{"report_id":"76359b42-7e4a-43c1-a032-667f091fa942","version":0,"status":"done","tags":[],"date":"2026-10-10T22:19:57Z","url":{"schema":"http","addr":"decodeqr.com/","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":0,"asn":202053,"as":"UpCloud Ltd","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"decodeqr.com/","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"title":"What is DecodeQR.com?","dom":{"size":6597,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (664)","md5":"99b081a032a0c5e9755de6631539b25d","sha1":"d50cf84b615131d38ec228a9d292ef4b26d841d5","sha256":"95a64be83d52ba616b6c8482d0bec5447a82e6d0881a594b6554f7c8243a5533","sha512":"8aee927d65f0c2b713ead2c47161929ae4e7b414cb7d71dab558d598b95d9915d6687a0a42d246f36ce331c9436613df19bad2ed8f42229f4c665ec0424427a9","ssdeep":"96:nzvY19/hZi/Xc/haSSaGPkMAkgFzTZdjmxPq06mA9KaB9Qsy/MWj/zcf67JQH:zvY19/hZi/Xc/haFaGPk7Fz/C6CEM/nk","tlshash":"acd1fa9b9052b86d8133c111f3d27909e26de113d3689c91b46d43f11fd5de388b32ac","dom_hash":"domhash16c0ba87ff22557a1747091623842e9d","first_seen":"2026-10-10T22:20:02.564044Z","last_seen":"2026-10-10T22:20:02.564044Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"decodeqr.com/","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":0,"asn":202053,"as":"UpCloud Ltd","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-14T22:19:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"decodeqr.com","ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":16,"request_count":8,"received_data":769112,"sent_data":4535,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]}]},{"fqdn":"stats.junglestack.com","ip":{"addr":"104.21.92.254","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-20","domain_rank":0,"first_seen":"2026-10-10T22:19:58.013507Z","last_seen":"2026-10-10T22:19:58.013507Z","alert_count":0,"request_count":2,"received_data":4626,"sent_data":891,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"decodeqr.com/","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"introduction_type":"scriptElement","is_inline":true,"md5":"f89a9238ae5420ccdcf968683be39ff5","sha1":"e9b19cacc4152c16b02bcd18dade816155d7d172","sha256":"6f469bab37b6ccb6d203c3d4dfbaf3ca79fb97466cc749b5d619abdd041340dd","sha512":"ae585410421fb6334bb68e8e0d215ee34ba46f9ad0e1bf2d91515ba704671099a981c84f5dc755f5bb8f865bcd9122e92d94c49b6f127350800eecf8ffd0f675","ssdeep":"","tlshash":"18e02667b04a725c44bf305993ab3203f532040b90c0d212b90e82d65f35a874332ec8","size":353,"data":"","first_seen":"2026-10-10T22:20:02.575787Z","last_seen":"2026-10-10T22:20:02.575787Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stats.junglestack.com/js/script.manual.outbound-links.js","fqdn":"stats.junglestack.com","domain":"junglestack.com","tld":"com"},"ip":{"addr":"104.21.92.254","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3bbaceb65d8e3f8495f17da9c544ff48","sha1":"3ed5c738f6e5100d57144340e34c3544e65d4382","sha256":"a8ca65124c2e9e1b4fff36473cfa1ced55bd62ceff2490d6eae7d173dfd54b6c","sha512":"40811d3cd21c3aec412d8d90ab2ae96840cfcd8fdf11add1f7d5e54d091a631b9b3b938a0c6eaa004b9613c0a71ceb6ba7656889ecd993c2569a8a7098a9d90a","ssdeep":"","tlshash":"b85131b97942b0b909b9c157b62f73067a372616341aa401646cc8c43e28fefd372ded","size":3002,"data":"","first_seen":"2025-12-16T23:08:53.322431Z","last_seen":"2026-10-10T22:20:02.571227Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"decodeqr.com/static/img/favicon-16x16.9be4bb7d6209.png","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:27.043Z","timestamp":1791670767043,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/img/favicon-16x16.9be4bb7d6209.png HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://decodeqr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: image/png\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-1e6\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 486\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":486,"size_decoded":981,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"9be4bb7d6209456e69341f3e919fe5f7","sha1":"fcf3f86954638808342bf10cb8456378d88cbe6e","sha256":"d0605b4b1ffe9fa321b933accc11bcce218bc0766227f2deb56b7a2389096403","sha512":"baba4013a18293ef634252a95240a8979e3ab466d4e55119508b3ca35835dcb246ff79db09ee6367867c5487bab41f74c717ccf02c26a5c18cc3bb3561021363","ssdeep":"","tlshash":"93f0dcf2936af519d6ca777e09120710b87896560ed8c24c8b54113a948a7d13eb4b70","first_seen":"2026-10-10T22:20:02.565275Z","last_seen":"2026-10-10T22:20:02.565275Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/css/styles.18a473ede7af.css","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.414Z","timestamp":1791670766414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/css/styles.18a473ede7af.css HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://decodeqr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=\"utf-8\"\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-24c03\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\ncontent-length: 16710\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":150531,"size_decoded":17270,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65462)","md5":"18a473ede7afd7031408724f5eb133e7","sha1":"38141ed59ab5d1a86e3b5fb68030688729b342cd","sha256":"479091cb962f20fa79208ecc0353d8c8bed04a4b73898d7eb174daa895743ca3","sha512":"9d3e415063f5e8f85b355ec719d321d0c4fccbc1c5312202ac19a381b3a169a2688037d69a2626982f86bfc5386bd87d4f2cd2d39e8e2e9858db6babbf9cb04d","ssdeep":"3072:AVv8sUrg3u1bA3XZdmQu3DZ+Sae6lKWG8ib8gyYI1PE7cC+ksRr6sn1+YUs/957c:AVv8sUrg3u1bA3XZdmQu3DZ+Sae6lKWM","tlshash":"a9e373a4f334e27fbc37697957aca45c3114b191ddb647f8fa0261218acbbf25c12628","first_seen":"2026-10-10T22:20:02.566325Z","last_seen":"2026-10-10T22:20:02.566325Z","times_seen":1,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/fonts/Bricolage_Grotesque/BricolageGrotesque-Variable.e4fcd6365cf0.woff2","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.849Z","timestamp":1791670766849,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/fonts/Bricolage_Grotesque/BricolageGrotesque-Variable.e4fcd6365cf0.woff2 HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://decodeqr.com/static/css/styles.18a473ede7af.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: font/woff2\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-31edc\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 204508\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":204508,"size_decoded":205009,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 204508, version 1.66","md5":"e4fcd6365cf0b063bad121e772d0f851","sha1":"e8bb087d301f246d533a82350eaff0fdbdb72ece","sha256":"4ccefba0bf8f25a84cbb72ce3896da034034832a065851718888ea6bbb8c9808","sha512":"587096f4bc3d60b0ccbbdd2ceec92f0edb96e94024f038aae14707056b3bb0f21e1e93ac704b0daa4add31b2f6312ebada5844f13067458c5c42c2dace48e4c6","ssdeep":"6144:7erA51/puhcDoOun3RTPGc2tVkmRtSok9y9n:7erOnZ/QRTPGcSkOwoHd","tlshash":"371423ad61b99d8000f8da02b2f83f51798bb3459f8f8db9535cc4487e3099b5662e7c","first_seen":"2025-03-05T02:31:10.878808Z","last_seen":"2026-10-10T22:20:02.567435Z","times_seen":3,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/fonts/Inter/InterVariable.499fcada6ddb.woff2","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.851Z","timestamp":1791670766851,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/fonts/Inter/InterVariable.499fcada6ddb.woff2 HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://decodeqr.com/static/css/styles.18a473ede7af.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: font/woff2\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-545f4\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 345588\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":345588,"size_decoded":346089,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 345588, version 4.0","md5":"499fcada6ddb2c38718c2c16a190d639","sha1":"9ef5d7d28925b9e0213f67b8105870e0afade711","sha256":"8af7bd5b545567adffb3dfceb5bedb353a522d7bf1b3a2b8af7b6064156babc0","sha512":"87a11b8a8cf75924370985a9975f88e427eff4550ed8d88fcb9fc69d294cb7320f216cc72748742705779be516cac02e57f5c4423d8e486612f657636dcac4ea","ssdeep":"6144:JnKViLt/6nunnpMQzXmL3QY5kpTL6/5JHXLZgK5isueYDoZmy+nTPvQAZKCyomgM:hfZ/HWEXI7kt6hJ3NgxsunDR7vQXomgM","tlshash":"d874239b7b7e4ccf443bb638d549c34660221333c5df9a1e5b60f2f79b82b6265481a2","first_seen":"2023-11-20T04:53:45Z","last_seen":"2026-10-11T01:11:50.560819Z","times_seen":12739,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/img/apple-touch-icon.b9ccf6943ebc.png","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:27.042Z","timestamp":1791670767042,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/img/apple-touch-icon.b9ccf6943ebc.png HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://decodeqr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: image/png\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-fbe\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 4030\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4030,"size_decoded":4526,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"b9ccf6943ebc5708cb2bf6b37b63688f","sha1":"47f1e40e3d29b1b4dad78cab791dc7329461c679","sha256":"973f7ac96e7bff15a8f6ca00fd15ee12ebd9b9c52cd534c4168ef4a35f7dd04e","sha512":"a4e8486eb5b58be67db45d4a3a5280b850d478e7f5140f887a5bf85f44e7e0428b76c64da066ca78367b87c64667915171e7d19aa3d5ea310e65dd0a7d8d7adb","ssdeep":"","tlshash":"c4813b6e06bcb862e33f022e16332413383d500884686c6c4acdb825d9c483c7ea1ffb","first_seen":"2026-10-10T22:20:02.569247Z","last_seen":"2026-10-10T22:20:02.569247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-10T22:19:26.009Z","timestamp":1791670766009,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-type: text/html; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:25 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nset-cookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0; expires=Sat, 09 Oct 2027 22:19:26 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Cookie\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\ncontent-length: 6741\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0","quoted":false,"path":"/","expires":"2027-10-09T22:19:26Z","raw_expires":"Sat, 09 Oct 2027 22:19:26 GMT","max_age":31449600,"secure":true,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0; expires=Sat, 09 Oct 2027 22:19:26 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]}],"data":{"size":6741,"size_decoded":7279,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (481)","md5":"cbe10c14443262e479479dd497c13c72","sha1":"77598c4cabb23dd3d5b8fd9cd90393a39009ea55","sha256":"ee814558cab086dd43a1141ec5a3349b4212e0f245b556267872d007da783820","sha512":"e8afd659cec9b7f691bb7858a9e8e94f494997958551bc2dac7779d88fa7946b701816c358909dd5c409cb32a22d11a1cb2ca102ac17a8008b84bde2b7434c2d","ssdeep":"96:NJ/wv/nbSahHkMAkgFATnFcWtDjml4uq06mA9SaB9Qsy/MWj/zcf67JQ1:NJ/wv/n2ahHk7FAnI6CEM/ny","tlshash":"c2d1f8ab9452b8ad41378021f3d27909d25de053d3685c95b4ae43e11fd5de38ab32ec","first_seen":"2026-10-10T22:20:02.570125Z","last_seen":"2026-10-10T22:20:02.570125Z","times_seen":1,"resource_available":true,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":8,"connect":35,"send":0,"wait":42,"receive":0,"ssl":84},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stats.junglestack.com/js/script.manual.outbound-links.js","fqdn":"stats.junglestack.com","domain":"junglestack.com","tld":"com"},"ip":{"addr":"104.21.92.254","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.411Z","timestamp":1791670766411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"junglestack.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 00:24:14 GMT","end":"Sat, 12 Dec 2026 01:24:09 GMT"},"fingerprint":{"sha1":"FB:CE:32:B2:99:2E:37:1D:39:20:C2:E9:CD:01:D3:B9:E5:54:A2:59","sha256":"6C:A4:54:2C:09:2F:29:05:AA:8A:59:73:17:60:49:E5:6B:86:EC:6A:7B:4A:CB:4B:59:11:82:BE:37:7C:1F:35"}}},"request":{"raw":"GET /js/script.manual.outbound-links.js HTTP/1.1\r\nHost: stats.junglestack.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=86400, must-revalidate\r\ncontent-type: application/javascript\r\ncross-origin-resource-policy: cross-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\nserver: cloudflare\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nlast-modified: Sat, 10 Oct 2026 22:19:26 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FqFXokStkIMY1xjjxtBEXIMz1PkNtCN9jUPfhoUH1lIUafSt%2FgBtDPAkqojspFWQSqXW6xTw9WzrJofJLaVO0Q77kqGrupdl86382XzWhlZd4nI60E16KI2QF3ztlS6YuUUfE5gHxc4%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a48901b24d2bb4f4-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3002,"size_decoded":2260,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3002), with no line terminators","md5":"3bbaceb65d8e3f8495f17da9c544ff48","sha1":"3ed5c738f6e5100d57144340e34c3544e65d4382","sha256":"a8ca65124c2e9e1b4fff36473cfa1ced55bd62ceff2490d6eae7d173dfd54b6c","sha512":"40811d3cd21c3aec412d8d90ab2ae96840cfcd8fdf11add1f7d5e54d091a631b9b3b938a0c6eaa004b9613c0a71ceb6ba7656889ecd993c2569a8a7098a9d90a","ssdeep":"","tlshash":"b85131b97942b0b909b9c157b62f73067a372616341aa401646cc8c43e28fefd372ded","first_seen":"2025-12-16T23:08:53.322431Z","last_seen":"2026-10-10T22:20:02.571227Z","times_seen":2,"resource_available":true,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":16,"connect":13,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/img/logo.2606e2946460.png","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.425Z","timestamp":1791670766425,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/img/logo.2606e2946460.png HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://decodeqr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: image/png\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-67fb\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 26619\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26619,"size_decoded":27117,"mime_type":"image/png","magic":"PNG image data, 1980 x 400, 8-bit/color RGBA, non-interlaced","md5":"2606e294646085b77f93d2f0ad6a9270","sha1":"aca41ffc3f8b8feacbc7c576a62a826b39f9712b","sha256":"4f643394390f1cba76ff197bb5e0ce7dd0ae96b7bd5ac105dfba9309e61b1874","sha512":"5c9939540b7a9b495765f82ae0d59cc0272f2f169448e0017577a1b62ed3ecd186c504d88f4b8a8f30ae13ea643d553d6537314dd7964e3253b495b19bd27490","ssdeep":"768:qxmEKLi8jcf/wfX1Q9Fvf9BtKTGy83re1R6M:qMEKO8m/Yc5lBckoj","tlshash":"d4c2e1c66d9359c7cd69c93d18102b22afaa958fd213f007ace9b4366c25f1d0c255fd","first_seen":"2026-10-10T22:20:02.572303Z","last_seen":"2026-10-10T22:20:02.572303Z","times_seen":1,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"decodeqr.com/static/img/logo-dark.f503107c4e8d.png","fqdn":"decodeqr.com","domain":"decodeqr.com","tld":"com"},"ip":{"addr":"94.237.96.16","port":443,"asn":202053,"as":"UpCloud Ltd","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.428Z","timestamp":1791670766428,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"decodeqr.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 07:27:04 GMT","end":"Sun, 06 Dec 2026 07:27:03 GMT"},"fingerprint":{"sha1":"32:CB:19:8E:46:6F:63:46:36:B7:F9:E0:6F:65:5D:96:7B:83:1E:86","sha256":"7F:F1:69:A1:7A:12:78:BE:24:14:62:F5:5D:51:3E:E6:3E:7D:A2:D1:8A:23:3C:5D:2C:06:A9:33:F9:A0:33:62"}}},"request":{"raw":"GET /static/img/logo-dark.f503107c4e8d.png HTTP/1.1\r\nHost: decodeqr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://decodeqr.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: csrftoken=dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"csrftoken","value":"dQzXMIkEjuGlanK0AebbKRFaoCq1o0p0"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: max-age=315360000, public, immutable\r\ncontent-type: image/png\r\ncross-origin-opener-policy: same-origin\r\ndate: Sat, 10 Oct 2026 22:19:26 GMT\r\netag: \"6ac5227f-679a\"\r\nlast-modified: Tue, 06 Oct 2026 16:31:59 GMT\r\nreferrer-policy: same-origin\r\nserver: Caddy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncontent-length: 26522\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26522,"size_decoded":27020,"mime_type":"image/png","magic":"PNG image data, 1980 x 400, 8-bit/color RGBA, non-interlaced","md5":"f503107c4e8d66fc9ff6bc83c3679252","sha1":"c9bdb2863e7ecfa1d637a8da2758e983ca967f66","sha256":"ff7822515eb331ebe784527356eaab1eb74ddd16d23ef9ba85a61524d5a165f2","sha512":"b37ccada070e14121ebbf44eaf8a350d919d06eb28d12760cc082b6e7b17d0d45141eaba107d0c9566ca5e581fd65ceb6accb18ac61be46299ebb8a4e7f55f00","ssdeep":"384:CcY5Tklw+x2R/MfZ/BZ8ZT+gRQIgwEWf/TmrDCQYEwnD7Ql9ipHu1IydQD1OQDc:9Hq/RUfp/QTwIRRmiQZ8i9MHyI+QpRc","tlshash":"5ac2e1d4b4f0a437def0267e420ba6e55886225c4850c3085027eb5287d6f2b37ffa6d","first_seen":"2026-10-10T22:20:02.573446Z","last_seen":"2026-10-10T22:20:02.573446Z","times_seen":1,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"decodeqr.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-10","alert":"Phishing Block","trigger":"decodeqr.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stats.junglestack.com/api/event","fqdn":"stats.junglestack.com","domain":"junglestack.com","tld":"com"},"ip":{"addr":"104.21.92.254","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://decodeqr.com/","date":"2026-10-10T22:19:26.858Z","timestamp":1791670766858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"junglestack.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 00:24:14 GMT","end":"Sat, 12 Dec 2026 01:24:09 GMT"},"fingerprint":{"sha1":"FB:CE:32:B2:99:2E:37:1D:39:20:C2:E9:CD:01:D3:B9:E5:54:A2:59","sha256":"6C:A4:54:2C:09:2F:29:05:AA:8A:59:73:17:60:49:E5:6B:86:EC:6A:7B:4A:CB:4B:59:11:82:BE:37:7C:1F:35"}}},"request":{"raw":"POST /api/event HTTP/1.1\r\nHost: stats.junglestack.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 121\r\nOrigin: https://decodeqr.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":121,"data":"{\"n\":\"pageview\",\"v\":33,\"u\":\"https://decodeqr.com/\",\"d\":\"decodeqr.com\",\"r\":null,\"p\":{\"page\":\"home\",\"host\":\"decodeqr.com\"}}"}},"response":{"raw":"HTTP/3 202 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, private, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Sat, 10 Oct 2026 22:19:27 GMT\r\nserver: cloudflare\r\nvia: 1.1 Caddy\r\nx-request-id: GN1LEfMCp_gWx9QAPbuy\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zhzCBYb2G7V9YQeADcnRBCourLNHsfhrzqf%2Fqng1Ored8AB%2Fd%2BZjnWhoWsrXmqgYo2ssDn3hksrjc6xBBpfCNxlWJG%2BqpVEfECpjG8rqhYjKe9hFhcNVwTxnZcm8mBJoVQFDcTrvRP0%3D\"}]}\r\ncf-ray: a48901b58b65b509-OSL\r\ncontent-length: 2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":807,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-10-11T00:40:25.999943Z","times_seen":502556,"resource_available":true,"data":null}},"time_used":411,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":394,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}