun 2026 19:07:50 GMT\r\netag: W/\"2a1d5-19e992f3b70\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":172501,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"be738271ca5983daa35a92332b81c8d3","sha1":"ba687c6a550a40d9b6284dd61fa7ce9d512f3b23","sha256":"47ed13ce8be701da4f30f75a0921f7cdbf11310a54f9d837d8ff3ed104e0ce1e","sha512":"769e351e47d3c2dfa0aa30f68cde58f36f4e2d2d3c77dd824d558bac9267f45b15de4b94423510eaf3e989f52cbc318c553b2de23661216ae3be74ab44613889","ssdeep":"1536:7h7TN+Izz+cHr6U5eHM0db/7ZcyBPo7ecq0MEsiTtaocZXxreXRNIrky/SQhuzQP:NTN+UrFJ0NLwF5+4RN0z/SQuLi","tlshash":"7df3dab676d0f8e107a780e5843b400af3295c37146f74a0a3e6dcd975605dea1b3faa","first_seen":"2026-02-05T02:39:27.872328Z","last_seen":"2026-07-29T00:40:15.996022Z","times_seen":164,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oreprotocol-research.com/api/file/237e788a8a679ed6.png","fqdn":"oreprotocol-research.com","domain":"oreprotocol-research.com","tld":"com"},"ip":{"addr":"187.77.24.2","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq","date":"2026-06-06T23:29:35.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnnresearchgroup.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 16:41:34 GMT","end":"Sun, 30 Aug 2026 16:41:33 GMT"},"fingerprint":{"sha1":"CF:96:69:02:B7:0F:1D:8A:33:42:C2:CF:9F:98:A1:6A:15:5B:37:84","sha256":"15:84:BB:79:0F:BF:18:41:3F:31:C5:98:6E:FF:F2:7F:48:C6:EA:F3:EC:6E:BB:1E:35:F8:0F:8C:78:E3:2E:DB"}}},"request":{"raw":"GET /api/file/237e788a8a679ed6.png HTTP/1.1\r\nHost: oreprotocol-research.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oreprotocol-research.com/r/cmplhcsui001joa01ozfoqswq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.29.5\r\ndate: Sat, 06 Jun 2026 23:29:35 GMT\r\ncontent-type: image/png\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":197879,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2560 x 1440, 8-bit/color RGBA, non-interlaced","md5":"af96e2bd2e892840c75e0055f7b4b962","sha1":"4af2f2c416b7a36f2239f3b8a2a102a7cf6087cc","sha256":"33f9558d92912f01d25611b206e1e2f1fe72c469291e6812f68169a8e915db49","sha512":"897e56a244aa20969c6e930e1dc0ad354a3d9cfbd62ac0c796b8a4cd2b9db10b2870ce8163ab2f28998b0656bbbc34f4d76b43c86354269f36a8d2bcd6421c0c","ssdeep":"3072:PlQ1SR+YL0qzk9+i/bl8maMZ2N26AqI9KiXJyyx:61BYQH9+yFRfJyK","tlshash":"2314af07cb54283b75280548b693658395621db73222ce2a2fd7746fab8bfb0fd34c95","first_seen":"2026-06-06T23:30:15.439792Z","last_seen":"2026-06-06T23:30:15.439792Z","times_seen":1,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"oreprotocol-research.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}