{"report_id":"9a3c47aa-2d53-4dc0-bbf4-1c196f8a02f1","version":0,"status":"done","tags":[],"date":"2026-10-16T20:19:12Z","url":{"schema":"http","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"172.67.164.195","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"title":"Raydium Staking","dom":{"size":345332,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1117)","md5":"f6c0132b45d7d8a29777a6cfc717f043","sha1":"1038928af0a0e542c07578b5d8fb96dbc9a63fa6","sha256":"ed9201447fd3bdf3e543d60a8200a17ed8d4f902e8d8ba5dc7f2129024f97d50","sha512":"7b979d63f9a21d9ea102241fd1f91532eae50f49683b635d90febafc1cbc7d0b5322878864d4751ed57ddc7050ac60e586875b6a5fdbb12c8425e649de01342d","ssdeep":"1536:psYD7r7gK4AVbsun+kef6Y/VSaCp+jTqjLDyvX8z2RfKPJEnh+k5OWWKpmtLpuNG:RoqHDP","tlshash":"aa746ab4a1e119bba197d5c079798b2f3ae1fa0bd91b524132ac8fe01fc7c86ec13155","dom_hash":"domhashf76c8924511d3bc25bb09d3acc163725","first_seen":"2026-10-16T20:19:31.723345Z","last_seen":"2026-10-16T20:19:31.723345Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"172.67.164.195","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-20T20:19:12Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"raydiiun.xyz","ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-04-20","domain_rank":0,"first_seen":"2026-10-16T20:19:22.698204Z","last_seen":"2026-10-16T20:19:22.698204Z","alert_count":215,"request_count":215,"received_data":1764169,"sent_data":108897,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"raydiiun.xyz/main.php?type=js","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"04186bd256983d663a85a3423a5be79b","sha1":"1e54da67738bb1c65dcf7954b5e12d64248ac246","sha256":"c8880c1b1618dd3bfdad83188111e6690e0ff168cae6f74443ab14bd33845553","sha512":"46a1813454cbf9f034e74fe4b9aae1f926d88eb6e3349cc9b9ad261a4c43578b12212c7c2964c1a1693d2b59b3afee70ea08509e7f7035fc067611542b4341c7","ssdeep":"192:SPuyS6EvZNlFielilPwQ70GrlM3ovyE0ZEzW1tOhandDJnmn98ApTqt7gTSoYpKZ:VIUfl3BQLlZaE0ZEykmiSpXdpt6","tlshash":"6222719cb4b6217086f362baa7dba715373520077084c9483fadc1c41fc1aa166a7be9","size":10326,"data":"","first_seen":"2026-01-22T04:04:03.775952Z","last_seen":"2026-10-16T20:19:31.974941Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b19b821de5e3ff0ba527e0b652f0a08e","sha1":"693f06f42ec4411be1184c1e52023c6055a1b0ac","sha256":"d79c2a7dfe8e16063e4fb2475445510d4f24a1200a2a6ecbb59b61b06c90986e","sha512":"0ecc8d20ac2d374868657c0a9314cdbeacfd58487191ec7168d0b764444197d1323f180dda0985a44731a1e2a6001d51992b9993c9293070882422f6ee5b758f","ssdeep":"","tlshash":"bff0dc1a307d12f086ba601fd3db37b8a1341207388ceaa739af52090ec2b21c5f48c7","size":493,"data":"","first_seen":"2026-06-24T11:44:40.330473Z","last_seen":"2026-10-16T20:19:32.176627Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"af1504246e13d4344a0cb8d3c8598975","sha1":"1c02898e695b6064db61140e6e905fbe43b6f376","sha256":"f2924c0e6fa212db9239379edeaafafe2729401b7db7c9e00b630db9e9b50369","sha512":"b04e634e05e6f46896b874504eb800631ed3e79076c95bae79627788efe8068fb04ae29d42789579787cb7e1cd0e2dd8dbbecf3c88458828ead17105d5c6cfa5","ssdeep":"","tlshash":"dbc01280d5a98aa04a5c488a51b6d250a560266c455254d3d5e9c99b649cd854a8cd14","size":181,"data":"","first_seen":"2026-09-19T08:07:20.029278Z","last_seen":"2026-10-16T20:19:32.177378Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/lpvP0dFg.php?s=%2Fipfs%2F54O7aCmOpgNR7-M8EtDykQ244818187cf5b76b944331d1ffd7146d%3Ft%3D1792181788260","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ccfebefa9322e252d7a45d35c7d1c500","sha1":"425f774197c6dff7e8d9f197eff22e3d0ca84273","sha256":"b8035d655859a69ef5f762cc82af6a548af6fc6a989f246692417dd9229dbf82","sha512":"0bfacc4bfcda9f2d4a68c409f904d000df17aba2e3ac6db0a316eb32dc15c48655548136024ddb28cb9bbea131d672efe8e66a64a944d6100d4b84432972f40d","ssdeep":"6144:fh5gD73JOviMTj7+mTaMP+I2/+jzWUf3a7lisXh06XuinBNO/ktt3nxcDoB:ns73Yisu/ld0oB","tlshash":"36e4b2d4c709b67668ceb2af1d33423fff8ea908115b1c785fc29c91a35638a51e616c","size":660525,"data":"","first_seen":"2026-10-16T20:19:31.924874Z","last_seen":"2026-10-16T20:19:31.924874Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"raydiiun.xyz/files/ai16z.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.778Z","timestamp":1792181787778,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/ai16z.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:42 GMT\r\netag: \"68cb957e-95c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WH2EUHP5Sy0WpzDKYWPLCC02v9Oktygaf65GavD56drUmdzWX5tkbEu20HHRg6fJBeI4y0dU99EDKwY2EOCuKIBIcxWQY6y91kcLocjndgGZFDFLTrOqULeWpn%2Bw4qo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f1b568d-OSL\r\ncontent-length: 2396\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2396,"size_decoded":3121,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ba6a2c8d83d13e733b5b1968ffeceae5","sha1":"74ebe1e0b2f8cd9dc241ed3129008069de52ee84","sha256":"1d9d4b4e419b3859a8cefcca7555b59ad358aa60054ec1ec2f8cbbbef276fdda","sha512":"cd5403ac7fe718697c443edc9df4392e0f8115ca788edc81a37cdfd7fea95aefc87f665ecc25037ddd34c1bbaf2af5943736aa28594f8e89ae9cfdeaff0fee91","ssdeep":"","tlshash":"e3416f435015397128c0f7d0b74d06ce434d27adbf85c1b0b62c12cfe849524cd3a90e","first_seen":"2025-10-31T04:50:36.985768Z","last_seen":"2026-10-16T20:19:31.732269Z","times_seen":96,"resource_available":false,"data":null}},"time_used":505,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":505,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/house.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.781Z","timestamp":1792181787781,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/house.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:45 GMT\r\netag: \"68cb9581-7cc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CgDhUOlHyEBJHlNdX1qmaUn%2FtmkiSUu5N%2FkgOzdahELqZuncFOYOiNo7BEg4zEm%2F5Oi94%2BfxUQYGyNH2fA4tJ1hip9wBlbmTQqt3Qju%2BnE9qViBqfGGHqqq25SX2mxs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f1d568d-OSL\r\ncontent-length: 1996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1996,"size_decoded":2729,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"857cec553edecf654ddd1932436aee46","sha1":"70bd19cbda90e98cdd980d64789f73cc7b06478f","sha256":"dc8b0b2a4a27b795fcf24e5aa02909c525a1221b7994e982577de7bf632e6921","sha512":"6fa4fc44580a9a1256f7c0974a231bb66123046798049ea08b9c933ca7f2c6ebbe85704048dedc78c03a151fe7239670cc407b6c277ada0d26f9a97f8a0a141f","ssdeep":"","tlshash":"1241d8066ab67f7a682d613494446a71942b809c80ecf869b81ed8fbcb6945ca278842","first_seen":"2025-10-31T04:50:37.008363Z","last_seen":"2026-10-16T20:19:31.737564Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/moby.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.822Z","timestamp":1792181787822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/moby.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:46 GMT\r\netag: \"68d0d402-5e6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a2rKNYpjFrT2w9dzZg0f4heBK87P1ePtZAIUNxvPV1r7alyuAtk5BSGj0NDxC10QhY36O7b65UKcwZ6yUBe1CLniAUXwnXYpLihmF631M4ooFJjmtGEaHZGmJ2JLm1E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdce0f3c568d-OSL\r\ncontent-length: 1510\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1510,"size_decoded":2233,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cd66a95f7bdff38a9d7700ad6612b76f","sha1":"7dcd562d055f4b028ff4583021c1beae004f9580","sha256":"cdada8aa788d4ef5d72ad7f361fb60414b48cc9415859ec6d897aaaf080ce0b0","sha512":"1e7b158eb61381a948d97c2f074343a5a01e939b32e6f39b3631d9903b033c07860b88156ab3ff51e0cbfc97dd02766d7010f3049f717652360ec26f3e834ce0","ssdeep":"","tlshash":"3c31ccbe3961d8009e2bee1481fa799c0f055c0b90502f1d9378d5c9d394b37501d5e1","first_seen":"2025-10-31T04:50:36.986636Z","last_seen":"2026-10-16T20:19:31.743908Z","times_seen":96,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/memeless.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.904Z","timestamp":1792181787904,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/memeless.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:11 GMT\r\netag: \"68d0ef87-5a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ejBNd4NzWPKNDnt7GE%2Fg8%2Bh6K9Jm%2Frc0xQKs2VC1HO%2FxdpD9Gz0qZRpvNBTgovjUz%2F6o6QbznnlFNw8WwZehFzzdB81sr1deyQ4MEz6AS86AxdumX7BSqF1hBC3glyk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd05fba568d-OSL\r\ncontent-length: 1446\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1446,"size_decoded":2179,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cfd01eddbb15e359e03ad53666d92837","sha1":"0eb26e3dac7f952feaa7a43651314b5f4f2097c3","sha256":"66d7f10adff11ad2f1908d0fde2e24f7d4c1b7e69972c032f25cd27c16f588f6","sha512":"3a78b39c7778fd3a843e9ced6ef672068a5095117e4be121006ebf7609d996755f47c0e3edca5b2ab86f768888277948946af507d5eb6868b05e1e1087afb040","ssdeep":"","tlshash":"223119130f920821f8da7b7e28d4c0556a1348e6a8b0c3bf831592e0081dcb680b0388","first_seen":"2025-10-31T04:50:36.756083Z","last_seen":"2026-10-16T20:19:31.747496Z","times_seen":96,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":196,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/kind.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.907Z","timestamp":1792181787907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/kind.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:09 GMT\r\netag: \"68d0ef85-418\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fi9sx3NRA5zyw6E9jBIzwh%2Br9mFs9ncwD4g02asS4RGVmQEdP0TuvSkPaw%2F9Qjp%2FO1JOlf%2FxG4NzeWazfAhOLD6M2gUf735zCADEHzqmwUfIwbItV6o81cNK0ObldQo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd06fc4568d-OSL\r\ncontent-length: 1048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1048,"size_decoded":1779,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d3b422300ae6d5c395051273c2f225be","sha1":"c4056948810ef58ec772b00f1d7a5f298edd756c","sha256":"0feb0e5732642b9b0a4652b6dc3974e284afb2a4484aaffa53610b57078d79ba","sha512":"f0098444383fffa5fbb8164ec524c67ace9fec9e98f16084782058ffb4624d12f1fe4af6f2208cb746fe22dd292e26d4fe2be8ba61a0d2b3c59f03d2e52722e9","ssdeep":"","tlshash":"0611d8fb55da3f5f2b036708cc68185609ea1270a00416754f2e5cd94d7fceba7101d7","first_seen":"2025-10-31T04:50:36.781629Z","last_seen":"2026-10-16T20:19:31.750984Z","times_seen":96,"resource_available":false,"data":null}},"time_used":689,"timings":{"blocked":205,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/san.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.951Z","timestamp":1792181787951,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/san.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2643-5d1\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aPnmQbnKM7s9gvM2ZKUlf40Vbak07q9Ck4viSXBxcByP%2BgrodK2Dtm1d6zrycU2QdH%2B%2FYpAdsM5Nm64fkE1Ss%2BWvpPF8VKMYZLyKgDzopINGBvA8P0E0%2B%2FO9kcvsbaM%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0bff2568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1489,"size_decoded":2211,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 78x100, components 3","md5":"ee087a6165361c81b5fea558c5d7448b","sha1":"5119dfc27d25ac56a2ded4feb644b34f9fe62bcd","sha256":"7bd7eec8bff1d4835084ff53a6ef1b83525ce74cbea28ac87979e2d6ec8f735e","sha512":"c4e5ad4dabc266c6ff54f9885b994914162220e25b04039d61a107b2bb7bd557a81754658f461bbaf29a1f700334513bfd0982c511df7d078e189a4f4235869a","ssdeep":"","tlshash":"d931c9fb4a765203ec2a20b616cf85303254e614d3cc4395d426d3564a167da0d01fd8","first_seen":"2025-12-07T05:18:33.865434Z","last_seen":"2026-10-16T20:19:31.754165Z","times_seen":88,"resource_available":false,"data":null}},"time_used":718,"timings":{"blocked":250,"dns":0,"connect":0,"send":0,"wait":468,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/clash.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.960Z","timestamp":1792181787960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/clash.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263e-e7f\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cjkmRGrfjsYAOhaZPknasgPvZGxUWJ7Cf5z0LRXXFIyamJzt7VhflAud0JyvxL9u9Ic7B8ousyDSyPjpehEVMAh7xN9DGXfl6MmTXkoiZmVHh5DMzoZ48v7CC2JjPhQ%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0cffe568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3711,"size_decoded":4508,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"b1f6162a88aa16e237670d7a5b4dec73","sha1":"dcda935e1a574a4f8dc670b8da4e711b5038ae88","sha256":"6a5bc26aaa462d511fb78445d33114d5430dad5f2f4296c2ca352754bc198165","sha512":"4664891b82b0e140ffaf563f372a0a8f5ea5323581c3f0e26e048a3bc35f8ee194ddafb38a87aaf6f9c1beb867d4ec9bdc8f6b300eb6aba8fc5232776d96a6c6","ssdeep":"","tlshash":"91716c23e10d17a6a75923c2fc1427b11d24d9ab0d772c231be604172159f67a8a4aba","first_seen":"2025-12-15T19:53:25.143046Z","last_seen":"2026-10-16T20:19:31.758254Z","times_seen":87,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":260,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/copperinu.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.991Z","timestamp":1792181787991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/copperinu.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31f-812\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TlBiGQLC7Nq4GRLwZmFL%2BDPaCTbPHQyGrTT6pHxh0i3HQ2F8uf48tpiX8oopIQTefT9XbecS1nDcqpJnjn6rM2CSa%2BvbfRDJgb4Z%2Fpkr5jx4ri%2FqemNQcpIvoKjufZk%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd11827568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2066,"size_decoded":2797,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"4aa96d367be7c1117ed78f80a96a0713","sha1":"402afe9782390dcc50fbe459b9bc963646373678","sha256":"b1b5aff8b1559ecba83ae59091f319df2eedacd69ef52bca0f754af36ac32737","sha512":"cc91d43c3f3f87dbf30077b9b93cae304a152f0618ba05e14e5141feafc6a7b5fd449f12c8adc2cda38c5b4c7033cab30ab9e7e62eaf6780257d83bc97971180","ssdeep":"","tlshash":"984118931b04ef97f98b407f6c54aa190141e849e2dd62f83340d37b7a812d94cc17cc","first_seen":"2026-01-30T00:58:38.136696Z","last_seen":"2026-10-16T20:19:31.762405Z","times_seen":48,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":300,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gear.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.640Z","timestamp":1792181787640,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gear.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 06 Aug 2025 13:59:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68935fae-4697\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lcozr2Sb2p9s3G6%2FU0DnfJxtONxoMltdUJwrj%2Fzn20kdx8%2FUK2f2kjou12EqBNIBepjnw3lu5Pv%2FLsrcZ01K7u1sF8n0RkUePWK%2BGH1fgi5xnUoidDhzyFrxVsbTp1I%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccbe90568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18071,"size_decoded":18848,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"f9cea30d1b25657c2bd229c771ecb32c","sha1":"f0e6746ad83a0c2ff4e49ca97dd909349d840475","sha256":"6a214077be6204ab5810a7b9982fc21ba7f6e3ef204dd006cd5a3be6ca597554","sha512":"78a559836815b1ced3d56a76cc79220376f1bde4fea7b4f07c921464d0a749fc3336645de35a95c5962c4f37f255c8c2501e06e76bf871d4d671b19f8e07be5a","ssdeep":"384:qhQR8rD5LBuQQyii+Xu1zvGsswHJSllAGUqsuyN9AihyPU:mQR8rD5LBuQQCv7AHUbu+jyPU","tlshash":"ac82d1e022cc08d2ffb74b6196091af08262cf8f459a9b39cd54107757adf7521bab49","first_seen":"2025-10-31T04:50:36.96906Z","last_seen":"2026-10-16T20:19:31.763802Z","times_seen":96,"resource_available":false,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/swarms.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.751Z","timestamp":1792181787751,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/swarms.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:51 GMT\r\netag: \"68cb9587-4a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zE3kCVVQnKCp9PbuQINg9Ardd0YVhJedHQEmlPeJixRtnvk1nDm0oS0oHoYLwuD4vqVQErJQX%2ByYNkZ4397ZnPCu%2FMM7RuTvEf2Seq6RL2r313M0KLqTr133RC%2FWl1w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f0b568d-OSL\r\ncontent-length: 1190\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1190,"size_decoded":1919,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"105df6daed68ee3bfb91147de07f0e8c","sha1":"31e078984547c04d8264c6e690d6d74e9980335d","sha256":"a17c21e49218279ff9813e07bac84792a62c797168e5aec4bd2e4f4693b4a019","sha512":"ff9015b98239c142cf4edd60ada8bd284f3a731d49c1ee6067a4617f34ba14b898bbc738fbd5847199f71e7a3646fd56a4fa4d972df7259ea3f4c46fbaca64ea","ssdeep":"","tlshash":"bf21071ae6282653c4fd4c0526eed8cf3535244090109a65f24f5b620659efa8c10a09","first_seen":"2025-10-31T04:50:36.861207Z","last_seen":"2026-10-16T20:19:31.7655Z","times_seen":96,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.871Z","timestamp":1792181787871,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:25 GMT\r\netag: \"68d0ef95-7ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L5mk9%2BJZxkKP1ufgI%2FXA%2FkWVPvoiKwzQKEH9wB28aaaiS0tucj7wFOGa%2FEQw0Y3cM%2BaBXKu6yPBeCBGm4sMcp2DjHhm80xlp3kjwrtHQK%2Fzk21iljqq9iX4hm9HouCA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fac568d-OSL\r\ncontent-length: 2028\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2028,"size_decoded":2763,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da9221034a235710639dd4a71a34f6f2","sha1":"2e66eecb5836423f41967133c1c9bbfb5319858a","sha256":"25fe63034eb43a1d3db966986e2b8752adbfa9fca3c3c29369d1e4aa0cc0516c","sha512":"6020fcd1d9bc5303a79385198527feb46b6cfe1513c7c0741887a1e717b342ad07d7ce2cfaf98f88a75ad43c46228b97df340eca47b69f92b201d97517f28299","ssdeep":"","tlshash":"f741f878b239e740c8597e3deda6879c698b40e1bb0a0c661a8c15b0252ef8714a1d88","first_seen":"2025-10-31T04:50:36.942321Z","last_seen":"2026-10-16T20:19:31.766386Z","times_seen":96,"resource_available":false,"data":null}},"time_used":657,"timings":{"blocked":174,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/natix.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.891Z","timestamp":1792181787891,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/natix.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:14 GMT\r\netag: \"68d0ef8a-500\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ei%2FFMxwBRCzRbJUyBcuTMFPe5azEnM5Mlksr31%2F%2BBjAWjEciGSmn%2Bd4ChJnEn3AOs%2FlxRLdxIfud4IIMMlyidOm%2BPwIkpTWMeBnGeLR4wIpHVMQU5%2FJsT6g2HOgJ9N4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd04fb4568d-OSL\r\ncontent-length: 1280\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1280,"size_decoded":2017,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"eec9fb39920259f780a7f043b6fbf91b","sha1":"208ad11ca8b9394aad88cbb9c79a34bc5b67e573","sha256":"c024cd77a0ab73d32d876352d5e629fff45ecbaaa9b377772471b91a4eba63c4","sha512":"1cb25472e4ff5e3fdc1cae7d31babb9e197ed99708504c10beb21646697d767ac3a924cdf6ff0abae036710a385152830bdc9e5a3bc5395d36651175eee252f6","ssdeep":"","tlshash":"b821cb4ac21221d7ab6305e423c51505ed1fecca96c1a11704f72664c9a4f2c6d6c2f9","first_seen":"2025-10-31T04:50:36.779868Z","last_seen":"2026-10-16T20:19:31.769902Z","times_seen":96,"resource_available":false,"data":null}},"time_used":660,"timings":{"blocked":184,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/chillhouse.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.946Z","timestamp":1792181787946,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/chillhouse.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263d-584\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SVbCGB5EE2rtR64Zl0hvLx963LOKMmJ%2FBIyTxMTTIacCc5IRjIzKBVIVnySdtP5GYAQGJRXf%2F3f%2FFX4MwNBBKb7R82HniM69c%2BLm469x%2BBg2n3Fi2%2FYPR4pdF97iIQA%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd09fe9568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1412,"size_decoded":2126,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 85x100, components 3","md5":"aa690a3d193cf61f98fa8b77c96f2a41","sha1":"3bbca9a768738972540d387610f5316db8bb377a","sha256":"f3716bd48ea2b5fad654d7aa8727c4a228426bfb86b12ca7a8c08ecdabcfa802","sha512":"de853edc84dcd16ca5d91584cf99be10db269ac855c92545f52eb509c61c4c19f2e4813a7c200c381a89618f70304e03824507cdc071382be982a0b42efdf6fb","ssdeep":"","tlshash":"892186ea435898f6e8390a7f4d86c4a00c0baa12c8a8139e15469db5f8659c27c51f6d","first_seen":"2025-12-07T05:18:34.167529Z","last_seen":"2026-10-16T20:19:31.77132Z","times_seen":88,"resource_available":false,"data":null}},"time_used":723,"timings":{"blocked":237,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gsd.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.981Z","timestamp":1792181787981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gsd.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31f-a05\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rp%2FHADiPCInjxoBUlYKE2j4P5LPBomsFXqswcfOh9Lg%2FAnYEGIZtbsQaZ2J0%2BDe%2FCohAbUqQTDJ3Cfv%2BKM2Bvg4%2BLOBvz8O8H8EcmdscYuJW24hPsHhznfo2or1%2Flig%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81e568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2565,"size_decoded":3376,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"6f793230328a358fc4141ec8bb864fd3","sha1":"7a43c367087384aa0aff24a6fa62245e280e7058","sha256":"ce0dbea49c280b6844a8016ed20de38e725f2349dc6c85cf67775ca5d57441cf","sha512":"0c251306b4919f51a42cc7a43f23197ae98dd27d5710657488620af2cfa6390189580120cee72abad2bedc5d25d25a4c0b8c4b8b4ec6f7c5df42af8139c0756e","ssdeep":"","tlshash":"fe515cd27407ef08ac12bc06a07c8388a6b301b3448ed4847f21a06ccdeac3d6a8357a","first_seen":"2026-01-30T00:58:38.078894Z","last_seen":"2026-10-16T20:19:31.778826Z","times_seen":48,"resource_available":false,"data":null}},"time_used":784,"timings":{"blocked":286,"dns":0,"connect":0,"send":0,"wait":498,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/triplet.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.994Z","timestamp":1792181787994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/triplet.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d90-bd7\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Yb7c7Eft5PEscNkx8qAl5UK2uh80NQmC4kFMvvZ%2Bz4rc78NwoyMP5fNDHhrXR4h7hTAWqmqJskH3p69BrVFO43H7RQCvZZ9q6g8xQlU9n%2BinwbaKl72Lht%2FTWN9MTg%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1182a568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3031,"size_decoded":3793,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"ecb8d582ec3e7174c90adce5e2989b2a","sha1":"a48bbd9665e7504c6448df07abc43cf75c8b75c3","sha256":"25e562baf9eb2d3eca527ee5c4b4408254eeed7cc16bf57961d8cb89f100c4e3","sha512":"1b20be1ca36eb3731071a8bda39c4b02a884775fdacf97a64686750fbc108c8bc83448e198a7cda0a09749933797b30c2a5935925dbb7eaf5ed47554af8393a4","ssdeep":"","tlshash":"23512d7b06b21117fca9433d0db29b219243ed27990d8759748fc3c5257d7dbcca46a4","first_seen":"2026-03-31T13:47:07.145541Z","last_seen":"2026-10-16T20:19:31.779775Z","times_seen":26,"resource_available":false,"data":null}},"time_used":775,"timings":{"blocked":303,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/lpvP0dFg.php?s=%2Fjmpd%2F","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:30.711Z","timestamp":1792181790711,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"POST /lpvP0dFg.php?s=%2Fjmpd%2F HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://raydiiun.xyz/\r\ncontent-type: application/json\r\nContent-Length: 1332\r\nOrigin: https://raydiiun.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1332,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB8AJZAyEACQAgA0IDMADPAiIAAgABYgMAAO8nhn2XtsKCAfJPb_GyBD2lSkLpqYYCAAA6knySNBO1Iqu1uMdEqkG96mJWjoKMBB8hp9QXpcASTBKHobameBR7D0G1HA1NdFh-QfyJox3wBRTydDrq1t71DF_zNtEqmjG3iFgBdfa8c1gFnzIBb4_H4C_QyeEHqKZcPOsuEFeMmaaRSSeKgzm7tEWTyiVKSQsFKZdHzW88gFZVkVWN9C9aYfNRRKynl9EppUwxATMxlHq4N_K-Zb_ekA4_0SOqiqCVW7o6-X6OxDqFm8SImKkoy6wqSOCTb5z-q5TRaMG-0SDRskTJpfvkHklIZog-NXGf06qWpTOGe6gB_KHFHYw1o-JMiVRPUuNjEwDer2p1xITRI9eRp8CqF_nb4xcDqi4dQa9PpiAZjXEu07vU2akEKGmABN1jwfQKQfVALak5fKpArj1SVFCVtBRHaa5GuaPz5cOoUOuVpBxpBR3SAL4X3anfRA4ow-reYLA2xdy-tLisccacIrX01p6BUsUlfgeeeDPztwMJ1Ljlp_Q3m4iukFylbUDzMrD6slSfHGo6KyQPFMQbeC-ysBYjkF1BskDVXzDPTpaoosl8YTHThpQAYschMAWeLn_ErCG4dwqaIT7h3YUNRuEx4Eh797XfNsfrRMC2Ae33oz8qelcMW2M9iFnTdoizbNmXGCy7imEYZPLJblBV1lCnhXdA0muruY7uoX4PIevVh9H32WCsa3XzNDPw2zG1kui9uCkGPEROxi5UPSorO2MSIdCg1qV44494obLio9giLIaHzn01b3NNHyTYVZ-9ZEzSzvdhp3h-hgWeeqgDwJGtTqzVaMyFOhVjFF8sWhBlrASfZx9MeSEBJSQ_V2aTMeUGi3xnErdGVwqVMFjEHT9Rwcqxu0NrYLBG4w0MwbZ7xSQyxy1B33x_mupIaiffEnP1OxcVbifhk4031KSqYW6qJlymD8p2PvMfwBl32akmqLq4bUKfSiKsczpYpMv8YNpnQqNoveaVsCUiAQveuFWf4lYOT_JE5jzm8su1fGwxYvTCCQvE8AKCWk9E-9k0gW2VGjjGsbqJSOW343kFc90_bpvPpKP-pSRcLUzBddQycj48fMI3YxwO3fikGzGBLFs4_8nYtc5M31x_nwTpWMzFxuKUORPMMO1PuYpYksUpi0xzmpuGyiNbkAQ_g-H4Nbx7VVzMrW6IJUE_xzVBuFXFyKaCgFF7mBAlEA\",\"challenge\":null}"}},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:31 GMT\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P1Ut%2FshsX%2FhS98h7ZYfRy4HqyZ1KhhJAaWm2vf%2BxnJC13b2n7lblYG0Ns9XPn%2B6ht58RicaY3g4SwIc8a96e0CNg70UhxyANesExB85FdLte%2F0bEHpcP4Gr710jFhg0%3D\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bddfead2568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":2584,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-16T23:25:54.97182Z","times_seen":19154246,"resource_available":true,"data":null}},"time_used":1107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-16T20:16:26.532Z","timestamp":1792181786532,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e7%2FBNfZxqMkOuFGp0ViUqhea0%2FuzmZFSsLVJbl2pWd7BvHa1nSx05Y5o%2BZaVGciBPtxl8l9i66QUNLigmGaQItGTL4j%2Fl6Dkkk%2BoRz%2Bci5ARB3zyYpjVHlx%2Bk64Me1s%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdc69d7e568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":332751,"size_decoded":19393,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1089)","md5":"2c704650dff501dd8da3a5b0c7b6423d","sha1":"cdce601b67bbb895cf9ab00d90db45c49d48fc1a","sha256":"9e78e49350bcc593a460839c08466c4d07908250a79f19bb0ff133c1feeaac97","sha512":"7d790f6755a20d3a18bc4e85633b7f9122b14d5d38965db9c2281bb313058ea1b907495a8dada7a00b0632cb7dbda54ca5f967235bb71bea85269af479895118","ssdeep":"1536:psGlLwTASWCMJMLR+kQfY1HN60U0271bCTMQT//KhR3WU1FfE9rfQB17252YlEMb:Jbbez","tlshash":"586438b4a1f519bba19795c079398f2f3ae1fa0bd91b524132ac8be00fc7c86ed17145","first_seen":"2026-09-19T08:07:19.779759Z","last_seen":"2026-10-16T20:19:31.798886Z","times_seen":3,"resource_available":true,"data":null}},"time_used":826,"timings":{"blocked":-1,"dns":99,"connect":23,"send":0,"wait":704,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/eth.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.665Z","timestamp":1792181787665,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/eth.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:35:16 GMT\r\netag: \"68c92f54-5b4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K9hyjhhHf%2F3c8MxXEKh1qx5MJjken2sLM%2Fj%2BvRkMuk2wN9QAFsH2XNwlwHTgrBgLnxy4Kn1FSebLKcY5sjd2ab4ddR9oikCnMuasnjQEME8WZk40jCHsO9YZ9AzBkjI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcceea4568d-OSL\r\ncontent-length: 1460\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1460,"size_decoded":2189,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7c33fb710fe13a417b44e4474ffe4167","sha1":"6a96bdee97e8bb16fb42d90782cd396033f48d5d","sha256":"12b13327e0850eae05d107d014f7950ac6f228019cf2873b5f384abcef40e244","sha512":"3243a8948c9768af94c8d85dc7de2d7485fab469adbeac13779bb2d92e0f0b34a758f5f0cc4d9a7d7a0a08f52ba6c4d35f65e40393fb5034658b6e69c157c542","ssdeep":"","tlshash":"d031e6139e971ec4ca8625fca9a3b3468421784642b948b94a4c4b666e87c356ed39cc","first_seen":"2025-10-31T04:50:36.880197Z","last_seen":"2026-10-16T20:19:31.80329Z","times_seen":96,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/slerf.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.686Z","timestamp":1792181787686,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/slerf.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\netag: \"68ca7a89-35c6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BZGD0p5YiAd4PLK7L9LS2NEL0aM1t0rpFcbyye%2FVmMATk7LDCglWNK06eiaUNhD%2B0vM%2Bpmle%2BJZ2JRhAJIl5858Qh4tQD31ueKx0KcU%2BL%2BPl5qnrXQb7YUt8qVDclSE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd0ec7568d-OSL\r\ncontent-length: 13766\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13766,"size_decoded":14505,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b17efc7faafe7ce6ab289c344cb5a7d6","sha1":"6f30ebb535f02d9875d83f0738fc6e608daf43ee","sha256":"93518f3827ee1246006ea0d2e53258fcdf404bcf877251171dda6a34e8667079","sha512":"7cf9f8006a7dbd13d2ca4fa8642b0ca12150ea80d285a2d81c70685affcef42fe6e6c4a25fa1c9ca418361a878358ea4ec570e663f92827b791313601bf5e122","ssdeep":"384:fjeRUjDcDJykI9J+yPz3HKBPa0KUxfVFI41o:wscDgkIuyPDoCWfVFa","tlshash":"e552c085a2b5ca65e80082ffd0565cafe6232087e73937cb839f87af7510fc2e644155","first_seen":"2025-10-31T04:50:36.991077Z","last_seen":"2026-10-16T20:19:31.816123Z","times_seen":96,"resource_available":false,"data":null}},"time_used":629,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":150,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/popcat.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.697Z","timestamp":1792181787697,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/popcat.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\netag: \"68ca7a89-266\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b0udl8xW1iw%2F6vHavADWrsikBsxiqFCKR2zb7Eq3qi1jsBrO5AooA4iM80lK2K81BDY3WKB7K8lkw7LG4n26tR67l3rhWhGQZ%2B28bwLs4ie8EBkceridztwec08qY%2FA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd1ed1568d-OSL\r\ncontent-length: 614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":614,"size_decoded":1342,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4e45b43e204d98ae45cb279b25e2ffa7","sha1":"0c6fe747c24f72cb8a6617dcbc64dc8a5cd0e501","sha256":"f712a5ed3d701cce3e39e9bc37372b1d54e16c655260cc0ea31b4c3deb052ad3","sha512":"eeb5fd0d9ce3aafccb526bd5aaee044fb6c6600d6b59d791e217fca8ed44a6a17c26abe5d2b1dd55ffdadfd837372e3af4151257d381f4b7621e62ba08b2e38c","ssdeep":"","tlshash":"67f0414287a87a40d47c4276c29227618090f092f495d507a3ff6cf39ce7291b503168","first_seen":"2025-10-31T04:50:37.010117Z","last_seen":"2026-10-16T20:19:31.821231Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/spyx.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.792Z","timestamp":1792181787792,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/spyx.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:35 GMT\r\netag: \"68d0d3f7-250\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IJeFHwtQkfjtENxhEovdbxmK3cv0JQY7%2FYlkzfKO%2BpcSX9TdpQZfqCVDsaoTwd3LnvW8G703q6uDbDPyOQ7LY7RBDn2uc82jIyoC%2BCiLFNir5nO82DvHUmK0aB0%2FHKo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdaf24568d-OSL\r\ncontent-length: 592\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":592,"size_decoded":1322,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"33776e6d825a0d18160bc2b00761ecda","sha1":"b2bb857683b1a4271359681d303de64b2c62450d","sha256":"67d266c1cddd93ab9dd9f2aa8fed857a4fba1b3cbc2ae18229186e619f0ff279","sha512":"a753a51c529462fe3bb1f6015930dff3069c09d973a83b33ac3d6ddded938424094fc015e381a917015cd0647ceabc6583e2da68332afeb0a1baa3ef0f1f721a","ssdeep":"","tlshash":"33f047e4a3ead475d6134d90d37db591064661459812c34cc4f7a5484ef382ccc8388e","first_seen":"2025-10-31T04:50:36.855096Z","last_seen":"2026-10-16T20:19:31.823323Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/hosico.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.839Z","timestamp":1792181787839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/hosico.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:43 GMT\r\netag: \"68d0d3ff-92a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=97btVFia5ncXWCSZTLWXCnUmJbOZdJ6sFw1R3heRhzzJ%2BA%2BnwcLVAb3cCDde5tfD%2BOfMuTAZ1h%2F5kxBXyYTkZSu2RXbikBv7T85T%2FsCaaoRGXwunaDb0ubRhTwnlYrs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f8e568d-OSL\r\ncontent-length: 2346\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2346,"size_decoded":3079,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x113, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c89e4f57ab2972ff29ca095e74b8cd82","sha1":"67c6486255c96504799239449ae06605011273b8","sha256":"249a8c90aee15935542288ceff2c9fb17950604dc9ca88acda944838c1810a18","sha512":"0bd08b41e9cba5493452103cf10d49a13eb1505b8c44f7eb2ac5f216ae0dbb21b070d619852ac68f87777dac05ba40b87ab247bef31f6bb203f24e9b5d56bb1f","ssdeep":"","tlshash":"ae414bc14b92fd616b96f2365f073e4caa8130e2c8557a7b82fa1015f7453ad1be2e0d","first_seen":"2025-10-31T04:50:36.66801Z","last_seen":"2026-10-16T20:19:31.824639Z","times_seen":96,"resource_available":false,"data":null}},"time_used":650,"timings":{"blocked":146,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dupe.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.905Z","timestamp":1792181787905,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dupe.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:29 GMT\r\netag: \"68d0ef99-402\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oUa7hCSx5rjgDs4QPhJ97CsjoM%2FhSOPQbS%2FpnV9fvSdlwTroDNU4mqnBHCtSe2yyaAMT4kaZPk3%2BKJUexRJr1%2FB0cqY4tBc9sxadGSiqydF3f2VeXuQjhGXTIYUxwJA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd06fc5568d-OSL\r\ncontent-length: 1026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1026,"size_decoded":1757,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e8675b6342cf88202289808f47f049c","sha1":"92507587eae7b3a0fffe2103eb9ced3ec96c72c9","sha256":"bf5b8dae96c220f4ae43d068570d4e6997e717221f2d0fd6183cf2170eff0b7c","sha512":"a9738c44622548ec99d63411867428825d86df16988910561a028722a6542ba1a8d928d011718d8a98e2156501f030bec30b0dc8bb9285c76033dd7eb033843a","ssdeep":"","tlshash":"9d11b51797065ce0d4d6e8f1ce6f6860941a68768843d89a068992c15f7560d80f4d07","first_seen":"2025-10-31T04:50:36.994427Z","last_seen":"2026-10-16T20:19:31.825675Z","times_seen":96,"resource_available":false,"data":null}},"time_used":678,"timings":{"blocked":205,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mirai.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.934Z","timestamp":1792181787934,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mirai.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:12 GMT\r\netag: \"68d0ef88-2e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FI2FXsI5VD2%2BikNBAstFFd32AUd%2BwHu1perZJk7ii2gGD5nA6zeCT2iEJYQNghD5CJyrj0TcduezLP5qZCV3JVwxOIdNS0a%2Fq57rdtmiw29FIkpgO2GdbP03XRJYbJA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fe1568d-OSL\r\ncontent-length: 738\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":738,"size_decoded":1468,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2820876af1e6e646f6730e4a5fee192e","sha1":"202dc91599a9d7204cb6bba34f2712b0fa2f2fd3","sha256":"a9ee50484732061b37a05ce619e7c119090c665614fab1567b3e2ab59176f438","sha512":"f246e44b632aa8f474643dd11581e588256fce2a14b33f9c4f9bb2a7dac47bc615ff2647cdc2282ac480a1f70325e3b66b667237b5a770573b301afc02a8be35","ssdeep":"","tlshash":"60016018a4a31f3fbc4178b7a23d9de19596c3b4c220ad09bc03532563688232b83e0b","first_seen":"2025-10-31T04:50:36.844332Z","last_seen":"2026-10-16T20:19:31.827881Z","times_seen":96,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":233,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/sol.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.645Z","timestamp":1792181787645,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/sol.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:43 GMT\r\netag: \"68c93113-26c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BiG7WrMtgWatiOpK3gC4xMUwi9wMqrJDzlBtZogEMWQTwxQgVAijZhJw%2Bwu4ahelyGbOhBlUmGrLtX8BXRPGHCVd6jB5R4Fla9nCDivQNRb9Dy3sHpnSF32llVrFQGs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccce92568d-OSL\r\ncontent-length: 620\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":620,"size_decoded":1344,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8547fa5ccc4675b4f3208fd43d51590","sha1":"ba297bf4e08ffc4c3994a29c1c0a4ed4751402fa","sha256":"797bbd8533cf1c0ae74b78afa4b44f23dae4596b47f4d784ecfaa319c68f2d8b","sha512":"3fbf3bbd6331e3b00efeca1c492c5212d9960dcb8390edc7b425d0ab9563d38f285974aaa47cdf69b3a67ee4ae383c2b5b32aba873ce9c930dfc110e47585f17","ssdeep":"","tlshash":"95f0e12a5b714927d429e53c0abb1396101cd8b6d03852ab52228e565f8be11dff58c0","first_seen":"2025-05-07T12:19:22.461777Z","last_seen":"2026-10-16T20:19:31.838168Z","times_seen":98,"resource_available":false,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/nvdax.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.846Z","timestamp":1792181787846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/nvdax.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:49 GMT\r\netag: \"68d0d405-4a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bV7BpXihtHVNzfucWzD6V8UtGS7L0%2FWRTcqTJiyQxZl0IYXLlKdTIiDah0BftCgjanuDYYgFcYfjA3Lv%2Bsq%2FNjOkc5jaccVQi8p1SndznMkYUqaF7FylHXaZP96JgqQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f96568d-OSL\r\ncontent-length: 1186\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1186,"size_decoded":1915,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9b36650699815d6a5e70fe1fd70473cf","sha1":"7c98038510ce51c367c40be86518b97c053d36b1","sha256":"6ff027fec2b5a0f01c63d9defcd00c21702eb091f13e371b9635b283f9c01234","sha512":"6b5a17bbcafe3ae8ce6ec0b23ed41617b92f2a8b4072c34bfa8cdd0c62f019d30d2599a1acb5c4c66be4b996c91789a2a5509aaf17372883d7f4607681cdc6aa","ssdeep":"","tlshash":"5521c637119c487c07484e42f9994b7d12567439db7afb3786c6ff251cb8488971b292","first_seen":"2025-10-31T04:50:36.768654Z","last_seen":"2026-10-16T20:19:31.840918Z","times_seen":96,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":155,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/avo.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.879Z","timestamp":1792181787879,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/avo.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:24 GMT\r\netag: \"68d0ef94-4e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3AIP2VL%2F834Bs4IjjMgu5UMgBDf1sYNPUBSooRjR9nFGnWmG0%2Bm8whV4jXqETJzxsPS8DUo%2BUCRUeq3ndD9WVq0zfxZIYiZb1aOX4WMHKWMWQGv19Yb19adHn3kFiSM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fad568d-OSL\r\ncontent-length: 1252\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1252,"size_decoded":1981,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d78936f6327b4a4acdf25d593d591a3d","sha1":"17bf8175d593bbd8591846ee417a375891a29d28","sha256":"49a455a7cf719299498f1ef0106201806b20739992d3adbdfa9e93a76e202690","sha512":"dd259046b119867809e89f2aa46629194a2e4b6e1693d4364bfddc5254a5a6f5ef24e4d79d14b889fd111b7b48c9d211b0045dccd4cea4237bf80185c7aac6f5","ssdeep":"","tlshash":"5f211772c07720d846c452afaeed0ae25c3a4a643fcc804c195908b4a146c7fee8630e","first_seen":"2025-10-31T04:50:36.771814Z","last_seen":"2026-10-16T20:19:31.843885Z","times_seen":96,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":173,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/brainlet.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.961Z","timestamp":1792181787961,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/brainlet.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263c-759\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hpffsPf2%2BJygFKPZUeAjqduRMjvLTeukq6efbCN96tV18UQbzCzG9wXQmnTpery7brzUxOofAxOAEJ7cDuk5%2BhrFLxwBZrL0bKd5c0jKenaCD5k%2BiamzH63KzJE7uBQ%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0d806568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1881,"size_decoded":2591,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 84x100, components 3","md5":"e2325c89ff22da30cc18991715efb193","sha1":"a941db046a5d599e67d5ae4b9eb151aefd85a09b","sha256":"5740fc24d8980511efa886abd4e62b672d401a60267628ea41beddc7f07454fb","sha512":"db1b35ecccbc3266b15a957c2e9b161b708537f63f65b0dfdfd231d194327a5ea50118284bd2688c6c50002444db12d2f122c83e76745a8b6d5d8707072f62e3","ssdeep":"","tlshash":"334119e7f2724783c91704370dddc5308713ac2ac94e13d89a52e32eb66e2a4ee20ac0","first_seen":"2025-12-15T19:53:24.996648Z","last_seen":"2026-10-16T20:19:31.851037Z","times_seen":87,"resource_available":false,"data":null}},"time_used":434,"timings":{"blocked":270,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dreams.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.992Z","timestamp":1792181787992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dreams.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263e-7e4\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qr%2Bz%2FEbw65Kz0cGAk3F5jaT%2BzbuIHxPOmkZ1ZeJqNh1DeHqDxQzoweX%2Bavexc2rEczGcQowKITnHUQPtiqW0iT%2FnHsX5yLIC6WCKowoGCan6PUU4r0s%2BNimpGCVMXo8%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd11828568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2020,"size_decoded":2745,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"fbdacde8d2b94ea861382d8d53a843a0","sha1":"a0970eaac2cacf399d4dd9e5d9c511521cc33d2b","sha256":"6975d95ed82b3547470049cd979e9e3fcd6b20aa7fff655e764ddfcbbf810206","sha512":"bb4af9a6922bce0e7b96ac1eb990544129ad89896adc83d50fe377cd61758b0d2cdcd6c7c9e0396774b65a4d1cba6202ef6de4737a1749718008d7bfbdafb47c","ssdeep":"","tlshash":"764108bfb381102fe71ba07455e5ad28aec95c15e820839372151abb78857e2b580655","first_seen":"2026-01-30T00:58:37.962425Z","last_seen":"2026-10-16T20:19:31.852388Z","times_seen":48,"resource_available":false,"data":null}},"time_used":462,"timings":{"blocked":300,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/qqqx.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.008Z","timestamp":1792181788008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/qqqx.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 19 Aug 2026 09:03:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a857150-53e\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xUtDB%2FTGBL%2BB%2BKHcXdr8IEn%2BC3yTmcflFDSZ5RJrve3a1pFBrPW4dgIX2kRVoGV89%2FCwxnqeKoOW78F%2Fu5Li1wLR7BM99YRTFKRsTkVpDpjsz8d0inhNvnx6zRSmgqQ%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1383a568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1342,"size_decoded":2129,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 4-bit colormap, non-interlaced","md5":"3792f20df6727df466b0458a51a6921a","sha1":"03bb47dc05e3d51d372034c3fcdfb51b318e99c7","sha256":"70524f41fd06d17cdf9b1ecf7926ead3db584f9e16c123c4521e6c6fc0cea60d","sha512":"41c02bed885b146b178a549be281def2c8bb759c84d3b809a5266af2ec4401137ff6ef737a972c7a7c1f28c70f4b9c1c6a5a180f46ae78fb7135eed9831704cf","ssdeep":"","tlshash":"a521d889b8d8fa64c7ab481b1c690d44d09d59237b960c9159f040d16cd84637a7368f","first_seen":"2026-09-19T08:07:19.819637Z","last_seen":"2026-10-16T20:19:31.855919Z","times_seen":5,"resource_available":false,"data":null}},"time_used":858,"timings":{"blocked":324,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gmt.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.677Z","timestamp":1792181787677,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gmt.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:29:52 GMT\r\netag: \"68c92e10-92c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cKrFNaHHvD3CaCOKdVMfqOkL0ZznRniUD2eMCGcBwwrzP4KY2P3mUEgN9bN2S3yzEjSRAvyP2Suas8mRtR%2FTmUoVqv6Y83%2FHUmeiDDZlzVoUmWouj4fPZ4WEOFEgXB0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccfec1568d-OSL\r\ncontent-length: 2348\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2348,"size_decoded":3075,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f18bbf73d3b9508e435bb984166c9349","sha1":"019a45172c382a677d74d06488e76020e5a1b966","sha256":"28f58cd63ab9353a6a07d31f4e1b7194771e8f29b5cabcf09756deb16acdcddc","sha512":"6feece22442fdb24307713bf3a2fd1c4b664da0be3770daa667ee81d3d443c591c545ae6a96bd0112ba29258a3553e6ccd5a7a3de18a313d12a2ce24ed8fb071","ssdeep":"","tlshash":"fa411d9386f10d75e30535bed15d7f00567399c5c91784a5f8cb852b2c6f8224e9e8ec","first_seen":"2025-10-31T04:50:36.982122Z","last_seen":"2026-10-16T20:19:31.857122Z","times_seen":96,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/cards.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.699Z","timestamp":1792181787699,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/cards.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:27 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:29 GMT\r\netag: \"68ca7a8d-518\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uLWeKiK%2Bls5lnCHLpJMNKkPOEtwYQ6Z8Z%2B94f8lmmZU9jejHlHUEG%2FSJFWHBF75kFH2GgDKu9qAiS6BAm0GnXF96SEfosymtUJzUJQGq5VBPjlpnoKwunoNlW%2B4d%2Bpc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd1ed2568d-OSL\r\ncontent-length: 1304\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1304,"size_decoded":2037,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8330dd5f2b43db360089e59908119673","sha1":"bd28be6d93fa6ce3975e2b64f2ca2bd8af2c152c","sha256":"7565226b687289596b23256419a737621abf325107589b8ec682b2be80853efa","sha512":"a32c4f06f4c7a717bc62b1bf2e2caabc080206d1023f3716274a7fde6cd249f2f32de54c9d2d1371e4406f5fbff5db31d4d645d0b5068854a1523fcb78cc12d3","ssdeep":"","tlshash":"4c21b76f4170c352c04b043ce7a52f5aa613501507a5e29793a93e42cef6e75cf28148","first_seen":"2025-10-31T04:50:36.722449Z","last_seen":"2026-10-16T20:19:31.857965Z","times_seen":96,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/swtch.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.744Z","timestamp":1792181787744,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/swtch.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:39 GMT\r\netag: \"68cb957b-3da\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HXtOnPDmWB26b%2B%2BraLWRwGuAGIi5uLBHBEa6Ki43lUV51W%2FAVJoNq0qed%2Feur1dLYtPGgHdweYGAzs9%2FlCCm%2B2t3RCOYW7%2FHsPY9GzuEq6OcMJHMvXG2013N3Xhty6A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f04568d-OSL\r\ncontent-length: 986\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":986,"size_decoded":1722,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5197efb425d9ac409817b70e92ed7622","sha1":"7ad2127913e85eb4d0520390c6dc9edaa0100978","sha256":"17e3c44f32dc83178553c15ffa7777388e73db2ea9c16d7e96c2fbda10d3c227","sha512":"7cf8401820a71c024881e839fb0a1f72049b82ca22423f6b0ffcae0239b7a0ec2f544c29a5ea4679d739ce7fce1ef0d12885a3f18688ebc3d98967ca9aa000cc","ssdeep":"","tlshash":"0d11cc2f5aa104197c4779ec0f2467530a95d5cf1414030774b5bcf893a5304a3b7214","first_seen":"2025-10-31T04:50:36.825709Z","last_seen":"2026-10-16T20:19:31.860644Z","times_seen":96,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mori.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.761Z","timestamp":1792181787761,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mori.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-a30\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qP2q6xWABm7BDIh20%2FKDVDtupzPUDR3eeke8VtfUwY9hIDR1sacLseHGYT8njZsDS52j4nmCBnEUx1nLe4%2FOlXYo0KaP00M%2FVHSUOhsAA%2BekwurY5mbDOikzskRiDus%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f11568d-OSL\r\ncontent-length: 2608\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2608,"size_decoded":3339,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"51cd1d70f32efec530ee7b233e833371","sha1":"6a421761ba953da7bbc40352b27c31d0fae9a487","sha256":"e41337aae65b1335650e93158f632a838ab25b5a47210d1e7cb43ba85a1fc1fa","sha512":"e7205a9608553e6bb43f331ce456e5593fad2a358be04061e8491c1eca77edfdbb315461862ee9fca2d9038a417d67976b0a8700065ae1b9383e30a4bece3548","ssdeep":"","tlshash":"16513cae1e528878d0d44e17c2c066b72881d533e804f9d334e7367b77c4b32a94c70a","first_seen":"2025-10-31T04:50:36.853391Z","last_seen":"2026-10-16T20:19:31.864036Z","times_seen":96,"resource_available":false,"data":null}},"time_used":496,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":496,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/snai.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.798Z","timestamp":1792181787798,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/snai.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:33 GMT\r\netag: \"68d0d3f5-23e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sG8XYknQgqePexA5GANiLt4ySG9ZkRnHqz6Hgm3dddq3%2BiZ5yILRu11qUmL9VuAFD3xxkaKaUoCKB1mmSyMes8ns38Sj%2BTjPSyjE8Nw2GO65pPpjh5tpIINwEqA1has%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdbf27568d-OSL\r\ncontent-length: 574\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":574,"size_decoded":1300,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e06b796b91efe1b0c8c7a6bc9b98d17a","sha1":"e64a69c8d79dc8dc2a48b4d820727bb62e803402","sha256":"9cdec18ac22f628cf1bf0a56a9594b93ee7f110c2fd58dd81ba44a824c86678c","sha512":"96002bcc32561b722fb4c892e2243298f9bc9318d5649403601ccd556b4f9dcde95114909d37b51d986b0dc7d918797bbebe85bc1bb059deca6dbe4158c9a4df","ssdeep":"","tlshash":"aef0415188fcd885da204e313159409ee46b2408ab88d16c181628844dff3537b60222","first_seen":"2025-10-31T04:50:36.753929Z","last_seen":"2026-10-16T20:19:31.867316Z","times_seen":96,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":470,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wet.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.964Z","timestamp":1792181787964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wet.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af322-80f\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jpeO96QFEgea7GRRHeI2OQ5cZtyfRdJx1Ws0IUP%2FiFOv1Aw3AbUJmJP%2BJjk%2Brm%2FZztc8L4p9OCNi5ziXPoTCkXtq8ORG65%2FQ8w5kRqfS91nLoicclafAWSqyXfrRM%2F0%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0d80b568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2063,"size_decoded":2506,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"cd4fd80487ee42f2b2306f90fbc67d56","sha1":"47cc04d0626587244cd5d08806b15ccbfa6bdafe","sha256":"9d5b2ac3d1897964d56c6b299dd5f96ebddc44aa4895c681ead78f18bec096fe","sha512":"2d769f503b5d72f7be2f8bd7333d2df730f9cb7b2974995ff25d9fbc820fb8b4c076e36c4185165cdf3acc4079a1f27378c675b4278dc44bcbf989ed04a5236a","ssdeep":"","tlshash":"f541d9921f995308df1229b816d057a4eb593e368ea6cf7d40825706ba69cf08d5c14e","first_seen":"2026-01-30T00:58:38.099158Z","last_seen":"2026-10-16T20:19:31.878911Z","times_seen":48,"resource_available":false,"data":null}},"time_used":434,"timings":{"blocked":272,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pump.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.661Z","timestamp":1792181787661,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pump.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:40:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c9308a-3497\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TZci99QPWrwBvVLdGE35JW97kq9riu%2BNrHPtSd9EFekccu5PwLk2Fnaa77bKVu5ZZZ7AnexO%2F4E19%2FJjgVsEYCy5UsFnJ5gMf%2Bg4OqquzUFL5amos%2FoUhTaMEG3cU68%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccdea1568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13463,"size_decoded":14269,"mime_type":"image/png","magic":"PNG image data, 700 x 701, 8-bit colormap, non-interlaced","md5":"e68fde5ff4ded2664bf71a6e3336e8d1","sha1":"111a98f1ef40ffb09ce69280ba1e318caefec307","sha256":"e73711710685d169e6ef7fa790a7c20820beaf283fadd69c5f62e6c03969fc40","sha512":"3b9287fb604eec089008d170d05e88ee5c748251f9949b7dfd1554ddb7f8e7bf9ea233e4197667b38b57451154c4ddefbe649501e566ce373c8e2c4d7d666164","ssdeep":"384:KjLuBTCSd4F+gmy5F7tarso1GpZA9SoS/lErGZnu:55fYxb6rdRAiSu","tlshash":"d152bfc0077fd4449a3b3f8913d8b7536e41a3df3a1620ae51e29d957c177176019e4e","first_seen":"2025-10-31T04:50:37.016495Z","last_seen":"2026-10-16T20:19:31.881254Z","times_seen":96,"resource_available":false,"data":null}},"time_used":630,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pippin.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.747Z","timestamp":1792181787747,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pippin.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:50 GMT\r\netag: \"68cb9586-300\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s4285kaCLxbRb7CIVjjS4IIEWlJ6BCwiTMtOOqsL4oCyZJxOyC%2BiZ3nuKp1HhxxP2uSkvc3fiZ%2BfFJIWT69Qp3bScILTPQ03UwEABoPXCg3H5FAScKzVpPfUPUcrl8o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f08568d-OSL\r\ncontent-length: 768\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":768,"size_decoded":1494,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"70b64d38d410f2018c03665656dae530","sha1":"dafef40d1f5eb288d93d89cb45bdf9fe6cb00f66","sha256":"e6bccafdb5c6789f3c86c9e676712ec6047504dba4e31c83ca83a7319bddbde5","sha512":"e9e84637c6333feed6424ccaea7aa615546276d96f415bd7af230c5215976bd17b2273a580d7d3f7b08a6f64ca1259686ce4d4d8f1d1c9df4db03d6f7759336b","ssdeep":"","tlshash":"fb01ba7394c8d1e46c01f5b0d097030c0c4b016c055150177ed934ceb38fa3c712456f","first_seen":"2025-10-31T04:50:36.977248Z","last_seen":"2026-10-16T20:19:31.88592Z","times_seen":96,"resource_available":false,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/neet.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.814Z","timestamp":1792181787814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/neet.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:48 GMT\r\netag: \"68d0d404-6a0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x2f7nveYq3Tnu%2BaLMUTLokWCpfflna1SiNmF4zdNw%2F8utZnG8SwN7FWaX4UesE5AtVUF3RxYZ81EauMFUStrEtuonSyaaG4v9V3aetGwnPpCS8y1jytdLq8kXrAH1NE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdce0f3e568d-OSL\r\ncontent-length: 1696\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1696,"size_decoded":2423,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"992c2e2c21353423ab236dfecb0ebfb5","sha1":"e444c8e23ef1e90d3c1c12af997cdb19c9e3217e","sha256":"05edce81251cf0c2642a9e1a33748fa83536d53ffa20db7924a1db62f4614d31","sha512":"668a7e8a04ff29bb833550614e47f59e09e6667ed80a800148e017bc632cf49dafbeedc122cbfefc5151ef49d10633e8d6dc9663416a3856099df7cacadf0892","ssdeep":"","tlshash":"a531fa009754b47dca2f1bb500a9d865195c92d1d6dcd5ef117f707d88b430dfa51a04","first_seen":"2025-10-31T04:50:37.013633Z","last_seen":"2026-10-16T20:19:31.888794Z","times_seen":96,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gun.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.954Z","timestamp":1792181787954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gun.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2640-599\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4O2zptdY%2FmAJH48G14aSZcQeK5cfFq1lC8VM5e7kK7SsB2KpV8E3bVVCGj6KkC3lnaQDTkRhPFv2O4nBQrPqvQG1mWT2qEvBR8aG6S88Wx0gGx%2BpFOq0jvFh9Cbxulo%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0bff4568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1433,"size_decoded":2234,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"81aa3aa51f52e6cee21535a8242d51d2","sha1":"4ee8b44f0dd346ddfd664ca780635e4ec2293bbe","sha256":"50e68afaa5caf85910a8d411ddc001d252c175f25497fe5718115701a34d89ee","sha512":"5ee6c0276e41542e4c396327a7901620839d54a1c7aa7f3cf09ef9b16b40e11c98585d5bda069829c01ce29cee820ee6d7ea56fd7d8d0a97ea62886a06062453","ssdeep":"","tlshash":"aa2108c038227e36c6612475da01ad2db9163a263027d2412ebf85227c8dbb796b61f0","first_seen":"2025-12-15T19:53:25.21971Z","last_seen":"2026-10-16T20:19:31.889858Z","times_seen":87,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":251,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/spsc.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.989Z","timestamp":1792181787989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/spsc.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af321-1039\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dfoQ4APveBylcTZOlgtYQSH5ml%2F8TRtGqcN14iMHGj7xDFQwqKrJLKvQUdcRLagaCL%2FCflBhfd6Lw%2FdJM84Z1Ccu2fYZkIr0ce2xG%2BkzypsC1Ns%2FjvBprZ1vi6QAfvg%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f820568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4153,"size_decoded":4700,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 200x200, components 3","md5":"bc55575598827aae34061a445697469b","sha1":"3fd9fdbc152959b79bda47ac31721744d4980b7b","sha256":"497b18cfbd8a38a26867722141802d09e15319604e97d3f72bb54253ad0b7cd9","sha512":"d927582c1ae57c769d0cfeb3130d57830f0140b1425363e4a6fa14d3e0bb37dd5ba63d6d80d803184deb400a7b510194025a060f8fa874ebb85dda4b50b0f77a","ssdeep":"96:IElbw+ik7CUpIdcMcGAklrl+ccGmH7PPfsofE230jXx:9wCLyd3rY59PfzFkjh","tlshash":"ca813b8d6368071ecec3993958a3ebcbc73b1b0c944c965f66416214af209f22cb7587","first_seen":"2026-01-30T00:58:38.080417Z","last_seen":"2026-10-16T20:19:31.892026Z","times_seen":48,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":286,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/psyopanime.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.995Z","timestamp":1792181787995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/psyopanime.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d93-70e\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hm5M%2FqtwnVA82rDBXGaouxlNPrK4C08sIstmvjJOdz6BdvpFq1ULywmVLHRL3HjJWpPXPtuyOdiufBc%2Ba%2B70W8VbekA3EvcRYtqdOPXFaP5rdUdXVbFt64fLGja9%2F2k%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1182b568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1806,"size_decoded":2534,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"83c445bcf02894682b263dc0532b7074","sha1":"33f5b0482545ca031b53f01faa581ba79a5343a5","sha256":"4c2af63121479e1ad931aa1443ffcab94aec2b4db34b154c6b217d80a7730967","sha512":"c7fe1d221880ac50d74aeea871fe9d71f636aca319ffb8ca971d666ff6f95adbb7b8bc751f394d0d503832ea90d20dc0e01069f64ee0b1c1769cc9cce09b85f8","ssdeep":"","tlshash":"2c312b9697948513da3f00f30db154b853021c9dd71347578e89e90f355f4a4ec441ee","first_seen":"2026-03-31T13:47:07.10204Z","last_seen":"2026-10-16T20:19:31.893567Z","times_seen":26,"resource_available":false,"data":null}},"time_used":791,"timings":{"blocked":304,"dns":0,"connect":0,"send":0,"wait":487,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/favicon.ico","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.638Z","timestamp":1792181787638,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tPFldGKrAXe9OETG1jGWIOnXuBLqMBFu6agS%2FTEwXAbpjBCNfjUTHDLz0AgxS49qbtQ%2F3iOl54IlKantLYOrQaFZ6THkoG%2Bt97%2F8U2RipnzJuOqqCbYxTuwFfy1WS%2Bc%3D\"}]}\r\nlast-modified: Sat, 03 Jan 2026 08:07:02 GMT\r\npriority: u=5,i\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\netag: W/\"6958ce26-634a\"\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccbe8f568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25418,"size_decoded":25181,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"0852ee59bec12689159c352345987cfb","sha1":"8349663b28875435a09ef425cd95d64d5bc21b1b","sha256":"536f8422beceeee32e1021494bc2119519fbc649688da9efbdcd06b9359536b4","sha512":"b38726e698ba80f7cf36ea3f415d68ba92388a1aca057226c1772289d73e12672d6f93084f6c423df4ecbe838d961ea7576bf297b9658a1b8b9e043a16fa0be5","ssdeep":"768:T1+YSPSYeL3kil54VS8WjTmCW7MwVSkGg:T1/SPSYeLJkWj6cwVSZg","tlshash":"48b2e17239b94e7b6118061906b32be42a239ab2b50fdb17554aec41723dfdad13c72c","first_seen":"2025-01-19T12:16:37.598644Z","last_seen":"2026-10-16T20:19:38.081551Z","times_seen":392,"resource_available":false,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":526,"receive":153,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/xbtc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.670Z","timestamp":1792181787670,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/xbtc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:33:37 GMT\r\netag: \"68c92ef1-5c8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VkNDZJx2c0p97j0XsyaCxNCsVTawoRz8SH%2BLUOoLir2AbxXEhfWepUDZD1PLTYmCtNabokLu2cZHAaHU8fidGD%2FrjeR%2F3GxKWtSEDdGxRfSm%2BosYAX6uO4YroTi7oQM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcceeb6568d-OSL\r\ncontent-length: 1480\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1480,"size_decoded":2211,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"360e43c81aed3690a061c333deefcd15","sha1":"aaf71170fd465c0a6c9b841f1c77c5fa3f61f876","sha256":"dc3d13068c19077ec26b81ac51abb61b8cc3eeb747e46782833e082b3fe62c6e","sha512":"a01e640094f8ae1ecc39a41d63efbd5d6ef11e60505266b0cab56bd2d806cb969969ec639c2811732a42b05fb7f4ee5ab44d166888c5f4af3d4a9cdebd28445c","ssdeep":"","tlshash":"4631e64b2315fe6ad1622dbfbf2277e4e01ac51a1509d2a74ba8c0819f84984cc177e2","first_seen":"2025-10-31T04:50:36.749722Z","last_seen":"2026-10-16T20:19:31.895754Z","times_seen":96,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/nobody.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.733Z","timestamp":1792181787733,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/nobody.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:52:00 GMT\r\netag: \"68cb8ff0-3a4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v9w5C2%2FYYT8%2B98%2Bu5jMXXXaGR74DMjaI7d8auIJ%2BzQMG%2BcPMyBir42uQDIuApNNy113w55cnfwYSEF2pWoVhrT6Ye6wtgDHAcIz9PAZa3YnCki%2FpWvGw009cc1uSkLA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ef7568d-OSL\r\ncontent-length: 932\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":932,"size_decoded":1666,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"50cf234ca25e823f1c35bd8259c9829b","sha1":"31ba9af4ec48a240720cdd3264d647ab2bf9deec","sha256":"0113257d43eb4964175378289a0bf014658fb1fba853ffea076ccbc1d261329c","sha512":"0cf4b1d1d2c00ed944c21c9353779ca3dc9f636cf1ffe9c931616fa6695aaebef5abfe1cb3a74eda062db05f0e3fdcd0c9fc353952a7a3599d36d4dc0f711325","ssdeep":"","tlshash":"de11fbc69a4f504ced535f187d09cff4240f19749ed24534c60ddd054a3a753442fd64","first_seen":"2025-10-31T04:50:36.725158Z","last_seen":"2026-10-16T20:19:31.897043Z","times_seen":96,"resource_available":false,"data":null}},"time_used":623,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":623,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/arc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.757Z","timestamp":1792181787757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/arc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:42 GMT\r\netag: \"68cb957e-160\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5OAtnxfnmVLqthfnMngDlNJOzS%2FxmdEXAmYP7S0CRk7mHJm3yf9QkhtnQXJJJjTgOla83tbRfX0SfYJnXwelVQPxQk82yJuFoPVXJBIpz0Y%2Bh%2FCuKFCBjQV%2FHRTGYg8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f0f568d-OSL\r\ncontent-length: 352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":352,"size_decoded":1082,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x89, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"886213ed584f3096f4116db9bd2c253b","sha1":"dae4b536768edd0568ef755a4c2eb33add4bad38","sha256":"cf989a0d0add7fc5f7b4dc42b6031de28d3554e699fd9d8f06123963660d3260","sha512":"c28a5920b940ca4d1a31d4d2b68721fb511a1539424072253f75fc340eaa8745a493a6ce1af1e0c4e270b4d739c2129e5082c6b47ecfd4d89da1ed4a71f77f4d","ssdeep":"","tlshash":"2fe0c0105b9de48cd09bd99d4100912944debc256a22f07ab89cdb8520ba212b660b63","first_seen":"2025-10-31T04:50:36.948185Z","last_seen":"2026-10-16T20:19:31.897942Z","times_seen":96,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":492,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/tokabu.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.825Z","timestamp":1792181787825,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/tokabu.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:35 GMT\r\netag: \"68d0d3f7-5fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iKpSQvxsQMc%2Fy2LqZAhP1iOMGdXHJ80TvMRmDnqeRaA28HDE%2F9yKH4hqpbpCAm6ptCIo6nOeEDMd3fvgvY1sPDp9Mf67n8oddifu6eB1rNB9Aw%2FessJeWEM63F2ohxM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcedf55568d-OSL\r\ncontent-length: 1534\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1534,"size_decoded":2263,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a676ef899d29975341f3d233a31b43bb","sha1":"d5da742227d24bf786b1c3d591968fb78752003b","sha256":"a1dedf0e7e6994d322734ba4b8e51800464bf1d7515ad4f282c29bae2bf1c572","sha512":"81a3f73d41754431a5d846b1f66e5c9ae710eb2974b9acd2b0510d3e78986c06809f81407885dbd82d9f3e82094a8c93f7e6f383547d82f788a56e041bfca0f3","ssdeep":"","tlshash":"cc31d8a157102759f70fa27898e10f21b7627ca6640616b6a00881660796ad9d87ef4b","first_seen":"2025-10-31T04:50:36.88379Z","last_seen":"2026-10-16T20:19:31.904256Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/habitat.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.832Z","timestamp":1792181787832,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/habitat.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:42 GMT\r\netag: \"68d0d3fe-328\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w4hmXtVTDSwy%2FzRps1%2FCZ0cDodao5kBAV2NGuNASrJ1RZgBqNcMrOGV%2FR9schSfBdp%2FdhS7FE3475lXLxIPrZA7iRrdVaer%2BzYjcuUWO7gbQGBWiWwJsI5RqfzvQAZs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef83568d-OSL\r\ncontent-length: 808\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":808,"size_decoded":1540,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bbb833633bf33b3bb4d730cbca80a314","sha1":"98113cd1cee3ce214dca3935d446c78a9e942a34","sha256":"ed4a2c9cbfdddc0990f0e0f2297d04133d903c4b918affb0218091f09277cf76","sha512":"2e9ec0b2f6df7f725d66fc2495fe5b23fdf4a77c238852e98d679ee28d0e85d842ee0c13bf393f60b60f075c94c41ea14365596dfa90a878da910689804c1ec3","ssdeep":"","tlshash":"a80186bc447c4115c408101074ea382bdcf599881672c27706e31ed6b21f76ba8f033b","first_seen":"2025-10-31T04:50:37.00936Z","last_seen":"2026-10-16T20:19:31.905328Z","times_seen":96,"resource_available":false,"data":null}},"time_used":612,"timings":{"blocked":133,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/sigma.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.836Z","timestamp":1792181787836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/sigma.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:32 GMT\r\netag: \"68d0d3f4-7ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YqIk4EiSJjPwwfbG3jqUOl0EyfFVGL5oSReWXv3uBIDl7abGOZhJLhpp48EgBtsLIGLGrovZuZtunSbnScU5YdNnBcti2b7RAzRfY%2B9maksk2xxW%2FT1QUwz%2BvRf5dRA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfff8a568d-OSL\r\ncontent-length: 1966\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1966,"size_decoded":2695,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"054a24ab785f14202d4ff1243e487604","sha1":"9188037de4daf78a32a247f9768a5d40adfd7474","sha256":"d799a93de585b73a936e5770560f699ad6e69ccb6872e21b74e1164dc3b3b1b7","sha512":"3ba2e28f56a1f2e5e492d12a5302ff076f4c54ba34b08c841949b3bf8ce2a82db08e512bf52bd164cc75165b57c1a6b7cd7275507431f6848c43e1fa15fbd3f1","ssdeep":"","tlshash":"e54108227d92e8c58dbb7f530789ab3b935440c380379ee11d8f2025d6100e8ab34a96","first_seen":"2025-10-31T04:50:36.962584Z","last_seen":"2026-10-16T20:19:31.906798Z","times_seen":96,"resource_available":false,"data":null}},"time_used":619,"timings":{"blocked":138,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/soon.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.857Z","timestamp":1792181787857,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/soon.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:34 GMT\r\netag: \"68d0d3f6-4ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y6A2Aa1hlXCkPSdVpbBm6EqjZhiYM%2FQgRT837PW9p3Fk8yqlO9JBtgOrQuioeMZ6ELCkpCXF0mqeKC5bhHhtA95KVUnicwUSQpiBTcIkIXpHcNux3jIQpI%2BJ0vqXMG4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02f9e568d-OSL\r\ncontent-length: 1260\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1260,"size_decoded":1987,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"88006edfe59ddc9697a4fb7882b2b547","sha1":"ac1fc49a0c1752bcd8dbaace476cb0d5c8e06a0f","sha256":"71d6c69accb539de223e3bbab09401de33194ee4284b65481940dbee23988d74","sha512":"44b5acc78e79e501e17c698c8116b29d1033a9536fe893711cdda7c55c5edbd90652c6c96edd01490dffd10288ebb8f1af913138c05f511fbbc8cfab0e1a9cc0","ssdeep":"","tlshash":"5121b7809e7f7b67e8b39566b18aad1091a6113db64f6250c8f0b87d12b9c11830c19c","first_seen":"2025-10-31T04:50:36.830931Z","last_seen":"2026-10-16T20:19:31.907863Z","times_seen":96,"resource_available":false,"data":null}},"time_used":639,"timings":{"blocked":169,"dns":0,"connect":0,"send":0,"wait":470,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/vsol.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.663Z","timestamp":1792181787663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/vsol.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:39:41 GMT\r\netag: \"68c9305d-73c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fLRzHuMKWQnK2QGzlb8ZOWm2WnD3gJaylDE8RcohJfOgTsGC3KG7wkYHkqcuOgrsDcX4ZaKYxh2SZzrf9pxcQm4UIVYTKbP1WIfWqNvjKnltBkCSq8RF1TZX%2BDGG1X4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccdea2568d-OSL\r\ncontent-length: 1852\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1852,"size_decoded":2577,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a3ad437c805d577e4a4e6022ad1cd938","sha1":"f39379004dcc3f28a1d7db9ac514d90e9dfe0083","sha256":"50fdb03c44ec1e0a288531bbcfaba8e6b8387b57bd006e2b5471356afe13ed38","sha512":"d569e2a9435e389b1d14761e3be0d490da6b543ae5f378dedef329630868f92d53409ef6ebdc7214f48238ece2e2a551ee52a302c7558f0b4ab2d8fd8451deac","ssdeep":"","tlshash":"8b31d7aa36914c7ae6ae76712539b7a2bf8da18260611855af4c2848cea3ec43e50341","first_seen":"2025-10-31T04:50:36.708945Z","last_seen":"2026-10-16T20:19:31.908918Z","times_seen":96,"resource_available":false,"data":null}},"time_used":519,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":519,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/stonks.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.862Z","timestamp":1792181787862,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/stonks.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:20 GMT\r\netag: \"68d0ef90-8d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ry6z8HGuI4wEn3NR1A%2FL83FoIgzdOu2vsUE2Dt4iacv7az4smEUwF%2BIwd%2FkcfUixPbDK2%2BVYEvmH%2FtAUreTMUlERPaF1fMamFdVpFp%2F4rEPvDJP%2FyW9%2FkCtguMdexSY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa6568d-OSL\r\ncontent-length: 2262\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2262,"size_decoded":3001,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f4f2fbe149f6a0fdd55b753b10baa226","sha1":"f048c10a7b98a8e5057453893b9c2a6506211763","sha256":"83c5125a0caaf46766f70834429b45cc727b330dcc102c0422df2581609a44b7","sha512":"148b1427683483a89cd1048ad574dd8be2b68fc387efb92b3fabc95e79c40c04d215080ed4aa11ba17afda38b40f664e69ad53ad7f2f5516552d1f151bb59feb","ssdeep":"","tlshash":"f4414bafe1ac3bcfc6846958fc75f00378315e37424a327981cb4384255b819a918f69","first_seen":"2025-10-31T04:50:36.7923Z","last_seen":"2026-10-16T20:19:31.910317Z","times_seen":96,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":172,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/hege.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.937Z","timestamp":1792181787937,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/hege.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:04 GMT\r\netag: \"68d0ef80-80a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZPBT1taeUxOeyD5Fd8KKeytXMwE5ePyfrNf4wyDWPDJlu5RK%2FmTxk8Iexr3as4jYXyGqxHpmTWTcjiIADrcHnN18GxGA64pwbpAPOoHF2hJm5wNjzAzGv3Cga1lf81w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fe3568d-OSL\r\ncontent-length: 2058\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2058,"size_decoded":2783,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b6612a0411ee3a0bb1bfbe8c638a7c23","sha1":"3ab5ba2f1f83c248af5e9f39974c2846da19f1c0","sha256":"eee308e98e8bee77677c4f662491b4f297731c51d9cb523a56d12ec0d52602ae","sha512":"717e1c55d6349dd00dc4fce9b23741bcd63ce3cb7136cbb1bb0628e1f68a699bdbaed3760ee06e3e2276ffee78d2d2a3a6e49849d38ea48a4b42e8b4300dd849","ssdeep":"","tlshash":"4e41f93767103490eb1ca1f995ef77e2a615be06839cda01778ded4e99828c082336f5","first_seen":"2025-10-31T04:50:36.681123Z","last_seen":"2026-10-16T20:19:31.914747Z","times_seen":96,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":234,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/monerochan.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.945Z","timestamp":1792181787945,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/monerochan.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2643-bad\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uuOcLWz%2Fd0vOd6GgHAgpZ9mqQ6VoGHtMHEoct2h%2FSPrWLUt2eRLmrNyEsHqkyoSqFWtmW461g7xdw9X0I6Cs3Qw3vLwCENCIXiNJogxvv6Tls2psxVoSjPOCtIA%2BeFc%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd09fe7568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2989,"size_decoded":3792,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"d7520ef343a05170c6eaf0d5b591220d","sha1":"2ed73f29cbdff6cde754e682096b37695cabcb2e","sha256":"51fe70b7b44ffa9fbc5f4c0e2507f9fbe27ce75a743c94232d3ee78b2b64e033","sha512":"d479564fe3cf0629c99b259c959f6340dc42a90785e02dd195d9185dbfd9b22d2e751b94461eed7421c6dd09045d8ad45b33c92239c984e17af017e99a6444fe","ssdeep":"","tlshash":"e1515ceab0b39d8cc73f1e89b71da6fc4bac59550591881db2404ca834d188edcdde48","first_seen":"2025-12-07T05:18:33.948407Z","last_seen":"2026-10-16T20:19:31.916075Z","times_seen":88,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":236,"dns":0,"connect":0,"send":0,"wait":234,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/zera.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.948Z","timestamp":1792181787948,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/zera.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:17 GMT\r\netag: \"692d2645-330\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hqj8XWMOOdNLYn%2Fs%2BFaQsVMaIjFVgvrGFSnjq%2Ba2rs%2Fi%2Bn8fjmdy5JLLeEQDsRSYrgIUrSYJKvttsPUFoP7nso16tmGCRzpqakbbaiDdU6Kg4KEoDmEFTtAaMDdnUtM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd0afec568d-OSL\r\ncontent-length: 816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":816,"size_decoded":1589,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"24967dafb8f4c81ed6af2f31abb43167","sha1":"253ae0783cdac31820d429661493cc4b002b9166","sha256":"dd13de447f206e54403e29c07265e1f138ec8fff4b2f17bbe59a4659ea15860d","sha512":"f8d23fbb5405ee3f220bd1c2d41d6c963bff893eb7371ec818582c03217b478493fcddcff3f5e598d3d8dee78a180f916b248b605d4892562826c4fb5f37e5eb","ssdeep":"","tlshash":"990186761388bb9f8552645218a5b4b0f93e4c0160301542eefa2abf39e710d8136560","first_seen":"2025-12-07T05:18:33.96531Z","last_seen":"2026-10-16T20:19:31.919889Z","times_seen":88,"resource_available":false,"data":null}},"time_used":715,"timings":{"blocked":240,"dns":0,"connect":0,"send":0,"wait":475,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$hachi.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.001Z","timestamp":1792181788001,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$hachi.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d90-a4e\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XtX8ieXlRbvvKHONXjDdLzHvpSodqG1Hc%2BhGl8%2FNU299Exidm%2B66n%2B3hpoj9yysDP%2BKX40p4w6ynmCjlP4GsAxP3jgmADr%2B2RzBXtZnXgtf6kPNTzAvq3txbUZD87nQ%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd12832568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2638,"size_decoded":3375,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"a011e11e8368bfaa195f01a82f21bcde","sha1":"beb8cbe73b0ef6c929615233e28984d26ed7eb92","sha256":"44e7db1bb94bfbe44e474d1c73a9fbc2d050f0b9d190d0e50990102a6e8c778c","sha512":"f3d4848f6e1a93d3c872d7543ef493be5a6822d3bc963959fa49219bb5945b1b4e2bbda55670ca59cf5bb4c1119a04a2fc08df21e3d8d1e0e989a3e0bac23ae2","ssdeep":"","tlshash":"1f511acf9e654293e11a44b2279dcd0cbac3882ca0bed654b7153960d70f0a12e979ec","first_seen":"2026-03-31T13:47:07.210768Z","last_seen":"2026-10-16T20:19:31.923927Z","times_seen":26,"resource_available":false,"data":null}},"time_used":484,"timings":{"blocked":314,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/lpvP0dFg.php?s=%2Fipfs%2F54O7aCmOpgNR7-M8EtDykQ244818187cf5b76b944331d1ffd7146d%3Ft%3D1792181788260","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.339Z","timestamp":1792181788339,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /lpvP0dFg.php?s=%2Fipfs%2F54O7aCmOpgNR7-M8EtDykQ244818187cf5b76b944331d1ffd7146d%3Ft%3D1792181788260 HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:29 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GfpZG%2FQy1fG%2B4eV11kMljwcaEFtunapiqvVkwiLb8djKDLcC2%2F%2FI1UDtWMqsjg%2BmGxHVsAWHkrLyDec7vE6%2FtrE4OA7a0tMUWe%2FXXjniWynz6oMoEQLKzClquYxC7ck%3D\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1483e568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":660525,"size_decoded":128781,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (40094)","md5":"ccfebefa9322e252d7a45d35c7d1c500","sha1":"425f774197c6dff7e8d9f197eff22e3d0ca84273","sha256":"b8035d655859a69ef5f762cc82af6a548af6fc6a989f246692417dd9229dbf82","sha512":"0bfacc4bfcda9f2d4a68c409f904d000df17aba2e3ac6db0a316eb32dc15c48655548136024ddb28cb9bbea131d672efe8e66a64a944d6100d4b84432972f40d","ssdeep":"6144:fh5gD73JOviMTj7+mTaMP+I2/+jzWUf3a7lisXh06XuinBNO/ktt3nxcDoB:ns73Yisu/ld0oB","tlshash":"36e4b2d4c709b67668ceb2af1d33423fff8ea908115b1c785fc29c91a35638a51e616c","first_seen":"2026-10-16T20:19:31.924874Z","last_seen":"2026-10-16T20:19:31.924874Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1794,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1493,"receive":301,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/maneki.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.705Z","timestamp":1792181787705,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/maneki.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a90-32c3\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xw34a5mmMuFVDqWbh%2BUQIXOeoQ008G6T21sMWpi%2FujfGaxjWWruxGR8ntoD2ZkQvNCsoyVQWoHdu6xkClQTEXP50vb467SsLzxSjn7Tll1TdBU23aQWt%2BjDR36xfPRw%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcd2ed5568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12995,"size_decoded":13614,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"0e883ff1b71d928e3debc4d54721ab51","sha1":"1758499fbd7ea5de15b9074480a64942acb25a4d","sha256":"4f35c51b476b921e86cca882b87f8c3f4531e5a01d244bc5dbcf2baf556ce840","sha512":"e2823433a97b6bf0f888b79db2a4618bdea8122438f346a5ae21a4cbdfd15d4ff206988cf2a94304ebf3f526b3a77bcf113336b3e58297c55a22ffefd4d06990","ssdeep":"384:PaZotO6r7EElUv50rUVpxvxDEthVfCxpXBQ8Yz9ZDB:WXSIElq50ixwthVfupuZ1","tlshash":"1e42b0015fbcb518ca9e237669510181c530cf1b96cb8db2bf65b04047f7a8e6debe85","first_seen":"2025-10-31T04:50:36.859028Z","last_seen":"2026-10-16T20:19:31.927434Z","times_seen":96,"resource_available":false,"data":null}},"time_used":612,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":612,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/spark.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.829Z","timestamp":1792181787829,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/spark.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:34 GMT\r\netag: \"68d0d3f6-984\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wg8Wdp%2FUqHQBsywQErMEURlnbIbOw0nR%2Fpr6iGGW5yVVY0Ansko5JKrkyripLJ1FFaCcktdi68OR9ktnLR2ocMQUSPP0JyP4odIKZNw5iu9b0t%2FHVVxa9PiiIsF4Yuw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef80568d-OSL\r\ncontent-length: 2436\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2436,"size_decoded":3165,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x84, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0b4637aa3d131ebd7a773d6b8064a27e","sha1":"e78284e79f06b18fea347bc1ec63caf65971debf","sha256":"72b4decc989d30f0b0121f2cef842a5ab18184de41615933bee867cb61b7d6a3","sha512":"d1b462f2472aae9296a836ed43b28f712b6e903df20359d62d7f312e68775c5deedd23bf91bb2cb9c2e95458700fa324c5fb7b809d51682ae9e4d75b31b4c499","ssdeep":"","tlshash":"71415bce5cdc41996020c4574a5ac670f03f7a22c782d96c10608dd8f3eb4a17f29af9","first_seen":"2025-10-31T04:50:36.836841Z","last_seen":"2026-10-16T20:19:31.928387Z","times_seen":96,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":129,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gork.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.833Z","timestamp":1792181787833,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gork.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:41 GMT\r\netag: \"68d0d3fd-596\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R%2BLYshWSwHOf923nWVsK8FtZCPe9zQrqoz%2B4KhHfw5C9wGUtqbwAQULfIU6YUa1jarUrupCT21ZpMCyPXXUlgeeTnQ9XDsN36morohPbMsn6JozhhxHDotCWp4%2FrOTc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef82568d-OSL\r\ncontent-length: 1430\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1430,"size_decoded":2159,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c76d5bd59cd926524ee5dc3f9a9ac24","sha1":"7c7ae35e266621cfe3f22513647f46f6936e00dd","sha256":"8cef1bf3625b09ff3ec7e45e21e88665424ca5be31f73913185eddffddae6b3f","sha512":"05fbfb16eaa61f2db730211d045605316638656162b0f3bf34125fba791d6606b292549966397760281fe0b5e1cdbe41c2b96351d3d5421676ec6f6f03503bde","ssdeep":"","tlshash":"5621986287897758e545677060c04f54d7a57f398beaa73f4540485a1f240818c1467a","first_seen":"2025-10-31T04:50:37.001313Z","last_seen":"2026-10-16T20:19:31.929783Z","times_seen":96,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":133,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wlfi.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.844Z","timestamp":1792181787844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wlfi.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:36 GMT\r\netag: \"68d0d3f8-56e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RV5p6Oz6ClGsRtjYSC70vV69%2FemLhbLOQHa0UZL6dBcdW%2BGF6BY0uTVFiZoKuRIHYcihIdC3XvPp3JofHLc3706Xjz8wzuoqZPmMvOdQoN2%2FZuuV%2FN43Dr%2BcdgpUdqo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f94568d-OSL\r\ncontent-length: 1390\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1390,"size_decoded":2123,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0c599110e07cce7a82b546ee3c40dac1","sha1":"bb2616be2186d422483b94d1d3d61c4250ed2050","sha256":"d61da012182060326ba3ed5c8274e0b0375f271be3e03abdd43c4029a1678bf3","sha512":"9694643d50026d4699f371978e43b74b31fbe4195e1696364a6e1de6e084b992c8fc43cb95dc5320d2bc13fb22a151e660ed8e0cdd4f8a595ee6bb704f840455","ssdeep":"","tlshash":"30210b9d443d8030dc3ac0042c9b01878e57ad23f6657712db773587c30403e5e1242e","first_seen":"2025-10-31T04:50:36.802584Z","last_seen":"2026-10-16T20:19:31.930589Z","times_seen":96,"resource_available":false,"data":null}},"time_used":644,"timings":{"blocked":154,"dns":0,"connect":0,"send":0,"wait":490,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/testicle.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.970Z","timestamp":1792181787970,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/testicle.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af321-848\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j2857N8BEeE5BuVILcOLT43p7DEGxt8t6h1D0p6sQtWGgeGjeXUO29yPtmDr24T2rmYKRaX%2BcKEyD8wnyTLl0oO1u75vxacC0Rcd%2F7uiBRx%2BzMUVzizh2dvBUeXcPnY%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f817568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2120,"size_decoded":2883,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"e250743b37ed158b96195ad30e9055e3","sha1":"0d3b7ebf555721631d3bb39e3284e20c870c95cf","sha256":"3422e69706a1e68851a0f71ef34bd4d7c16d815c8a87f424568862d9890bc5f1","sha512":"856721741a6330d227debf93f8bdf08dbc5542e5cce056a2d6e07d37c6e8d5be91ceff8fda1e0bd2d697111bf75969063b7771fc6a80c29732515d7bcc26d74f","ssdeep":"","tlshash":"194118576a4db090ebda0d38dd6b5b210e987a201c8bfa3b3450671489adc354e0a391","first_seen":"2026-01-30T00:58:38.196017Z","last_seen":"2026-10-16T20:19:31.931389Z","times_seen":48,"resource_available":false,"data":null}},"time_used":522,"timings":{"blocked":286,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jupsol.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.653Z","timestamp":1792181787653,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jupsol.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:44:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c93161-3e81\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nVzQKXV8N%2F%2FVYulq2Bodx3%2FySZVvJbvh0SGY1JVonnhdz9Mto%2BiW0crN6UX%2FGtGq%2FD0yS%2B29EMQiizvnb5XXFt%2F9rchZ9ANK9de%2F44%2BIpiOlZ3JJ00WnvPB2wzzqwvw%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccce9a568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16001,"size_decoded":16610,"mime_type":"image/png","magic":"PNG image data, 360 x 360, 8-bit colormap, non-interlaced","md5":"fddecb361b3a702ca8d67e5bcf2c131e","sha1":"fffb0129b548b83f4b69c39a706b0da09fbeef5c","sha256":"92469dca2b99aaa5ccfb7935db4e04ca42e2764361c17c15b41e8dd8ae902241","sha512":"3bc5cd172abdc4e2a10ad2caaadd26be333d73be0eb0cc422cdf37b3670bc2983c61396296296059f92904116fcd275e7d95c282b155d24fafbb048b90983ddb","ssdeep":"384:Cvac04X9fxg1AqtR7g+Z307mm5DEb4a3LZwbQ+LLtM+d4a6DgDGL4s:CvX9xXUu5v5DE8a3LZfMLtM884s","tlshash":"b572d08b0bd3f510317d1c2359a7845e4bce3d9ca8272a768607b7caae327ca8653615","first_seen":"2025-10-31T04:50:36.934872Z","last_seen":"2026-10-16T20:19:31.932702Z","times_seen":96,"resource_available":false,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jlp.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.681Z","timestamp":1792181787681,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jlp.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d92-d5d\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7ejfAZ7H0bDdYcQ9JCTgHyFpyKHwkv6QWsxIzqhLrha5ker3piUllOL5t3%2FrdYsSospM%2Bo28oljgHcaa0c2tTRZ4yF%2FnS%2B3Axq8Zd4itTBjoNPJMIxh84LjzyXQJFTk%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccfec4568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3421,"size_decoded":4226,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"9e14fb934ea0c5945d2b9b2cbaed8555","sha1":"4f77676f7871e129a51e2a02c5bd566ca045c601","sha256":"96eaead08f347fe768b4543956d422a7b72ed21088b6aaf89e614ecb77ea75a8","sha512":"1c378287fd54405e898809f93576b6fd27857f0a77eb6b35dd5e5fff8813b1cc615a49d02b1ac2a40df44cf599e7c0fe64cd6c33af6cfe4083894b65cad6dc69","ssdeep":"","tlshash":"03616de3bfc0a919f2c6173691f2141bf8d80ad112147a611b1e05e692e5d4ec0b30b9","first_seen":"2026-03-31T13:47:07.115311Z","last_seen":"2026-10-16T20:19:31.936906Z","times_seen":26,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/aura.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.710Z","timestamp":1792181787710,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/aura.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:28 GMT\r\netag: \"68ca7a8c-42a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7knRKSkHESvfF0%2Ftigfroixcc%2FqVClMzictW3c4Ix7ReZ7DIMHgIC5KPysxKAO%2FcYWwNzMjW2t15iAKT51wkeBvN5qxd%2FVKXalTeGYILJCN%2BwlM0Wv81Oc0umgrVSKw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd2ed9568d-OSL\r\ncontent-length: 1066\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1066,"size_decoded":1799,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0e5fde1bb4f55984486ae24c234e604","sha1":"89f3a40e5aecb9ab384527f8a197bbc4fd3a05be","sha256":"313edb581e7fa3934d193a580b33095bece1e8c6cab9a62f880a0523e29360ce","sha512":"d3c069481c3e17f6acb882ef857a27474e116d2d7b4cbb14373818b1b5b602b43c69f84ae159da62cd3b7c983340d9dff385dff8cce492c0bfc54a19c3c836a5","ssdeep":"","tlshash":"6711a8d2d670c8d5e42279345d77a72b6939108ac166dc979105c0134dc7c05ffbccb8","first_seen":"2025-10-31T04:50:36.758072Z","last_seen":"2026-10-16T20:19:31.937676Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jellyjelly.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.723Z","timestamp":1792181787723,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jellyjelly.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:40 GMT\r\netag: \"68cb8eec-1246\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sb2TAzxSe7v%2Bzu8PWfVxj6WIZhZrPjeA91QGvSOJ0pE2sqQzg%2BoShe5WeO%2BQdDfewNXgmV3TarV0BrztdAl%2Fr6sAb4V9JmUHHJ0MoUvTGGmuUhcR5BCnHmUn37WtjdM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3ee6568d-OSL\r\ncontent-length: 4678\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4678,"size_decoded":5410,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x209, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"69b7d09cb0b95b83fe294fbb9cf6cef8","sha1":"fb704e8ae24fdd2de9cc59be56a92cc54dd5baf8","sha256":"f15ffa38698db4a33fd7d40c27f799a01288529e4f2aa9db1adb1120bc3e6f61","sha512":"c8ec01dfb8d3e16ec5a61849255c33e0301006706825b9114faf2695a489304d1fa5bbb72de8ccc31a9826ad2f7e3e2eaa08a045b30debd740115d3496bc3746","ssdeep":"96:GfxtGpLGJ8tWGWjYDukWPsWBs/ajNfIj1vy6vDFUPi7VQkDz1I:G5t0iJCK9R5fIBvRbFUqxzDz1I","tlshash":"cfa18e192263026ff13f9636d2dd678e8b06ee458034f20d98b1b36b55168761682bcf","first_seen":"2025-10-31T04:50:36.664449Z","last_seen":"2026-10-16T20:19:31.938956Z","times_seen":96,"resource_available":false,"data":null}},"time_used":1332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":471,"receive":861,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$michi.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.737Z","timestamp":1792181787737,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$michi.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:41 GMT\r\netag: \"68cb957d-3a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zRMZXsBDankiwEcC7EjI4ZZ1Zgzbo%2BdGpn%2Bkus8hGlvUpzutGDe7VY%2FFVFnQcZCpXmnwAJSEorLPp3EtQDTFDYb1SjZKDBH7l%2B7gWJ7QvyBZsBmtBeA8jrpL05V7jXY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd5ef9568d-OSL\r\ncontent-length: 930\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":930,"size_decoded":1660,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"276be821e3c9d3e547b2c7f44eb22d78","sha1":"568e97675c67225c31163d73f8281c39adaff44e","sha256":"999788f2ed8ef804fec140075f6a4c055f4a8cc69ee8baf1c4c19da2e30a20a5","sha512":"b823fb541afa2fc2421b28cf67fba8082333feef0c34bb7f18500c5dd10c9782a854d0d0b8e45849508c7a5eeb34dfa519aab60fdf2020ae463bd38a5cc3026e","ssdeep":"","tlshash":"d011f753f5e314919ca4cc2728987fc671baee9082def1220597ac520bbd63c3291377","first_seen":"2025-10-31T04:50:37.007462Z","last_seen":"2026-10-16T20:19:31.939842Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/ufd.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.749Z","timestamp":1792181787749,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/ufd.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-5e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3qMd4W%2Fbqg9dnB6AZLVjoq4poG1voIEOkCT5Bmk6GUSIztxjUK46NRKxmEQH7Dt6YA0W89TcVl5cVXK%2B%2BneHA8b5kEra2HTkeZ6dc4f6sRY4sbrPMH4YKET183Pq4PA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f0a568d-OSL\r\ncontent-length: 1508\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1508,"size_decoded":2237,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42ccaa0797229532db809fc0e93da9d8","sha1":"bb60ee0d97e72951915f41be44e3fe40e7793951","sha256":"d7565a86ee13408d6e7a31c2be07c167f8180e3607da28871ea2fe939dc7ea74","sha512":"02cc9fdbd362e0bc70cce6c1dcfa812a8cacf46d08aa2e6ebf6852f882fc761fc948205f74721e14be400a02103b0780bd64c0cee9b5e70f2122f5e0ac8c39d7","ssdeep":"","tlshash":"fc319535b30623d8da022fbe31c91bdea6783c7a7248573b8f0052235b101e5945c69b","first_seen":"2025-10-31T04:50:36.76016Z","last_seen":"2026-10-16T20:19:31.940718Z","times_seen":96,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mplx.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.850Z","timestamp":1792181787850,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mplx.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:47 GMT\r\netag: \"68d0d403-4a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6cB5B8Wl2k5NxXOl8GGTiDJgMRFgjMEPXBY5vV6tN%2FF79XMiobvNT5TnnK7Bt7pBZx8IsgRsN8og4ags3BfogWnhaxMkvD7GpVVsM5AkIIxblcAupfiZfDYeRTyEGE0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd01f9a568d-OSL\r\ncontent-length: 1190\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1190,"size_decoded":1915,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3333e49d07e21f27998b4bd1da31125b","sha1":"74697f0fb65bf60c1d67c02997b5b5cb6003a91d","sha256":"3fdae9383252a4b204a8b7660690dae2684edba576c64ef4367d574e0b92c355","sha512":"57ad71395d9df15081cde6da7ee159f2be021fd2d4eee26bbe7bf2dfc5d24c1829b397f3d526fd66a58495f428df83288418cf2ac0b0083c9f4063c7a0ca6c21","ssdeep":"","tlshash":"0821b71f0869f335fc280416c4c1b5990b97119a54a7835112d1f9bf88cebe0933fd8d","first_seen":"2025-10-31T04:50:36.813944Z","last_seen":"2026-10-16T20:19:31.942504Z","times_seen":96,"resource_available":false,"data":null}},"time_used":687,"timings":{"blocked":160,"dns":0,"connect":0,"send":0,"wait":527,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/cloud.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.920Z","timestamp":1792181787920,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/cloud.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:28 GMT\r\netag: \"68d0ef98-732\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dz%2BVsEFEKWRJGqm%2BrzJeK70%2Frzv39vj83cR3uS66uQZ%2FXcCl2IPu0cHh9gnkGK7zvG6OkVHYgKf9pKkNyRiqtXWTtRenWpoFSry13neegZj7hPKqALQl48mijZtSmZI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fd0568d-OSL\r\ncontent-length: 1842\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1842,"size_decoded":2573,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"774e1c3252064bc07f6a13b3b3058ce9","sha1":"87a70896a048a1d14cdf5dc4fb3238e406a60f8b","sha256":"e9d76639c3bd2994bb2ed09b9657efc00a9ca707f164b8d6a35e36d0b24c3f93","sha512":"77ab50ab797c2ae14d9bd69cdc30a48d87ca08c68119ec347f080b4628ccfcd0ef4c2ef5b07fc72b1dce20261a93e8cb8dda843cf0675723a8fde131ae82e245","ssdeep":"","tlshash":"ae3119be1184ca716cc2b93d7cc54a660b071b057dac890373aa33d49d0b2d4a83df06","first_seen":"2025-10-31T04:50:36.916747Z","last_seen":"2026-10-16T20:19:31.943457Z","times_seen":96,"resource_available":false,"data":null}},"time_used":387,"timings":{"blocked":215,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jup.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.651Z","timestamp":1792181787651,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jup.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:44:24 GMT\r\netag: \"68c93178-7ee\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3GH4z%2BEvpA%2FlJiba4tbuULMzYJ5d1FqIsSZ1H62FnpnXYQ6RblYvnH0TA5DrxY0VD6qBJYqPYdUNx2dRBSkf0iKAmbXTyR0%2B67FPd5%2Bw0WLfnborPwF2jr2LkseY%2FpQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccce98568d-OSL\r\ncontent-length: 2030\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2030,"size_decoded":2763,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"361e9dc3e4608f1b01f718d9e10bb756","sha1":"8392084fb56fb3d2a622a458a63d8b900b381a14","sha256":"33cc093532470e1cc1b61f14357789eab408147cbf01431784688ebff3ed74e5","sha512":"0c70628f3b92d17f4a4d76456826983ec700c84349a02a8a8da56df3ea6c2cd4e3ebeea0b987fe7aa902c10e519b4cdc0dfef1418e944b52f1f5cc1ab2604131","ssdeep":"","tlshash":"5041b6493bc25bc1c02964fc19adb70ff54db7a1a01697a8967d01219cb15158ee4784","first_seen":"2025-05-07T12:19:22.463101Z","last_seen":"2026-10-16T20:19:31.945615Z","times_seen":113,"resource_available":false,"data":null}},"time_used":516,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":516,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/slim.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.788Z","timestamp":1792181787788,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/slim.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:33 GMT\r\netag: \"68d0d3f5-810\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8YDWSye95hQa%2BqPRmuAaUvqVFGQp8qNZi8w%2Bq9d7lo0QXZKUXi1SEtJfDjLZcm7UT7eAlHysFu6zFXPmRyuPW41n0CdbjdWzZJo716eHSX6Hbb5pwlEp%2FVruOP6cjTc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdaf22568d-OSL\r\ncontent-length: 2064\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2064,"size_decoded":2793,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a29018d05b5cee800553ed788ea334fe","sha1":"fba8ed888939e7fa59f4da4592905ad897799c1b","sha256":"6d40dd40644687f109cc8cf548b75b538e2a8b5a4a3c5c4319bfe37467410301","sha512":"8556f7f70a7d0ae7c2a859026a7d3a65c56ea874ba7476676cc646d46aa74b6a5e5468eb03bb928102fa1ff45d47e44bf0bbff06faa45ebdf091647e9d44ac04","ssdeep":"","tlshash":"71411ac6a898cc2ae9a0fc7480f139f1009f7054fd619e31484f29966c6eed0a5a9871","first_seen":"2025-10-31T04:50:36.751966Z","last_seen":"2026-10-16T20:19:31.946472Z","times_seen":96,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/spx.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.889Z","timestamp":1792181787889,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/spx.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:19 GMT\r\netag: \"68d0ef8f-77a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lzipZ2xRZf7tps5ndwtMjIrgJHo8TQfRoSlYpekNsLtIgfT%2FH%2BJR5VPIYGBcLOHcSRfuSP1TSxdy6UiPSrBWxVDC0mYiGz2xahNrL7zxMc6WUcCED%2B%2BvvWpTWGZ1ClU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd04fb2568d-OSL\r\ncontent-length: 1914\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1914,"size_decoded":2645,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2864e037db297bf245236475fa5868a9","sha1":"57ffd3d74cbd2313c04541c5088d976b63c8ee72","sha256":"9addad58453fc3868216b604db7ba4de7a02de6fb5cab3d73a9a56968dc4b448","sha512":"d1f1aff81965e6a6105b90f7a63a0e0905e1f4045235a8c957d6f887e9dcc4119c4d521537e4605636ff09c234c00168910ffee31c5235fe703adf6b0d13fbb3","ssdeep":"","tlshash":"b7411b714f70f385c99c1a2e37a02f1202416dc936145317c1b00572a7a3a88d19bd7c","first_seen":"2025-10-31T04:50:37.004766Z","last_seen":"2026-10-16T20:19:31.947816Z","times_seen":96,"resource_available":false,"data":null}},"time_used":653,"timings":{"blocked":181,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/sns.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.924Z","timestamp":1792181787924,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/sns.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:18 GMT\r\netag: \"68d0ef8e-682\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XUWwcKFHa%2BC4MagYSQa%2Fobe%2F7CmtojJmb%2FJnR3GxznamSZXUDD6XPh4zHw7cwAA7qk2BGk5mrqKsnCcoZH8KeShld0GqlCfWaeGtxGoPU00LRKZ7dztLhNxwkGJy63w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fd4568d-OSL\r\ncontent-length: 1666\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1666,"size_decoded":2397,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8714974fbe6540ee78b05fac3416059c","sha1":"ea762c4d0cdccaf028248c27bf610d5225b819d2","sha256":"3751cd41448f0ab6622ebb6e58bd0764e66ac38621407723d1a93a0294847ecd","sha512":"4aeed8af555f6053ebbf352821b5988bd2c1f2dfa8d1ec5c17ad3819e0f673cfa13e60798148cd377879a012176d30e5f60bec6baf3e80e9d573a2190a3a54c5","ssdeep":"","tlshash":"7a315cac2c8efc4afafe50c889317d8a16ae4c7d68420133a1877201caacce55d6042a","first_seen":"2025-10-31T04:50:36.747307Z","last_seen":"2026-10-16T20:19:31.948712Z","times_seen":96,"resource_available":false,"data":null}},"time_used":382,"timings":{"blocked":218,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/67.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.942Z","timestamp":1792181787942,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/67.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263b-656\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fiZzV%2FLAyHJoxGQr%2FykQnr7wyt5foYXz97ho%2BfJf0IbMhpwafvR3od3VvtTrjU1GVsYDvmdgT%2BlgXOBcLBwC%2FHYqFdbVAGgP3%2FopUp%2BgDiqcA0hMG4zb140RSWgfkLw%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd09fe5568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1622,"size_decoded":2362,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x51, components 3","md5":"bc0442038c0bf9decda992903fd60b1c","sha1":"189a3657d68eab5927aa9deb906a888a9cee248b","sha256":"d4b6cb7a9ba879c1fc8689bad8b1f602d07ac500758733e514a82395c674f53e","sha512":"6d050271ea878f4303efcd1b7ec89ea376fe3bf747130e08b268368ecffbc6bffa1b76f138355cf90560f5278b65765e1a673c53cf2248c788c51d7b5f3a6293","ssdeep":"","tlshash":"8531e77be93c5c1bed2e05b193d0ec2193a31f54ca88cbebf748ca2e22157d61c00228","first_seen":"2025-12-07T05:18:33.825072Z","last_seen":"2026-10-16T20:19:31.951227Z","times_seen":88,"resource_available":false,"data":null}},"time_used":766,"timings":{"blocked":235,"dns":0,"connect":0,"send":0,"wait":531,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/aaplx.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.009Z","timestamp":1792181788009,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/aaplx.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 19 Aug 2026 09:03:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a85714f-57c\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X%2FFb1DISqhxkF90BCQ%2BiyBh068zdKI1P%2FbpdEsNseRZ98MZDqTXE%2FSpnZ51H6DIhcvql4s2js1kOBpvPM6yNK5bY%2Fux%2BFMtqPMLrhK6WhqSNHejGOsk8Q9F5sS8TTU0%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1383b568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1404,"size_decoded":2169,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 4-bit colormap, non-interlaced","md5":"3a56170f17cae1c2b55e124f74780d60","sha1":"a632fcc18c3b933fbc3084ca2ee49c838de03c5e","sha256":"e6b4d8531426fbdf14dba3b94147856705289f69eafa8d3505a605cedd70000f","sha512":"2c5fa5843eefbefbad45a070f8182da809e750d06577e75299595296a872d01b5e23e7233921ad6f245dc19f60b4067ea438e76e72b8553040cfedc59677468a","ssdeep":"","tlshash":"6e21b6df5b45bcfb7013f61f41266110b6aa540d86d4901f972e08a44c2e845c63e45a","first_seen":"2026-09-19T08:07:19.645404Z","last_seen":"2026-10-16T20:19:31.953582Z","times_seen":5,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":324,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/like.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.011Z","timestamp":1792181788011,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/like.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 19 Aug 2026 09:03:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a857150-117f\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Aw0sWmGBBX5csAjdEd5s3QTAvTgeuvI4TjcC1gqdLZ8r0Xmbq%2FTrRzbbzunMyL7AEsI4JRzaiVAwKR95O890wnBCyPLRd417BF4xm4e9udGi8WjggJEZkDWjPLXjAx4%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1383c568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4479,"size_decoded":5279,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"785455c84389d64f5a55cce86da7d11b","sha1":"a7b7fadd1be266608106aaf81692314d550f65b1","sha256":"eaeb4fc29c4459f8d160b83e60bff97c2f9a525c4b7dac76a8df3f58408009eb","sha512":"ac8b38f65c6b378bd7f9556159e6d408567d1119c72ac07d8babb059477661299a6dbcc073892f320ca48901c13b71ae60b5935a4742fe93ed8481b9439fd1fd","ssdeep":"96:CaNQw453Xt88TmS+l2TxydhkvK74Zsc6D9XngIi1i:CaNb4v88TzQ7kvq4Z+lgIv","tlshash":"08918ec7038b6aa101017077c0f5814aa65f0a933d6068a63a9c918df7cdde7d52ed6e","first_seen":"2026-09-19T08:07:19.888655Z","last_seen":"2026-10-16T20:19:31.954841Z","times_seen":5,"resource_available":false,"data":null}},"time_used":789,"timings":{"blocked":325,"dns":0,"connect":0,"send":0,"wait":464,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fartcoin.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.693Z","timestamp":1792181787693,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fartcoin.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a8d-ff4\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VG32Cp%2F1%2FTiaanrKzFpTxvVapOnuVJkjFYoLQctxTflkZpk%2BTPBJ9NkgyTqTgJl%2B2dGChiY24tWjFUXe%2Fh%2Bx%2F6kvzWur57WHJXKNJGeYSvPr4r200DVtYbtvp3DoFNo%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcd0ecd568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4084,"size_decoded":4723,"mime_type":"image/png","magic":"PNG image data, 868 x 245, 8-bit colormap, non-interlaced","md5":"7d04f03fca023aff1dcc6bd02d391c17","sha1":"e5beb1e748fb24fe625987be9037dc5d79158030","sha256":"a050e7f7dc3428fb27367f316eed4699fbce70715f5114ccde411da582d079ca","sha512":"1e4e317c5f2f1103674f8429e0775e0ce8604bfc6930e209571f44bdc241b4a468fcd513955ae7e7b342b018e482f08a432776b8ae0635d6f9a7f4a5e9ca865a","ssdeep":"","tlshash":"4d817ff0d5f4d051cc038a3408378fbf59526c3954d929fe8650a7df5993e11a942f93","first_seen":"2025-10-31T04:50:36.824141Z","last_seen":"2026-10-16T20:19:31.958799Z","times_seen":96,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/billy.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.837Z","timestamp":1792181787837,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/billy.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:39 GMT\r\netag: \"68d0d3fb-53e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gIg53mxIxN0A8V9Gjn%2FyVMumPdtfeqk8eZW5yRbNyszWE5CYAb%2F4QSCQS1Pltlkor6YzXAScwgeFYGMwOx2egj20452OO9aFAwonid%2BT9S3k2HWCofZTL%2FvwMWNLibs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfff8c568d-OSL\r\ncontent-length: 1342\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1342,"size_decoded":2073,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x74, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5bf1a0e57ed95d4599e3566f6aaeda84","sha1":"6ecf63dffd7fc57197b6dd5d6d821e8ecfd388c2","sha256":"f649e00d08dfcd4be682405bd0ddb28b822d75351aac3d66c3d4ad62f48e56a7","sha512":"1f9cd40c71724928128c9269e3f3823c6bf9fc26e74420867ed18004e9ce7169c938db24fa37d116fb8a30ac620f1f481451352c37c37c5c2a946204bbf886f9","ssdeep":"","tlshash":"31212bc3e91d873fc76e9ced00e43471a5d246e892a8435848ed8ec8631c0a6e1a1bc7","first_seen":"2025-10-31T04:50:36.808579Z","last_seen":"2026-10-16T20:19:31.959671Z","times_seen":96,"resource_available":false,"data":null}},"time_used":619,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":475,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mumu.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.841Z","timestamp":1792181787841,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mumu.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:48 GMT\r\netag: \"68d0d404-5b8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B1rvDb%2FR8gElLL0LK251THFuMROZy5VYUYXNIJbkpm6N64jNOvK%2B7Fed%2BmaqZAdKc2dbGfQV2hR7pwuHDjMvgXYM7jLpyhJPKu%2BZMV4%2Bh1Ywm6Tk9U0%2F7P%2FwfXT8SE0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f90568d-OSL\r\ncontent-length: 1464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1464,"size_decoded":2201,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a65b266d57b497052b76e0e4198c1c5a","sha1":"ab644ff17b3e2637fec74e78ad24c41a59a19508","sha256":"6ccf85b4c76d65e6f7206dbae03abe3ed470c650b90365990c4166118d132ba4","sha512":"fafac2586586f4075fec45040ee1822f1a482c84c9efe76faf580716ab4273fdcf608c6fb370dbcc9614951d76acc49941fc0af576454225e9ff20b5d48c7e11","ssdeep":"","tlshash":"59313b28ef6909e92d3ae915dfedb182e58500481371074c81730efa8105cea62c6f93","first_seen":"2025-10-31T04:50:36.96392Z","last_seen":"2026-10-16T20:19:31.96023Z","times_seen":96,"resource_available":false,"data":null}},"time_used":623,"timings":{"blocked":150,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/saros.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.847Z","timestamp":1792181787847,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/saros.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:52 GMT\r\netag: \"68d0d408-900\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G%2FjUahbjvnv8bNHQNfg6hY5AAgScmf2GyWfWHHrUVSIsBBIQeGShHUE0RrYsvBndIiyQUEAoCHOgpa7r8vNP5l3r1feXjSJ%2F3Ms%2BWGtJhIMQ6VcSD844xbeibMVnFI0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd01f97568d-OSL\r\ncontent-length: 2304\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2304,"size_decoded":3033,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cbfff9c0a3b39e7be46ddfdb279dde0a","sha1":"bbf263f9025a3c4a25a993d85df178bc9fc78289","sha256":"cc542a218eeb8883c2a01bdcb663954a80abf34b5b2b5d7d8219ac84fc3003b2","sha512":"4e15274c6d4a1b1715f23d8ec3bb5a3ff464ff1c895c4f85fea5204a8ae0adf273274d143daf7fd95e9174abfc3ff5d8b85aba6abd2f612cd7696f50a63334a6","ssdeep":"","tlshash":"b0412b0e644c37acf0964caddf2e41636efd95b204d8d2a1a48dc8829e894ccd067e7c","first_seen":"2025-10-31T04:50:36.790405Z","last_seen":"2026-10-16T20:19:31.966349Z","times_seen":96,"resource_available":false,"data":null}},"time_used":631,"timings":{"blocked":159,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/cudis.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.882Z","timestamp":1792181787882,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/cudis.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:28 GMT\r\netag: \"68d0ef98-4cc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VVNg5r04g3mkwTcQLElK7oUQkEBrEbqMk30LqX%2B3iAJ%2BKK3KpMwm5iA2Kaq0JjIt6onJNcQP5sHKQHH43pItUEVHd%2BIyij0zEm5AJWZSkY69UBo%2FLySWUDnrLdR5WIY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03faf568d-OSL\r\ncontent-length: 1228\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1228,"size_decoded":1959,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cc2c7519f969353a6575c9030c3378c8","sha1":"35c1703a8ddf204feb3ade6dafb025ef17482621","sha256":"b14cb07d6868ee72a36e62edca34df685c61e2d4e1d41778809fd10a273787a5","sha512":"4dec32f1a7c43384e3dcd9152fcafed78aa06f3c6ba1091b1fc0d46469a63b807e703d0d18674be799ae190ca35512c4991c60e9faa4d4f55b1d6c9ada3f3e0d","ssdeep":"","tlshash":"e621b796ea80c0edc552171d56b48e30b60aa4887f1999a971b103f3384783ae8c2294","first_seen":"2025-10-31T04:50:36.944031Z","last_seen":"2026-10-16T20:19:31.967194Z","times_seen":96,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":175,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/tnsr.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.952Z","timestamp":1792181787952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/tnsr.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:16 GMT\r\netag: \"692d2644-15e\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W2FnZSlWfNmDlzyqA5CqI%2BR8fpyk4EvYcXwDWbio02GE5EoVb6nKyU%2FjMUKm8rh%2Fg39iU7rMwExwsgfxwpqq8HrJNx4u0F7nlHHV4gSHXltP1GocdecDv5dA44t14%2Bs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd0bff3568d-OSL\r\ncontent-length: 350\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":350,"size_decoded":1121,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"41daa1caf9ce620e589050865c3bcf02","sha1":"48479127bd71fcdd2283734231217cd6510c3d53","sha256":"bfe68d9244419c6c3cbb720e42ae91f01a7b3a3d1a40d586ee67dcf2daeefb6e","sha512":"9c905cfb351a2c5bfbde73a97d7ddded2e6c5e85aef1992847a2530224e0ae1914f2535067cab8e2a0f5240f5845137e2e09f7a278939a591fca4c3c3810e8a3","ssdeep":"","tlshash":"0fe0c09353195c2ed97724073905f0503ee275aa106c200158835f9d7cc7c020fa1983","first_seen":"2025-12-07T05:18:34.133906Z","last_seen":"2026-10-16T20:19:31.968004Z","times_seen":88,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":251,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/clawd.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.976Z","timestamp":1792181787976,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/clawd.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31e-658\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XC5RvBAdOGIPJ7cgiBAcRgjj7BHOc%2FIWhfZp4a%2BQ7ZOPBhGVm08f3UodQe0wXg7EN2V%2B%2FINQnQVIJhceosNoKJ80BB5%2BjjMRf1x0ec4ykIbFbL4VPZETSKy%2BHJnfW6M%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81c568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1624,"size_decoded":2361,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"349cf153b2bc032112385fad1e22e0a1","sha1":"58ec84f783c34148a9d43f36f10967139e521a0d","sha256":"d58b48e0b834fd574c783897f1c2c2f69b98a3f01a199669cccb8c390dd24a6a","sha512":"fb8f62132e359ce172f757f2fbc95c92b90d2e7bb988998aa5a9b24af5e8a567429ad7e3ce71422a838a04f76af7174032c2fe82ff1a883da37c16014b9c3507","ssdeep":"","tlshash":"8e31ba9b0e0a3cd3f88b03b44919c53221929986cd8986162637ff19f8b8ad45c4b764","first_seen":"2026-01-30T00:58:38.211395Z","last_seen":"2026-10-16T20:19:31.969532Z","times_seen":48,"resource_available":false,"data":null}},"time_used":773,"timings":{"blocked":285,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bp.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.997Z","timestamp":1792181787997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bp.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d92-5dd\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CmBHC5HHTAG9Uz2M3Nr1Ny0sPGFCRXSvN2PZsYKSlaMbreo9QxUVY4SrMGhCXQvBdeDbW%2Bzyfsbq34hbt1O94X2PVgDxAOSq1%2BWRSSCcO%2BFTls2ZnFD3V%2FtpexB5Vug%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd1282e568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1501,"size_decoded":2239,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"7bee23e3da25bbaf49504a7d9cbdcc55","sha1":"d3156d33ec9eebdfad990ef034eaf490daaba734","sha256":"7214409bab733ea6ef9dbe96d8ad3d4317c984f882db5a3a387a46a7ddde320f","sha512":"50cf5af331fbc59d1e59e5ef728315515c72456d8a8edeeadd183efa6de7d2b85a37ac706983acd038414964859b8867774ecc24087e5ebfad7f80b67a5f1691","ssdeep":"","tlshash":"2d31a7bbd3210917f9350f393998c238735ad8128a85978a3b95ae4dbc786c459c0ff4","first_seen":"2026-03-31T13:47:07.070977Z","last_seen":"2026-10-16T20:19:31.971412Z","times_seen":26,"resource_available":false,"data":null}},"time_used":781,"timings":{"blocked":308,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$wif.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.674Z","timestamp":1792181787674,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$wif.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:27 GMT\r\netag: \"68c92ccb-36c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MTGnmmxg1Q0rNyCSka5wNR9Eki6f%2FkOb3hTCAMwpsM4%2F%2BNxdBCItfOueIbU2c4at7%2By4d1DeqmgQjD11isx83u7DYLiNZHEaU4ZnZ7ErI%2FNuaZmhpmK9k2uZlYhe3Bg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccfebf568d-OSL\r\ncontent-length: 876\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":876,"size_decoded":1608,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c86230f0512d3e53b5dbc1245a3ef16","sha1":"e4e61b26d81fd699398bfa0fda436218b75a4dfd","sha256":"f9efe564a567c71623be1aacd5d34bb8d25d4db665be35e2c465d23657c28759","sha512":"f146fb3d92e4bff8a64c53905f05873f880d9bb8e106035f8751e20a23d85153f832d08e5645407dd65f4a11d749cea950c3786d7d9b6e2a1bc9a719c6423d7e","ssdeep":"","tlshash":"771152a33bae4754c0d5a73b205a374148e0f89cbb17cf4b213c2869cda09b16e61144","first_seen":"2025-10-31T04:50:36.947321Z","last_seen":"2026-10-16T20:19:31.972237Z","times_seen":96,"resource_available":false,"data":null}},"time_used":495,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":495,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/kori.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.790Z","timestamp":1792181787790,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/kori.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:43 GMT\r\netag: \"68d0d3ff-7d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gnty5V4QChCWSxrYBoIp7TFhlSLoIqukdMWGAqgnUgkWc0JbFYFofW7a%2Fx5l9B135udyytf%2FSZ4yvbjr5cQYa8mY6V2wwQSFkh%2FGllORGcv5cL8HPN%2FbA8S9JAlj%2Flc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdaf23568d-OSL\r\ncontent-length: 2006\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2006,"size_decoded":2739,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8a3c366d36806dae646b72414832b6d5","sha1":"5e9d97533f99ccf7fe374c850831422c992d5ca0","sha256":"60ceb93a5f385fb5f6dedd334eb4ef9d5d2b3d564c3793545bc106fb19dccc5e","sha512":"55fe3e8f3e4fab0fd29ccfbced10f95455ddb8691c4fa0a5fce31e81b359cc99b08c6ed4fe5fdc6067a10e1e4d12f284525662db79b93f7ea2b615db0345e52c","ssdeep":"","tlshash":"e5412c1ce2e8c2a987573c4ed1640632752beadfac34eb6b0895cf325cc0f461a01d55","first_seen":"2025-10-31T04:50:37.003894Z","last_seen":"2026-10-16T20:19:31.973924Z","times_seen":96,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":469,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/main.php?type=js","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.802Z","timestamp":1792181787802,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /main.php?type=js HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:27 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PJZuYfI6WviV6P2qjzYV2ArAgKrmQCep%2FEeehYs%2BLlWFLKeTJr%2BYKS%2BExa9W9z3ehMGkzIoXIGeciaf4oo84RQ6jmLjLfp08Pe%2F7GmA8y%2BrQuZ8sF6tpuu%2BlkIHmz5w%3D\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcdbf2a568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10326,"size_decoded":4028,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"04186bd256983d663a85a3423a5be79b","sha1":"1e54da67738bb1c65dcf7954b5e12d64248ac246","sha256":"c8880c1b1618dd3bfdad83188111e6690e0ff168cae6f74443ab14bd33845553","sha512":"46a1813454cbf9f034e74fe4b9aae1f926d88eb6e3349cc9b9ad261a4c43578b12212c7c2964c1a1693d2b59b3afee70ea08509e7f7035fc067611542b4341c7","ssdeep":"192:SPuyS6EvZNlFielilPwQ70GrlM3ovyE0ZEzW1tOhandDJnmn98ApTqt7gTSoYpKZ:VIUfl3BQLlZaE0ZEykmiSpXdpt6","tlshash":"6222719cb4b6217086f362baa7dba715373520077084c9483fadc1c41fc1aa166a7be9","first_seen":"2026-01-22T04:04:03.775952Z","last_seen":"2026-10-16T20:19:31.974941Z","times_seen":46,"resource_available":true,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wojak.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.963Z","timestamp":1792181787963,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wojak.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2645-8f8\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3I2mFiVpTQCS8PXUfKGITHclyT0ON7300s3Jocez4l%2FmwzLKgLtnslRxX9Fo1lNU4XqZYUwmsN5HmGcj7WXusTBd2klmMBsTGeMgDqYIZJSN%2BJbzfAuIszSP%2FEzLKms%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0d807568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2296,"size_decoded":2684,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"a74e924ab910f4f1f2c74fba53d44852","sha1":"6d26f8e85a026a281135d4f6a16440cfa52826fd","sha256":"a2b7329788ba44f73a8b02e2c95f36dd7c9adfdb0cc9227e3a8d67dcc1e2a7a0","sha512":"0d57683aee2657165fd10580f84b126912bf163a42c05cf11743e2f9d71b17069cc5ddbc8eab047778d275a4e9e457da77f0ce8c06125b4d0671009ef2a3f005","ssdeep":"","tlshash":"ae41f8f327981a0ad9061b7028d04732f334bf105349930eabc98158b6ae4d09858f8f","first_seen":"2025-12-15T19:53:24.955261Z","last_seen":"2026-10-16T20:19:31.97562Z","times_seen":87,"resource_available":false,"data":null}},"time_used":735,"timings":{"blocked":271,"dns":0,"connect":0,"send":0,"wait":464,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/birb.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.005Z","timestamp":1792181788005,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/birb.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:29 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d91-486\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0AEMuhlNtee8nVyffdbsqZwRBSPtGysbj8ySZHfoo%2FLoWZkxh3FJ1WlrnJ8MbZE4KlBMEQ%2BQrTokh%2Bs6VEMoSCgX%2BV0a2mf%2FUETy4dI0Mq7SV7xKkOWxw9lq2EJU98U%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd13838568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1158,"size_decoded":1835,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"f8fe3b3398088f0e69a11f175bc2e60a","sha1":"4c3d3548c02d8093e1e10f3f0797b03bb3826d52","sha256":"58499474dc41bdaa10400233da361529e60b209435a5ced9f39ea37fba913aad","sha512":"656d482bfe8f87849fea0f689eaba2fbe37fc982019d0b0b43ae435fae1adaee848e54d396c3c9de061a5b5a16089b2f3a78fdabc6b32a0d19a656f53aa62533","ssdeep":"","tlshash":"7d21b69b3ae61803ea0618ff0b5ccd7c13c3cd00c1fe96291553d28128bc2c1bc80a68","first_seen":"2026-03-31T13:47:07.146401Z","last_seen":"2026-10-16T20:19:31.976612Z","times_seen":26,"resource_available":false,"data":null}},"time_used":1020,"timings":{"blocked":323,"dns":0,"connect":0,"send":0,"wait":697,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/w.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.685Z","timestamp":1792181787685,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/w.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-680\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WZ0mIiJKOG7rdtSH5eHY9yrGWk7npNj%2BCJGZSx18xWNBEnzsjqU0uua4lB9Wsk0n0qHAR%2F6gFjGmLCONZjXvPi%2BtXFvL%2F8AEBaCFRfo6ZdUoi1EmkVi3HnqtSnhCQlc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd0ec6568d-OSL\r\ncontent-length: 1664\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1664,"size_decoded":2395,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d880092e094fa134138ef428e3c89f9c","sha1":"a1ce979f319a7228c67f086b2f5032c4809d767b","sha256":"eab40e12a58df1c2654e388f72006257d37247bdf2a7aaf0746c4ebf40f19784","sha512":"388a03f6b21399dc4205a5f9c3ba1f8e3283c486772f209a4a643801073d394416cf625d6bf178b3effbf5d86af0a4eeb49e9169dae5cc5caa763fe9dc13c6af","ssdeep":"","tlshash":"f0310a5aab120285eca2647c46d3abe152412e02921cc6f0d204ab420e17e213c7a387","first_seen":"2025-10-31T04:50:36.695043Z","last_seen":"2026-10-16T20:19:31.977328Z","times_seen":98,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mini.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.779Z","timestamp":1792181787779,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mini.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-3fa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9YBCucdrJPEJQFrKpZltEcwaokrtQOdOKE5XSZ8oh8o94aSw7gSDy%2Fnj6zFwNNXgIMc0mv3SfMQyqoOhdLO6zwqFSqtcOQG9mD0Q7P7zAeyUi4hWgihuEVaw9JFQhQU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f1c568d-OSL\r\ncontent-length: 1018\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1018,"size_decoded":1743,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5423895b8927440bb98872be54916caf","sha1":"f7a1d56bf3c66154a0136dde107fc1f1c4be1f99","sha256":"92864148d1d74ad7a0fa81387c8060d7551a7c6265f12d29209cb3e826818b5c","sha512":"19b68594fa6871e8c0770daef62eb64f4d9474167c47ad38c37dabf46cc38603d696112b83bcc511f4545cc397301056cc0c8e43666a243e7120c3b569ef2a66","ssdeep":"","tlshash":"5d11d81c23a62ffcec542880aa9840c18f9181b5bf788f1571a265ea4c61aa4e10204f","first_seen":"2025-10-31T04:50:36.788218Z","last_seen":"2026-10-16T20:19:31.978013Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/retardio.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.823Z","timestamp":1792181787823,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/retardio.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:51 GMT\r\netag: \"68d0d407-422\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ih0NrtKNtiPlzbkY8hVd9Wq5uqztYwe3wHElQ9sLZFL8WgDAtN64T%2BnXd%2FDPv6J1L8I7VpcrjvQ6EOGWPgKINQoMq8lAP6w%2B1OaG%2FLFOIxXu3l8JbdCtmCx3CcZonwo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdce2f42568d-OSL\r\ncontent-length: 1058\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1058,"size_decoded":1789,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c4997b4d706f8983350025f9d6d6d74d","sha1":"535fa23d66880b33d98a01559db7def28cfbaf79","sha256":"0d5d34d44f8a12b42bb486e4ab8170a457ff66ad8cd9cf715f7ca9793ee2fb0c","sha512":"4598b27de3550b30c83e098fe2a2cf8531620b6cc60ff7d1855ceda0bb977640a5e432d2ad89a3d578df4446583f1263a08927cb4031a81685cceda70a141c42","ssdeep":"","tlshash":"d511b565f9005204c59122ca02e443cbe29efab5e20163e79bee4da43655f9b957a0f3","first_seen":"2025-10-31T04:50:36.778413Z","last_seen":"2026-10-16T20:19:31.979309Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/launchcoin.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.854Z","timestamp":1792181787854,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/launchcoin.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:44 GMT\r\netag: \"68d0d400-4b2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kAolggG9wALXXBTCgH%2Fz70%2F8AaFKl9vrYtaoIE5f5VST0F5Z3Qf25m3SKylEyz7rSeIFPJCTWVRE2y6g7ngItU3ruP251kFH%2B%2FZ4LT2nC%2FlrPloHqs0HWIgUD5VZidc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02f9d568d-OSL\r\ncontent-length: 1202\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1202,"size_decoded":1935,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a65d93ecc842738146008b3cedf4ebd3","sha1":"6133c853034dfebe83508115511d3ece477fb0ee","sha256":"053f212d0d205eff9c4e5a6843e1d8a0c2e3987347c8bcac7beaf3b7385490b0","sha512":"27fdee98bf13ca1c0d6c3370f3c93b98ed9774893d79099b048b50b5c21062712cef2047aef0628848fa541575a7e11ef9671a54c55a11c063b79b9c05b0e66a","ssdeep":"","tlshash":"20210dc3896910e38cde953c1f503611481f59403dd3a32e4712775c4f0cc10d96d3ea","first_seen":"2025-10-31T04:50:36.865088Z","last_seen":"2026-10-16T20:19:31.980071Z","times_seen":96,"resource_available":false,"data":null}},"time_used":654,"timings":{"blocked":167,"dns":0,"connect":0,"send":0,"wait":487,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/huma.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.931Z","timestamp":1792181787931,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/huma.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:05 GMT\r\netag: \"68d0ef81-32c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HWld77C%2FT2UiIyOlfUMLmrldsKialu2tHkOJiPEW3sFOwC18ruejtvsRe8i77k1S3uNIHBSCzKB%2Fu%2BShCjJOysOVyA1Yn8rm0l9TCSSvJz%2BEaARTceYATEvZkgFdpHA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fdd568d-OSL\r\ncontent-length: 812\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":812,"size_decoded":1542,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b109450e98b04cc4db6515753bf93131","sha1":"43c372177e5c2da411f110d6858a2fbecef01651","sha256":"dd4526aaf9964f4d31ab2c261590bfdc7d204f191c31db088e0cd36acb46967f","sha512":"b7514fec7558d4da9e93d11e32c519b63ffdffe9b5ddf5484c5e01c0e19c6bf343f7274bab94cd37a6639f1752c19e978bb760174993f6c26a9783f6db1cb694","ssdeep":"","tlshash":"5b018a701f35b06ac4ff5a5af582ec64075f341d4eb1a44423c15f4a45061d4d7b674c","first_seen":"2025-10-31T04:50:36.818989Z","last_seen":"2026-10-16T20:19:31.980794Z","times_seen":96,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":230,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dont.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.979Z","timestamp":1792181787979,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dont.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31f-7d3\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZPKYBaaAuDOUHGoXmOK%2FQogulXq9eX5LNqsKr%2BsZpgdze%2B18NHwuI7wvoR7u%2Bsw5V85xWFGo8XaXmtF0tt20kYIozhBL4DB8hzZjhjlqrsQPtxKZITbo3p%2F%2FM7NmVig%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81d568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2003,"size_decoded":2741,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"157f3b7a5a2ebde910ed4dec4bac1183","sha1":"5b53356511af6c9161a098ba03c0ae41929b9abf","sha256":"04cdf05488b753ad9f0a3846a94b439e72164ea1d554338e92b8a7bf212e81d5","sha512":"3f53c2fcdcc3cb134bf8e49da423fb2fc670858624be39946f5c10eb867c5004f788d6ab931e2a8fd4bd1f2d24fd3b5d490ef44c966b69849b4bdeffd06473f9","ssdeep":"","tlshash":"0a4108d3f35b964fc062147b5ce1c23b68812e09d14a9227a3063e1eed29a9798862e1","first_seen":"2026-01-30T00:58:38.222866Z","last_seen":"2026-10-16T20:19:31.981593Z","times_seen":48,"resource_available":false,"data":null}},"time_used":771,"timings":{"blocked":286,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/useless.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.722Z","timestamp":1792181787722,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/useless.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:41 GMT\r\netag: \"68cb8eed-590\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E99gBijGPd9J%2FDyMGbFWoD6fRABZRScB5RXUcJfjQr2SJuiVRBexLyXCOMCrIWNs4KaDbS3Gk9CeQsTjudSqzX1AjzaJO%2FMYXzLTkwjoaXayIXmPN%2BhfwfKa3E06Foc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3ee5568d-OSL\r\ncontent-length: 1424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1424,"size_decoded":2153,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"47e67b87c643c410193de120bfac81c3","sha1":"d89be78255e4a3220cb072723802d1aeffe412a1","sha256":"83a19828652576705f9b6fc8892bf2f55e24126590a98fac057e9e670d3a5581","sha512":"fe75a8d2534d2abf98334b35b1b25e93a86988110584f62c93e5fd93d63af550e150636ea4a1c81fbdff0791bdf2138203aafc4d06c49af274fee20516ccef02","ssdeep":"","tlshash":"752119163af25920731d3081e85f04ad524d46cce3cc8dfaef29505016834f21ef1f55","first_seen":"2025-10-31T04:50:36.810512Z","last_seen":"2026-10-16T20:19:31.98402Z","times_seen":96,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":470,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/io.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.660Z","timestamp":1792181787660,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/io.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:40:57 GMT\r\netag: \"68c930a9-34a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Apq3fes7Osgk1eZzssffMAZEKXEv3ooX%2F1%2FMBnQV8DydOxirfVB9UZXcvda%2F1VRJI4Ma%2BDdjWOZAx0lmtL11F1KkIqc3iCuQmcdU48m3VVERQry8jBbeBWwL1JvphcM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccde9f568d-OSL\r\ncontent-length: 842\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":842,"size_decoded":1572,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af2a04f8a1bee054d4f8ec70da7375b3","sha1":"d05eb67d52b19618a8933eda4ae39d242ca4ad9c","sha256":"55d7d7a0b33c9b50d00b39b231318e9363b3edd56f5a41214d60e0279a3382fd","sha512":"739344a9083b4815572bf0071f4dc4036d015707a6360be73112eab34e61b8ae37f4e1fa6bbd74e1fba4d13f0ecea3d0f406ebca1d2f5c2b4ceafc2c159a8c75","ssdeep":"","tlshash":"660175114e328bc0dd17b37948fdb7fa60e0c45cf3a0e9734b6699201dc84484ac8faa","first_seen":"2025-10-31T04:50:36.932153Z","last_seen":"2026-10-16T20:19:31.98793Z","times_seen":96,"resource_available":false,"data":null}},"time_used":686,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":686,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pnut.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.703Z","timestamp":1792181787703,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pnut.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:33 GMT\r\netag: \"68ca7a91-61a4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TbCb%2FtDUFkx1mJH5JGp4SDQOF2ZU7FgGV22R7cfmi7pyhzmG2eU8zKrN7YlsqE%2Bh%2BIHBRANO7g2Spy8iLQYsU3EfrbWJX9gPc0qG0fAfpmkj9euyJhI0G367RH5Y7Dc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd1ed4568d-OSL\r\ncontent-length: 24996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24996,"size_decoded":25727,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc4e3cac0d72c46167a5ff5133e525dc","sha1":"92bec756365b4bd3abe6d428c6c65a82a35d4037","sha256":"66f38f1406524d1b639fb0327b3e23c9555c4fb5d4e51cbcf9fea227f0ee9a0a","sha512":"21accb0255a3b2555245b4b938f4c63c76b4bc1d3dd02fd63f81ff7d8e1a10681f9248b984e6674fc308522e1510c08d80ccc12e9c39cea72e6ca47ac5a5be8c","ssdeep":"384:qurOJ2Z0gt910E6la5r+zK4MltB5STNklDnF2J51bG74IUpl23t:qurOJ/aOOYK4MlteT6DnYJzbG7hVt","tlshash":"cbb2e12ba43adcd5cc16fcf53fc010ba469e67f1621acc9645aaadd7931721387c508e","first_seen":"2025-10-31T04:50:37.006547Z","last_seen":"2026-10-16T20:19:31.989947Z","times_seen":96,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":149,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/tdccp.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.708Z","timestamp":1792181787708,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/tdccp.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a89-b8c\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=raaS4jBAMHEpuntgc2KqxC1C9jD0RcjZfpEb%2BhBmDH%2BcmO3OUOg03zdueF1ciuTPpLTLguYSdl2Cc8uqAi2F1ovaCF%2FbNhFdtBYLVQ8kmJEplfmA2LkZr3gRG0lZ8w4%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcd2ed8568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2956,"size_decoded":3759,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"917b7e8b3651441710e8e7a841e57019","sha1":"bc232b09cc496ec5fd10b9d957c4bdf7334fc0b5","sha256":"82fa67f32191e0a48f3d4037f73146c8563bb7bb5ead8e88865a3ba937827893","sha512":"075dff3021dfc2bb9429faae2a40a86c40d41d4d61c26662a3db495897c346aee95a437622b7854b324ba21abdf316161d1b20ae9e7c41b41b1bd0d2f0227f28","ssdeep":"","tlshash":"21515a6902a30e2caba327f21dbeac4079a07048df27c2685723097b25b46c3a218810","first_seen":"2025-10-31T04:50:36.871786Z","last_seen":"2026-10-16T20:19:31.992102Z","times_seen":96,"resource_available":false,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/act.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.731Z","timestamp":1792181787731,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/act.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:52:00 GMT\r\netag: \"68cb8ff0-ba2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ntqPsxgf1TEfEjvEXvTQfc%2B2H5v4OQAXJIMV3DF7u%2BR65XvlwsRYQdup90jWlEMjMapTPMQaCFb6263MnvtOtHxoZShJaPxGxMl2HQtiCc64gCmDpmHQWk%2FFu9RgV1U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ef6568d-OSL\r\ncontent-length: 2978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2978,"size_decoded":3707,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28025c2684c78fed7b66dacec56af92c","sha1":"732764993d5f1065ffcf84eb9ed2de6b3a5d27dd","sha256":"792eb6c379596f985e0c89562a0d9de77a2f5836fc6b803a52c9313e32ff7b07","sha512":"273330199b8909b9804411538a71fc9d582d87f383782c8eecae74533bc21649eaf553e4fe2f496636a2a866bad3e00edc103d0ea8ba80698ab021348cdc6881","ssdeep":"","tlshash":"f6510b45978a47c1d9840cbca4940fd8ebaaff368bdb837845b04532b5e90c38458aa7","first_seen":"2025-10-31T04:50:36.97586Z","last_seen":"2026-10-16T20:19:31.993925Z","times_seen":96,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":469,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bert.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.739Z","timestamp":1792181787739,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bert.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:43 GMT\r\netag: \"68cb957f-972\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DaeoYbWJBYLRalu9xHuyMz3TIcbdUiS25crNR6Ny94HvRZs%2FRjvSY1MThTC%2FP9K1qF%2BKi8BIettytMrfYOpWKqXTtgTLPcIyouXWQf4Lwy%2BAmBFmSwZ9RzoDcoVw5ak%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd5f01568d-OSL\r\ncontent-length: 2418\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2418,"size_decoded":3149,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42f6ce659c048e7b028534ec168df007","sha1":"f2ccf55ee4405b0a54bf9f8f5679280516094d13","sha256":"128c4af9cca2a4de4937baae39768b1b24b2e1f76a984f717084c71059b2ec3c","sha512":"2b2174ab0c6c3d952255f475a7963a7e3e1ce735005af46c89ec08d847a4a764fe219bed76b2dfd020ab9750fe894cf93d9bb363bc22729bc96ed010011e82e4","ssdeep":"","tlshash":"f9412d69f3884318d90416b540773bc6f7e4bf9d9735ae14834743a107289c9f1e85bd","first_seen":"2025-10-31T04:50:37.011879Z","last_seen":"2026-10-16T20:19:31.997589Z","times_seen":96,"resource_available":false,"data":null}},"time_used":475,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pain.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.754Z","timestamp":1792181787754,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pain.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:49 GMT\r\netag: \"68cb9585-89e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vh9kRcU%2BV56sc%2FgG1uF65Zp%2B0Rsp32KPNMp7PaSleFBsKdz%2BIRaPokN1UAcHY3qPn0k7IEaCYaBTar1GSAzsIdJC%2B32kYS88mMR%2FEd2jnLX7nGhO%2FMQpFeDtKKlCd8g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f0d568d-OSL\r\ncontent-length: 2206\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2206,"size_decoded":2943,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7979c67362a2918d99ffa17518249545","sha1":"14d79496477c099bd3dfbfe3addfd6337966807a","sha256":"6989a3f292d792d419c7a9f47a64206653a9492a272e7dd92b1d0cac4751e9e5","sha512":"d50e9cee92df8d3ffa667e89aab92f246c95dd1115039f2b00b7342b3e3a34e3a123b2d4f348d39ae5da5a3e6e26039a3abc7ce80e083aa499d0e939b0864f12","ssdeep":"","tlshash":"bc413a068386ed228d52cd40f1f636c7ac2498a81ee454ff9ef650fd68e4d452d1dee0","first_seen":"2025-10-31T04:50:36.675999Z","last_seen":"2026-10-16T20:19:31.999132Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/tslax.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.762Z","timestamp":1792181787762,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/tslax.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-3c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=weCAZrRvu9lfBtw9UNv6ZV4BxZPJbRc4iT99%2Fh7H9nzPSTOYSZAYZ25j0IV1MOgqPQiNfajsXcHRewIefAow%2F%2BFM%2Flj69p%2FIQf4yEbCZAjL9laGMKkknhA9BdDZR5Ns%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f12568d-OSL\r\ncontent-length: 960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":960,"size_decoded":1692,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"641906f846d08492338b70696957ec20","sha1":"9808750aab28e0109f85f1bf9ef101f3417505a1","sha256":"8b94e684af39238b2b1bb291389d20f4ec0a02ec2804451ce90a5d3937d6549c","sha512":"6a5129fdc20662a75f00474d739c9af63c20f008ffb4fdf2df4fdff469be9becfe11dda4fabf0af0a3fa9000d008e8fe727513e53d9bb5587ee5d90b3dc3a680","ssdeep":"","tlshash":"a61188f49e5752f5deb01283d6ccbe41131e855e14e09617f84a04b62f055f099c3689","first_seen":"2025-10-31T04:50:36.829001Z","last_seen":"2026-10-16T20:19:32.000171Z","times_seen":96,"resource_available":false,"data":null}},"time_used":490,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":490,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/trump.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.658Z","timestamp":1792181787658,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/trump.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:41:18 GMT\r\netag: \"68c930be-5ba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QyaYfHqrzqh5BF6Jb7QgH6eExi5oQ3ARGWdX57FBWSnvsS06UN7HjAbQP5rf51WeF0f9fCObQetdprxlsnMDYidfZz6qeOWkb7iW313sObLZO9EsYhtwju7Q7ZUbYXs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccde9e568d-OSL\r\ncontent-length: 1466\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1466,"size_decoded":2189,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5b7b68c9acdc17a186862f56a620be7a","sha1":"57961a3844c4515be40b722cb3ec5810c40c9114","sha256":"edcdb92acc20730cff950c0e6dd19126243cb26ec8d7661630e67f1488c84fec","sha512":"9281323ce0bce6546a0842f4b7134cbef2744fed833333bb581694ac7eb0a9e0ee714e29c0f6ef3359ec866ea58a81109f5ff1a57c036e2f15f778e4656e9566","ssdeep":"","tlshash":"2a31b97dba818609e06445bcbf3723557495e0c5408891ab241e0f18bc9f88c5d958e0","first_seen":"2025-05-07T12:19:22.490812Z","last_seen":"2026-10-16T20:19:32.001437Z","times_seen":109,"resource_available":false,"data":null}},"time_used":506,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":506,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/cbbtc.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.668Z","timestamp":1792181787668,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/cbbtc.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:34:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92f1b-223c\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2BRphSUlU2KM35WJryAeHGLm0v2z%2B8cE7jyDIMNljdpemkEZKZUPVCX4ke0oPGw5m4RqoZNN3KzNipJmW%2Fu%2FerBxirzQSgAyDuvrj3C4CV3Jios51Df6OvGtUpTGV2s%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcceeb0568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8764,"size_decoded":9516,"mime_type":"image/png","magic":"PNG image data, 640 x 640, 8-bit colormap, non-interlaced","md5":"4b8fcf1d41dc6b9b27578324de15a8bd","sha1":"0716848f6cb16a5dca789d11d25350802741b2ad","sha256":"968d5730a47219a3c17037839e0ddf699f3ffe4feea28a1d15473b22d7afe90c","sha512":"97b1197a445f40838a00d5469a3d29f05fe0f9276bb2eac5a4253b9fae9c158b99e5fde9653c910c2d9684bd3315df68191cddf86f294ae6b4adffc009a811ad","ssdeep":"192:RRODUmTWtgspS7nC9fFqqxlux6PnAlo9Ymgx39GI2ZJQottUXeiUn+:oT4aULluIAm5gaI2Z7bdp+","tlshash":"cc02b0432056ed3442fca44ad80c7ae7015a6eea7994352888065377bb36d8fcacd53a","first_seen":"2025-10-31T04:50:36.655445Z","last_seen":"2026-10-16T20:19:32.002449Z","times_seen":96,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":478,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/vine.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.713Z","timestamp":1792181787713,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/vine.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:26 GMT\r\netag: \"68ca7a8a-3b2\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ky6slbnFB5LHoiZsx5Dy%2FLY0Y9FOP7E02zqbUIDQF%2FrHlijlhCWv%2FWNuGB48uQXBrF8GGEBrtW4biImwukBp3So%2BF1iDsddyYLkBpYndzPmxEOPS%2FMGFHIpJgLbMpFs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3edc568d-OSL\r\ncontent-length: 946\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":946,"size_decoded":1719,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"53b3a7a7d29c9ab3866fffa023f23177","sha1":"fbb7803171a6d3a0d4c1f5cd02b79c39d6ceb764","sha256":"2ba50e8139bc64cc8dccf01f27df386f470f8f385576d7671b4b35141311470c","sha512":"ecc492c21cb9b5c8e8207fb252ce447758453802381be3fb0f5beb1eb1ede6d93a07b3ffda797dcc382857d8f1e8ab46492d7c2e1174187a114571a81ad8b55e","ssdeep":"","tlshash":"4b11c8d903585624c879e1e9c15311f08b61ccfa19bb1c3c2ad7b2b13c28c0f629f292","first_seen":"2025-10-31T04:50:36.874463Z","last_seen":"2026-10-16T20:19:32.003481Z","times_seen":96,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/orca.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.768Z","timestamp":1792181787768,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/orca.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:48 GMT\r\netag: \"68cb9584-904\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NyWIL7SlQGr5bG2BsVoDKK2v42k0FveaJ147s7SAUIugYdzLTozWQeMG0lboCr%2BMBOujgobsj%2BeXbX0sF5LPDEfQCmWMn8Vhj1B0II2sP3oRGE%2F2yQy07hyvYc2FUn0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f16568d-OSL\r\ncontent-length: 2308\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2308,"size_decoded":3037,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f144e6a4e44346e636d6f364152cfbec","sha1":"c35fe3c2830c4a455817d784e64b1f39252af3d2","sha256":"697921aec7b9356d920e50d83e85a736867870ffb954a1527b6e11ac9fc317ad","sha512":"5cb9c853ab26e315f2ba3e4b5718d4b4bd3146155442ad48bcb84534b72724a3f8eafa0be5bdb36adf406c5771f15049f0f765b635979af0b7eb73dc04d0df32","ssdeep":"","tlshash":"bf412baa77674b83bd442c3876ed229c274a92ee72cabd50742dc1c44731a958d2a0d9","first_seen":"2025-10-31T04:50:37.012799Z","last_seen":"2026-10-16T20:19:32.004432Z","times_seen":96,"resource_available":false,"data":null}},"time_used":471,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":471,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/verse.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.776Z","timestamp":1792181787776,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/verse.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-40c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZurkbBNWKYvIW%2ByLHa91nAjFcwvEZVfGjFpwapMK9JxXnZfqXkWcr1F61fnu%2BrqBjPJGUeUhX6ut7sgptj1h6UbX0AcAMf3tWfPNGFW5LduZbJNCaq%2Bsr9yQG3vkJPs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f1a568d-OSL\r\ncontent-length: 1036\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1036,"size_decoded":1765,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x87, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b6b751ee59e040efa6437cba3d655229","sha1":"b42fdc0b1de465d88d270aad472082bbb4f2aa74","sha256":"d583c540e6a901b07dec948da9b7d81180ef5af63578bd9ee16cafe647b867d5","sha512":"7dbf58df10042829fba53f0429028cf6eff550a440f99816323953d61a8ed6ef25a1e6c0876c812fe3a6b4cb0625174988f09c5ccd0ce09402011463c8a6713f","ssdeep":"","tlshash":"2011d8035bb7f67700002ce966b895749b9584e0060264770abe4d15d94b71f0af7a7c","first_seen":"2025-10-31T04:50:36.984841Z","last_seen":"2026-10-16T20:19:32.005295Z","times_seen":96,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$myro.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.808Z","timestamp":1792181787808,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$myro.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:37 GMT\r\netag: \"68d0d3f9-862\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iKnGIZH8VUQcdpGHspJwwMjdSfIagPVUR%2Fafc%2B8LeA2Lgs8%2BDuUcJY%2FuyK2hoVMTAiHIq9f8%2BXN6MvtXuO52CwjC%2B6X0sIHeGaORteoALaTjIqKfazea0DjDhbmWQJw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdce0f3b568d-OSL\r\ncontent-length: 2146\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2146,"size_decoded":2881,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8d5bba06a8d84af302a89362f8ac16b0","sha1":"60db160c9d042b6031cd1dff50a90091b6ea0920","sha256":"f59b4b5613ee80d204239dac6c509a2e6f16e7e16329b8dd53bc85c4867a4f9a","sha512":"fee530f5d0e983dba1e2a33835d9b00e491c1d7f36592a2c274a87a2e9bb24e5c1c322b72ab9b699ee86e64a51cb9ddf71a36ee955cece19c5b02ffff64b64ca","ssdeep":"","tlshash":"b9415cb3c847cc33dca8b603ba3c51f8b4d020ed42ad0a197d967b55913d9a0fe49a02","first_seen":"2025-10-31T04:50:36.863105Z","last_seen":"2026-10-16T20:19:32.006005Z","times_seen":96,"resource_available":false,"data":null}},"time_used":542,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":542,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/project89.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.818Z","timestamp":1792181787818,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/project89.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:50 GMT\r\netag: \"68d0d406-702\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S3EoNYnSQLd%2BR0dWZeBUKIdFeROsNM7qFIyCOBl9xg0fZM4MgPECYtBZDHh0s0kOrBDihr%2F4Wh6sB%2BNfc5kC9ZPVd2uCCAdFseWOP7KUO1sAI7Q2tP%2BqRYbiKUdeksM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdce0f3f568d-OSL\r\ncontent-length: 1794\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1794,"size_decoded":2525,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x105, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0522b818215f9329b63eaaec396ce7e5","sha1":"f2d1318ae265e565d55d3f0db7a7ac8ca1aceebc","sha256":"9175dee348b01eee13378546e44a3864ea340160854ad13da7f9d6852bc122cb","sha512":"23cfe428ba44b9ec148af3e61c8d221e3986dcb152b92d299dd5683029f131c211f14d6194990717510218902269dc6bb81874d477fd45a5353548ba7888d0df","ssdeep":"","tlshash":"69310969f00b5f2fc8609695ae0f4017487d022a3b14d3cfe31e54c9ba285a4e21b78c","first_seen":"2025-10-31T04:50:36.9996Z","last_seen":"2026-10-16T20:19:32.007056Z","times_seen":96,"resource_available":false,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":498,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/lpvP0dFg.php","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.796Z","timestamp":1792181787796,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /lpvP0dFg.php HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 400 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccess-control-max-age: 3600\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cqUwn%2BRu2TzcqB63a7%2FnwEeHzYyRLflMJLswh1B%2FxGfVNdJwHRNW%2BYVo7Q3lWPte2P%2F%2FCwnCUFAEC%2BQ1JToR%2BWGBfZY4UlIPuFrZO3xllT9MunuBwFBZ4CCbgZIUd5Y%3D\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcdbf26568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16,"size_decoded":716,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"ae87e37becf8b16a6143c0451453895a","sha1":"ee556a14d241fb1108b5ecd46347fda6835fcc9d","sha256":"7b7828cee0785e666db0dee048d43c7099dc57845886a2de7ba5e84e4db73d54","sha512":"6fb1f4008718feaa204727ded7cf69a7742c8a72078e2f5baeaef1b3f692e35644faa2f079559145bc657c4279a508ed519dcd10d86bbd4fe4fbf9ddd7e3f2b5","ssdeep":"","tlshash":"106000200202020800880020202808000a0a000202c0020008ac888820000000830a00","first_seen":"2025-10-10T20:59:32.991945Z","last_seen":"2026-10-16T20:19:32.007932Z","times_seen":68,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/usdc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.647Z","timestamp":1792181787647,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/usdc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:45:25 GMT\r\netag: \"68c931b5-87a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=29jSq2QC%2F8AOqpN6h0k%2FiqNJlpORv1kte2p%2ByefY2sdWmtbC3l7X5fTwzhSaOr5qnGdyUq4lFfzPI5sFD0Pc%2Fqzkm5cjorM%2Fxq1i6rzoooPG0w6TRKzl3n9Gdqltg2c%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccce93568d-OSL\r\ncontent-length: 2170\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2170,"size_decoded":2903,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2b1cc9796258e8b444cddb152d10b742","sha1":"b194e7192c90979e8f27f659b29bc5e488ef04e5","sha256":"4829789fa6bf5a71d6dbf349d1fb1ef8e3f6f69cdd9e50d6e66c0a89756201d1","sha512":"28cae3a8efdd4499eeafab4eccd294ab8fa5f861e3d1a61b7649f07a90e7669e335572110e8a81ab05705d69f08b7b408e541b7db0bcde10475c47b9830042f8","ssdeep":"","tlshash":"f7411a17e95a7e5ae20bd8bcd121f76158517c545b8efe0733f8ca516c814079df00aa","first_seen":"2025-05-07T12:19:22.496814Z","last_seen":"2026-10-16T20:19:32.008592Z","times_seen":112,"resource_available":false,"data":null}},"time_used":484,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/usdt.svg","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.649Z","timestamp":1792181787649,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/usdt.svg HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:45:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c9319d-495\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UOu7l8PqHsB2sAXIxrMU7cpIJxcWRvnATxxpK1ZZm3VM0wsnnl0gJc4FwPJlgMSZCKGwx5xCrPY51QoDFNfdE0Bupz40kqPQX5h2%2FohRvq9IeLSi9%2BIE0i9VXewuC8U%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccce96568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1173,"size_decoded":1368,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"335eb4a1649df9ef0779a3cf76667dc1","sha1":"94a48061d57696748777521618457fbb4cc29d1e","sha256":"ebe5e8004bc8a9e681f3208c5f838abd5536ed8e4eae243486a430ba70a90ab1","sha512":"1050f9d49d53f9ede345242eb6e98c2e40bc69d651c8908a217071d43bb4011b6e87f3ac628456ec26e0dde2525f756689e223a15c2ac17ab0c8a6ead3ed58aa","ssdeep":"","tlshash":"c52114cd775c884040c44ffb7f3788c83c36e4c11e464f18c0219f152c999af9d46a9a","first_seen":"2024-08-20T11:34:03.137583Z","last_seen":"2026-10-16T20:19:32.009275Z","times_seen":149,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":537,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/alch.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.716Z","timestamp":1792181787716,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/alch.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:04 GMT\r\netag: \"68cb8a18-346\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=99xz3viQQu2Qr5DCbdYq%2FBxOfX20iSr5ArC6D3TLpuDonOfAQnLZ5JfbOupC4RamJxwMPYrUEh1EonxOik%2BsRUhXaUd4g2lbtOaFrlldubVFm8oz2jVhLSQIE3e6W%2B0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3edf568d-OSL\r\ncontent-length: 838\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":838,"size_decoded":1566,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ecf1b9e78a867d44444f7419ff65618b","sha1":"f72b1b6953bef113500e2dbf86a18e79238bae81","sha256":"30923734d3d2a619539df306fb2e21125acbaf0d31909b626955d6b512f6c245","sha512":"d3ccd6fce9436364ef1b752ff95cfcf8d7eb6d41aca59adf58e70bfde5c5ec48ef63ea1c02e72639f008900b1b8296b09ee5167d2de9f4a9bcb8910a46141fbf","ssdeep":"","tlshash":"9f01d61d21dccb9a39492e241f9f178884a8ce843080d11309229a02b8d29eba242539","first_seen":"2025-10-31T04:50:37.002166Z","last_seen":"2026-10-16T20:19:32.009953Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/goat.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.720Z","timestamp":1792181787720,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/goat.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:44 GMT\r\netag: \"68cb8ef0-5d4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sB3nRlWz0bUhFAyOBR7%2B%2Bkl9Y4SGYDzATapqNQujG8vmOlV7yLGpXAMh3I3KwTNLj%2BLlw%2Fd4mH654moAvZCcq5YihcIrzhsWC9kN4S%2Fx8t5SbCdt5s9T6NWs4l8BvJw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3ee4568d-OSL\r\ncontent-length: 1492\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1492,"size_decoded":2225,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc8b2af6e2767846e8ce460afa140163","sha1":"9749e1ecc8e3a690f82e9234e4b155d2dada5fba","sha256":"cf1e9c8b224416ca3fcecc49d8b99258e2886ec0fd3c741d854624d7c59a1e9a","sha512":"33edf74311bd16007d03aecf2d7da037fcf7317ff4b5f9b4bd764c1de613cb5a109282c61613675c1408e560f4800a89d28665a198bcb009f9a49ab1705a308c","ssdeep":"","tlshash":"0331a591e39e272dfd002b34b4d48bb0c6fa3e118fd6d366c64405659eac9c0da6c79b","first_seen":"2025-10-31T04:50:36.922382Z","last_seen":"2026-10-16T20:19:32.01057Z","times_seen":96,"resource_available":false,"data":null}},"time_used":529,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":529,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/ponke.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.725Z","timestamp":1792181787725,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/ponke.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:41 GMT\r\netag: \"68cb8eed-870\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ucTdj27MyseghpC1X4JCAHJDfCQRtVwK1ciqpJCNRbeYY%2BWrIHWab%2BeBXLS%2F03WTVmeiAg%2Fw7ZP2kuVvp3Y3y7X%2FH%2Fa3qf3cI5XbHGKzDnGctn6o5tt%2BBPVROXj5Lco%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ee7568d-OSL\r\ncontent-length: 2160\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2160,"size_decoded":2897,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b9eb074425eff713dd10de3475e8953d","sha1":"caf79ce5f8f811166d4ac27b9bd0348b8c4eae30","sha256":"6891aab3ff52ca709e41106a692fd3aeb854c70edbebf3ada508e267ea511423","sha512":"bfa46eb09f17117a515275f2a5d0f95490ab3292b31d43a0716b988e645759727f37151413c3834a137fea169342b627a0a002a7308bc4881c2f61a2b4a4f716","ssdeep":"","tlshash":"ae4119083a096a415adbc4bdbf5c1ec70b708097803ef1c9a3aa79501824d18696a2fc","first_seen":"2025-10-31T04:50:36.905568Z","last_seen":"2026-10-16T20:19:32.011265Z","times_seen":96,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gdtc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.812Z","timestamp":1792181787812,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gdtc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:41 GMT\r\netag: \"68d0d3fd-bfc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gF5%2BuNBsLbd%2BEQ7renritJ%2BHiGPtdq7MDc2Drn7WAXoX%2BcUdbzo5aUtFC67C2vF4efY5GsFusrQVFIhsQ3HsJQfEi0Np5pvp3XeI7zvGHY8kBr5gmBTbNjr1Hf2n7tM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdce0f3d568d-OSL\r\ncontent-length: 3068\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3068,"size_decoded":3799,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cce70f15961932f4631c2063dd669064","sha1":"ba58a2e0aafd539be4fe0269c07557ca3f7af656","sha256":"0fb624367d915cba3fb5107a1c897af7a79cd6f9471ffd0c17ab0c35e4f353dd","sha512":"490647a4fd7325b18d4591e037aa7820aa427b2ee1292bd9b2e4e16f5578a0f2dc9b845d19a744650a95920bcaa612f541bb7b3864013ed15a0866ac6ca12677","ssdeep":"","tlshash":"0e515de9db3f55da856f31a4ebf14d2750901880d3834aefacd78c49200eb193a519aa","first_seen":"2025-10-31T04:50:36.741534Z","last_seen":"2026-10-16T20:19:32.013984Z","times_seen":96,"resource_available":false,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":498,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/audio.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.855Z","timestamp":1792181787855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/audio.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:38 GMT\r\netag: \"68d0d3fa-44c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tNSVh58sUZiGoYY4ysYFFENvBy1%2FGPHqdYjRQIfvGOhpHVUOuedkGQ8PRaCXQhX4BNLC4eGU8%2BIYQ6kIM4mqEuvDXs3WSguDqhzskhnN7B84I3FKbIZChOcfSQe3B94%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa0568d-OSL\r\ncontent-length: 1100\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1100,"size_decoded":1827,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1c6e9ec5c19856d46ef6ae6eb44f9e07","sha1":"26757d9943247efa3d2c28ed4ff8cd39b26385b8","sha256":"c65af8cab2005808822aba9cbdc20912ec9c4d84e5778c8be11227789507fb6a","sha512":"8285a54f40e24c0228f64e7b2af653b07c7f7cdede6f9fe5866270659a895060baf9b5902a7d90bf2a446fb709b48bc0c0d2e16550d33f59ecee7e2835429e0a","ssdeep":"","tlshash":"7f1196f0e28936b06d15561d405462aa0360716698e2e33a5b40453b8ddc0a0f59b9ea","first_seen":"2025-10-31T04:50:36.946467Z","last_seen":"2026-10-16T20:19:32.016047Z","times_seen":96,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":169,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/uranus.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.895Z","timestamp":1792181787895,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/uranus.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:21 GMT\r\netag: \"68d0ef91-4ce\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qAzwAl%2Ff6AEwSxREXCubXRdlJIAnu4sUGwAP%2BFPbPn8TdzAeYqrimwiqzFRYofnbpPORF8MYQZkWnukRFazwtANwC65jLsZylwk60wWIDB%2B8hExjTEaAoOWl%2B%2FMrF6s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd05fb8568d-OSL\r\ncontent-length: 1230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1230,"size_decoded":1963,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"220943d4bb6c760f59773c51328cc22b","sha1":"dfcd410a8c3715a663d74f037b452700170c6794","sha256":"32a0725da1c5d57080eb75bf292347972a3b2e2b877aac05fe4f74e82e8b622e","sha512":"6a1bf9925d1d47d2626b6437a8912e703fa88df14b970e63ba941954bdc3dac2508a6c132098c6321993976fd7ab7bb8a6d66d98ac775fd8f35034256b8d2f39","ssdeep":"","tlshash":"2321b634632c374cd0183378a0713321b7a53f32020a6eaad70166755f1aac8558d046","first_seen":"2025-10-31T04:50:36.690959Z","last_seen":"2026-10-16T20:19:32.018661Z","times_seen":96,"resource_available":false,"data":null}},"time_used":675,"timings":{"blocked":193,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/codec.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.834Z","timestamp":1792181787834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/codec.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:39 GMT\r\netag: \"68d0d3fb-25e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Sygpwuq33VI8BVTBqcZJQEh2RQLrEuLQ%2B5rTlzVZghuEoDSy47aO342tP9hnHGPDutKg2XCiOAUrYm1SNwXclQuHIrMtLk3xd%2FZlAFNRco%2BasknK1b0cEKT%2FkktV5JM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef86568d-OSL\r\ncontent-length: 606\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":606,"size_decoded":1336,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d127a3c3f1c94baaacc57f64415c9279","sha1":"d32ee4af752288057471b109c1f033d7f5217739","sha256":"e80c0d028505e82c468bc75da08e0f455749740ef4e4b5ff9f45c365810cec40","sha512":"fa41af926c68e43f6d9127cfd90300a348a727d52318df9ec8aed43222feec741ff585320de1a08f8988f3af9567f736138895e458953db7f477461767d4846e","ssdeep":"","tlshash":"9bf0b715dbf2fdf5c18cb93d10c9780c30d4400c112e3de2e55b8044f31184d5480ae0","first_seen":"2025-10-31T04:50:36.949045Z","last_seen":"2026-10-16T20:19:32.01977Z","times_seen":96,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":134,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/nos.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.835Z","timestamp":1792181787835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/nos.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:49 GMT\r\netag: \"68d0d405-3e0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=huBlQ88d40D4qc7HPs9VIpIFkACFZ6bywywwn8KyErN%2FB%2F%2F2clqwqIOMU9kfXA%2Br%2BKcMq6%2FYH%2BPCHCRpyLsdx%2FSiDm6VoIX95qhSRM%2FsSjrfHuWouL4ndQitspXcXgc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef88568d-OSL\r\ncontent-length: 992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":992,"size_decoded":1732,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"864b2323d8987ab96d61d4166059e55b","sha1":"0f491b8534524aa916953c725d870bdd1952ed95","sha256":"391029cd327a3d9eba39afbe211545b89c32069bc4f74e33631aa1a53d461704","sha512":"77c953a7d0965f1b2e9f9d2cd49419bd564edc7365a7dcd143ded780b9587dd06b0356df586806cee5d4997ce24c935ef95855877eaa17ca1f72ae587419345d","ssdeep":"","tlshash":"e5116549ffb03b1aac1776a864e91dc78c721105065b058e55fb843398b02b8d505b02","first_seen":"2025-10-31T04:50:36.876461Z","last_seen":"2026-10-16T20:19:32.021815Z","times_seen":96,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":135,"dns":0,"connect":0,"send":0,"wait":469,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/look.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.860Z","timestamp":1792181787860,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/look.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:10 GMT\r\netag: \"68d0ef86-392a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a7y%2BrWdBxL35fhcv0V3WQs4YzjeuGwgrCE2WkPp80pcO7vVk%2BUWmAhg3TY2PImmGqXtK6%2FCuDX9lhJUMfTI0iv7gjzgIgUrQA7v1BrxzSG2FKO6G8EPPDr%2FrH53ybbM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa3568d-OSL\r\ncontent-length: 14634\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14634,"size_decoded":15367,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba05eb2fbd6ee81042eda9d7280f2c96","sha1":"9d45f1f34041e9abbe444dd0833d1d64cfa0a4b7","sha256":"910779c1342238eba4a30617754c35c018a414c6b069bec0fc1ac6c68cc49c33","sha512":"e696aabbe259d5459bf8ede9ce5ec28b74e4d78401a89127af037f4390cdf9fbd439437687b52aee78d1e4a0b1cebd1466a4715a4f3a99a113f40e5a77a9611e","ssdeep":"384:q47YGBcIWQVcee94aA4rkczENQgA4EI28xQON/:qMYypgJUwz4Q1i2vON","tlshash":"4762d057f329f2e2d8ef1837db1a3b28d5326809817ba4c67d67f830610d2357151d8a","first_seen":"2025-10-31T04:50:36.912263Z","last_seen":"2026-10-16T20:19:32.024178Z","times_seen":96,"resource_available":false,"data":null}},"time_used":794,"timings":{"blocked":171,"dns":0,"connect":0,"send":0,"wait":474,"receive":149,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/a47.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.864Z","timestamp":1792181787864,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/a47.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:24 GMT\r\netag: \"68d0ef94-820\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cdhn5gHgTN%2BNOOD3lAjURDVmui%2BobUn2NDCm8eCg7k2vMIM4%2FwwtOJkrsGK9JwRo0XubaG%2ByyDnAHj4y64xPtJ1C1Nfj691QPj5sYVIj4Hu6bO7pVaUneZzQpxf6du0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa4568d-OSL\r\ncontent-length: 2080\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2080,"size_decoded":2811,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c9a72195f9cff2c36e987354b3905674","sha1":"d2d6f450f6be9fde08e431ef1c22ea04a0fb48b3","sha256":"9e60979b600aea90cbd7585d792d61a2b8279da7af416ac9718b116d78e24340","sha512":"008c46170f1151087148fb3741b0d7d4c6f533ec737765e61288f2538d138c0f6e30e7899bc20038c80e85f7b0ec6dcbc41c1b61284542d99049613a9341ed1f","ssdeep":"","tlshash":"944118f264620e881c4cd73c3d4e2b7718a87a02d9ce579fbe8bd5cd58d45d2d1861a4","first_seen":"2025-10-31T04:50:36.794397Z","last_seen":"2026-10-16T20:19:32.025315Z","times_seen":96,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":172,"dns":0,"connect":0,"send":0,"wait":166,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/sonic.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.870Z","timestamp":1792181787870,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/sonic.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:18 GMT\r\netag: \"68d0ef8e-842\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ja8fNXR81avfIrTVx0CXLw9aWzZMqyXclTcwfbEFRwkJumU2XahiyImIgXAaAViCSEaDcxGlh6NGUIZRJKpD83i7A6QT3yruILNFbxkTs26zu5L2YuNPasi0BYPr2cI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fab568d-OSL\r\ncontent-length: 2114\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2114,"size_decoded":2837,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8778db3ea25cec1fdf2f23c11b29fd9a","sha1":"5845698778eea8f3b4acf5d8efba1a2800a20df9","sha256":"53ec66ba5a2ee4af15cacf18e42ca94b81401830084fb4819d4044f146d2e94f","sha512":"0ccd9cd3b79dc7508733cc370b39b35e051a613034ba85b8a99b4cf5c09951f1408a9a68e6009ae3cddbd576f8e6cecea5fc7d46a0c0d7f6bbf5de864f0d7658","ssdeep":"","tlshash":"ae411a06621d39d3866cabad77d48d4988df8988f07ccd6fd08c7e11c0bb2291b0536c","first_seen":"2025-10-31T04:50:36.770332Z","last_seen":"2026-10-16T20:19:32.028309Z","times_seen":96,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":174,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jailstool.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.884Z","timestamp":1792181787884,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jailstool.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:09 GMT\r\netag: \"68d0ef85-55a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7O1mU17AehjHRQ3JD33yYMGrwn5dVZOnyedTzapYj5zPQQQIeb16x%2Fmrh7EnpuZmAyiM70nE9IyFL1DfMx3nHuweGgDVTFhalvF0gGqGQM%2ByqeS9yKQDwkN4epvH6SI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fb0568d-OSL\r\ncontent-length: 1370\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1370,"size_decoded":2097,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x80, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0e49c7fdccc3530ff2ed90ec47e80ca1","sha1":"9fc7a011fd034fe324039ec4792303468547be2f","sha256":"496cd7599cf28ebbf6a4ff93967359eba413f1d4e46b577bec2e1599a0131005","sha512":"251412502da9e44e13dc7dfaec5872eddad462af78929780f7ec45a68cd7f3f517ac97b27804df660f18802deceb77d515b90f732a5abf7f4b39f713401fd3b5","ssdeep":"","tlshash":"fe21084bca0d023680e6ed167d3c2c0f7aa9c0c5a4d555cea0b1813e54023a37b9588c","first_seen":"2025-10-31T04:50:36.987418Z","last_seen":"2026-10-16T20:19:32.029428Z","times_seen":96,"resource_available":false,"data":null}},"time_used":657,"timings":{"blocked":179,"dns":0,"connect":0,"send":0,"wait":478,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/virtual.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.893Z","timestamp":1792181787893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/virtual.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:22 GMT\r\netag: \"68d0ef92-254\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8xeMXq%2BqGT22tl81yJuOrY4vgArfrDK7C%2BnY3d7OOFV736LD%2FhHTmxN0Uitn%2BNnNsUQulQOLvqwFselMmoOTkguMrNl86Es73IbGxtnJ6yRevz74ixGCn7Mp2Qkn2h4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd04fb6568d-OSL\r\ncontent-length: 596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":596,"size_decoded":1326,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d67cab96aedaabe99af2dec08d4c181f","sha1":"be2d7a204ffa7b76dd51159f9ff357b41ecddcab","sha256":"dbd1acd916b18a1408ab8327c886c39971a7d48cf90244c5cc602e3c0f8380b7","sha512":"431ac66950b068dc97fb4376a0241d93256338cca4e7be6a588445b5999e7d61aef20bef5d5581321c8f1cc1c10d1faacb7929a7d702ab4fd768f1222cfede66","ssdeep":"","tlshash":"80f0413095e2a1598802ff8d2b7615176dd304097582dee9d88239b3915895ae2f208c","first_seen":"2025-10-31T04:50:36.885658Z","last_seen":"2026-10-16T20:19:32.032073Z","times_seen":96,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":189,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wen.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.917Z","timestamp":1792181787917,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wen.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:22 GMT\r\netag: \"68d0ef92-54c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nJ6tdCAz%2FHvCl9nzMO%2BiP9sM3orXUQ6S4pnubqXQqRo792q55QciV%2BfDfeoPqdzUnUq%2B7355SGJ%2BwJfzDg6ozIwoyvXlxTFMBW1IrYdXRQDU%2Bx7dTWgKk7Gprw1lQT4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fcf568d-OSL\r\ncontent-length: 1356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1356,"size_decoded":2091,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7f1b454f2d8c91c82cf692160812b188","sha1":"db16bde22afa68cfff3e3622412cc60b1817183a","sha256":"7233054b48727bb5921efa53c57dc3b69a235cd47f60d6407cde50c8370bb610","sha512":"d0b7b1161c606ad07e006308680f83a981e31188e71319425ee76cf16f3c2da00dee4a30dab6a6ec4fe9d768417cbde051d67f088b11711c2df76cf64a2ff86b","ssdeep":"","tlshash":"b221d80d45b430ecb80270f5c0f4201997e38856aa0a456b1e373c99ac24b19269fde9","first_seen":"2025-10-31T04:50:36.924161Z","last_seen":"2026-10-16T20:19:32.033516Z","times_seen":96,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":214,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bnsol.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.656Z","timestamp":1792181787656,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bnsol.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:16 GMT\r\netag: \"68c930f8-8b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=67AGT8uWlLdnxJBiA75j3A7N10y8z88A9oc0DbO%2BEPrTo2db6PFlhOZ6u%2BSijsciln%2BI1Ji%2FWXgyHVEu1EJdAZP9OTlS%2BLC%2F%2Bu4ho8%2FSvABRjhwvmH0GYNjPBuLrmqY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccde9d568d-OSL\r\ncontent-length: 2224\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2224,"size_decoded":2963,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da523586082cf5a54dc8766a27ba2da8","sha1":"067c52de65e979ac7867cdd27f4fd79d20cce718","sha256":"67e917c2ca6a19c67db370823f20d4b7af0b44a793b1676f4456146b561ed268","sha512":"a35c62812432e7037681a1df490e88d1ae52fcc7ab9d3d0a701048724f95154163860c5b69876119732c641bbddba8bd4c4ceaa1cb39a9dbcda228f6a085218e","ssdeep":"","tlshash":"01415c5e0a73be18db6bf13c5eb69369815150860c8888b7f344dc8a1eb3cc05f799b0","first_seen":"2025-10-21T09:10:44.635424Z","last_seen":"2026-10-16T20:19:32.034823Z","times_seen":100,"resource_available":false,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":494,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/zerebro.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.753Z","timestamp":1792181787753,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/zerebro.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:41 GMT\r\netag: \"68cb957d-8de\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rWmqXy%2BHADLZPor3ANqpFIrLnyhPqdfhSFZ52jhoE%2BJablxRaabwLu5167RLE19km4Pg3AbVUiwKtjbMAavIRCoJL4SKlrO%2FcB0RLMgnVCy9obmHPMhC3%2BQm4uV%2BI%2BY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f0c568d-OSL\r\ncontent-length: 2270\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2270,"size_decoded":3005,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x87, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"561b885c5306e7fe32d073cf86952277","sha1":"24fb87e4e5b82e845ac0cb4f43fad09683e1c742","sha256":"9fda3d3d879bb63173e5b8bfd5c8ca9f29d8d108fdfe9185b0897b41854052f9","sha512":"fbb06d0e5b99de0ad7c45d19e0309afe900887aa68f1c684ebb2b9007533c9b37ad674fd0eb1305c95b473586226c6ba4cc61504ce0841015ff4508ec8dbb87b","ssdeep":"","tlshash":"474129cc54b623e348a0294040ce7bf3a4dd8024f7a300a52bde23fec3b4409780b9aa","first_seen":"2025-10-31T04:50:36.812343Z","last_seen":"2026-10-16T20:19:32.037128Z","times_seen":96,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$collat.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.826Z","timestamp":1792181787826,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$collat.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:36 GMT\r\netag: \"68d0d3f8-2bc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wkbto9VZQiRvAg7D0w2h8g4%2BzVExBqPqvP2iuYdKpVuexolksNCpOynqQocjyk4HDDEtUizOELRPORP4Al0KirzLd2UfSZTX%2FtvoRZr1E9MQHa4wZBnL3z3ifCbNXXI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcedf57568d-OSL\r\ncontent-length: 700\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":700,"size_decoded":1426,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1e2d39790592b230fa4cb0ef8db46495","sha1":"461a6e4414b8855b163f3d5907577db2abf2517d","sha256":"4a6158e2fdb26e242c36c26cd7ce8f8601826cb4a65ed2dc0da708a50a335c69","sha512":"5038700a18f94449122e8e50d802aa38af67ce28c4deb0eedf6c6849074e9528fbddae36b157471e874158841d21f12a89bb84272e4e31d1d072ba880ff23f56","ssdeep":"","tlshash":"7e0194230f5ad013498fed8ae490883c00c267546b2db96a05ca56524197cf359a9300","first_seen":"2025-10-31T04:50:36.909922Z","last_seen":"2026-10-16T20:19:32.038047Z","times_seen":96,"resource_available":false,"data":null}},"time_used":517,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":517,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/opus.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.842Z","timestamp":1792181787842,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/opus.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:50 GMT\r\netag: \"68d0d406-d8a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w2UXc8N1nDvNcKvEJwiGyMUzhEFK%2FCWD7LB6Y82oWDWdCs4qZzLZ23hkVxn%2BYTd0tcrkI5bDuLint3%2B%2BzVDPsBm6sEK0WKhouxEnXEGDJT1PRdtYrXHR9kLq24NiOZ8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f91568d-OSL\r\ncontent-length: 3466\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3466,"size_decoded":4197,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f82b323d7ec4be1699d34f1891889958","sha1":"a8dd04c915ea3791f11e0bd6dc7ea4ea5eb056fe","sha256":"2adf9e254bf61ff1fbb604600213db3aaf1785916eee795f26fde6b146424b51","sha512":"c79c6c0aeccdbebfded28bb1b42330395a79d6b34f1656cba99dd651c7aa5de195b3f9fa4eac5fe0ffcb6bcdd45872d50081af5352ba66d54adfe9276126b201","ssdeep":"","tlshash":"e0616a480ace930502bc59d3049602b1b0ae1dad840b2b39a8196e477016be2a07affe","first_seen":"2025-10-31T04:50:36.915265Z","last_seen":"2026-10-16T20:19:32.038772Z","times_seen":96,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":152,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/rizzmas.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.885Z","timestamp":1792181787885,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/rizzmas.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:16 GMT\r\netag: \"68d0ef8c-dd6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qgrwJGfrqeRjrMzhIeChuH4%2FRR%2B4qRWVyB6rQcfqZw9sekA%2BtXM6z0FdCmmyrQ2Dc%2BZCIoFvHnPlAYPEcYZQ%2FnzqA6dZqEjlNIkWzfbdYDNf%2Bf4flRl3VbXjXEryrJs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fb1568d-OSL\r\ncontent-length: 3542\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3542,"size_decoded":4277,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x100, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e4dcfb1574c971b8e3fa658a636ac0fa","sha1":"d2ed880c9dca730df67e1fe591313b969f25dd6e","sha256":"da51cc2d42b477fbaca7d0a53b49b622b4681bd17e0b873817614eb4542b3a9d","sha512":"80f9f4d9eb2c7fab22e088b1c071b8923e9dcf90814eed690c3d89adbc01ec8026050d9d4e4b34ccf1813eab6b3da81ddc2b6a9d9d71fbd1d1d5805c9c271420","ssdeep":"","tlshash":"77717f13a0b32b4bd4d6401c2cbd67402e7e359258b0ffd4a596faaf0a24f9d4b31549","first_seen":"2025-10-31T04:50:36.945471Z","last_seen":"2026-10-16T20:19:32.039575Z","times_seen":96,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":179,"dns":0,"connect":0,"send":0,"wait":164,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dood.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.919Z","timestamp":1792181787919,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dood.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:29 GMT\r\netag: \"68d0ef99-872\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=azeLfhffvivoZS9FoMIMBROBAk7WbVQGnoG7DIdYmR5ArSRyiE%2FsYoFApV%2B0H2adGYIzxafSA1Rh5NN%2FHMN3hMR1ZZL5EXnlbxJdcOmq19invKzI8cJszsoHKvK5N5I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fd2568d-OSL\r\ncontent-length: 2162\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2162,"size_decoded":2891,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1297fe6884a818c144505682426ea476","sha1":"038f73bb67917d0d4091cb4781fda583553fa2e9","sha256":"c925cc9a1968bddec9180d8d52b3e970190a0e2095f355112bfaaa3a28509af7","sha512":"ff03d0a0c3e3c09820b59242a130d657a85bb84e515d91ba5807d9607488c787d3aa5636ec70d47910374770cf952fc7a9081c8fd276f59b5ff848dad8d5a445","ssdeep":"","tlshash":"c141eba9d89120dccc2eeed67cdca71a49f329e443018f618279560b162a9446d9d794","first_seen":"2025-10-31T04:50:37.000458Z","last_seen":"2026-10-16T20:19:32.044911Z","times_seen":96,"resource_available":false,"data":null}},"time_used":378,"timings":{"blocked":215,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/purpe.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.922Z","timestamp":1792181787922,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/purpe.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:15 GMT\r\netag: \"68d0ef8b-a72\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Htn%2BsO4WBP%2FIYfKiYaevlShdtlor%2Ftj1VCWIN%2FD1l6tPpV3KX%2F9I7I4g58q4d1cnUdgR%2F2IcqUMei4FSpbQ%2FE7lQPtXIEpN%2Bq5fmofuSVz7hM2O%2BA4P%2Bi%2FqWyInpGo0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fd1568d-OSL\r\ncontent-length: 2674\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2674,"size_decoded":3419,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e9fe753e81e4fa8eee49869225c24bc4","sha1":"ea25ec8be3d1a0d0eb7d99bac3e3844f635f30c0","sha256":"92d1cc719cc5813c722fc2878d10029cb7481f9abe20f9245f11b8d1d14aa517","sha512":"709d08020e20d9a7467cfbae80f9e3ae18cd574db1e099f2b0fe0b01b27d7a539a26a2d7268b5e7ce9d94f93fc01f1273ff7f2d6b92e126d1ce765898e5b32a7","ssdeep":"","tlshash":"9f512c5927754bcae2e1333d65819f01fb4bfe3ae0c83f9d84042c776648580772e292","first_seen":"2025-10-31T04:50:36.840474Z","last_seen":"2026-10-16T20:19:32.046921Z","times_seen":96,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":215,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mlg.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.932Z","timestamp":1792181787932,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mlg.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:12 GMT\r\netag: \"68d0ef88-584\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J%2BlKiwtFQwZJ9qMynGGvuJulMFQbI0mT%2FOgP14ibTgWL021cQ%2FA3cSjV0Z6CbgJimSRuEZE21JeA0wE6wl9IJotJZW02Nb8vSEusczdXIC%2Fxm2Yai%2FTT7MCCIUDz2kk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fe0568d-OSL\r\ncontent-length: 1412\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1412,"size_decoded":2145,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2d0197017c923224b450d723188e130a","sha1":"71977059b7a8bd03d4e814605811a7d5040c617b","sha256":"fd24783d813b0bcc8758dc95d3721bed91dd1414dd4feedd17e9e4e5932bd808","sha512":"be2cb492f1e15d85f8d7019309fc699c40b1ca660a7acdccde43c336d0fa2a53b6258ec676bb806220b5564389baf2898ceed56bd9cd582f6c7af7cb60a4b46f","ssdeep":"","tlshash":"7221e9e6c726b8e014d0dc5a6f5cf91d33e75bca6241e2141b4f95b778daa805524241","first_seen":"2025-10-31T04:50:36.842417Z","last_seen":"2026-10-16T20:19:32.048017Z","times_seen":96,"resource_available":false,"data":null}},"time_used":713,"timings":{"blocked":233,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/light.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.786Z","timestamp":1792181787786,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/light.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Sep 2025 04:43:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d0d401-19a2\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tmGAW2WCUhzL8PTBNchGgw%2B%2FP%2FJNM0N%2F7JFPfW0WM%2FpmTtiXMkDM4bGIUFwjjbp4QSmLwxVHO2AiCGT1YvIKc9g5ypqDfl9qXtL1rzVB0yhDTqi9qYBThIqnWlFh%2Bm8%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcdaf21568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6562,"size_decoded":7372,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"b38cf5a87864a49c942e15e59727a509","sha1":"9fdb7e32806dfd7d86a18d56ecc72acae24f822d","sha256":"02a5e4a08fba32575dc694abc0fdc48f8ddc6899084fe013aa79e5b898e0fcb3","sha512":"3a7e0416585cb1116b3cab0692e8cd3efb3d5cf2bbf1ebaf7f3c70e9f82d1f8da8b2f7442eff8a3f10a3a9606e2c06743783308f728c4dce120100ffaa117bf0","ssdeep":"192:Gz+vlUUurBR4waBp0ufxBPH/UeNvtm4VNDUIp5dBzdj:GaKLBR7gfnH/U0UKAIpHBt","tlshash":"d2d1af33975341fe8d8b36906a04c239fc3d9013a5adac5e3f7609e679e3ec54554381","first_seen":"2025-10-31T04:50:36.998499Z","last_seen":"2026-10-16T20:19:32.053427Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/labubu.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.828Z","timestamp":1792181787828,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/labubu.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:44 GMT\r\netag: \"68d0d400-7e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xo6XmRzdC0aaGXKxBcvVQ3mDu9axujLugzVDOopu2K0pb%2Bi2QpEYIzGdexJecu35odt1JTNlB36OCvcYFt2UHnX423vYs6FdUXE0P3xrUE4SvMQu7Lk8vS6dPLvdHbQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcedf58568d-OSL\r\ncontent-length: 2018\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2018,"size_decoded":2743,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x102, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"66b92fe6453089e08c5aa34d124c3a71","sha1":"9b35ca779363181a605cdaea5cfab869b18f9256","sha256":"bff8360d01daa20c09f9b1c98739c124e3807723ff489ec7e802766aa93a2061","sha512":"fe7b3d1c2282bbe7dd0109c4b22daf5b1e5e2f37b6a3ca3b9d698c466aef596ce60e5dd1b0ddd93358a5f8276f4132cb7be5c897e4c3d05b2a1ba0a7e60596ea","ssdeep":"","tlshash":"cd412a11fdcf0d28fd82cb71797a8ee14dc15c937a2086dd0d98904a0a6b8387983b98","first_seen":"2025-10-31T04:50:36.743993Z","last_seen":"2026-10-16T20:19:32.05446Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mnde.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.912Z","timestamp":1792181787912,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mnde.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:13 GMT\r\netag: \"68d0ef89-7c6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Thv8fw0BifHHguye%2B9oBetKXKTkaijpgJv3pS7eV0dV3fMTgiP%2FriKp58qyp6gI6eIrdRk7oSCu6aCBP82qii%2Biqp5MFLuOLFFztyRcMjUqsN2WF4g18gN0gAsksAt8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fcb568d-OSL\r\ncontent-length: 1990\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1990,"size_decoded":2719,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f7913fb42d11902f4930eaa7de026dc7","sha1":"d8711710d2f0fdefcf153bba150d4db5f1bbf5f5","sha256":"874bc1811ae613480506c3c7a6bee811bbe0477a54312fe7a131c173ff599477","sha512":"85a49dca22b3b236af107f4fe8212adeac6f77943db89eaf3d1a938137ed8dc5b3ee5695a317770692ac053ff152198fdc9aeaa266a684437c6eff11c0a1b56b","ssdeep":"","tlshash":"e2412c59b17862074d23b1defa9f63e36c2d2ac26b405740d4c17088a8f2d3629459d4","first_seen":"2025-10-31T04:50:37.015501Z","last_seen":"2026-10-16T20:19:32.057054Z","times_seen":96,"resource_available":false,"data":null}},"time_used":690,"timings":{"blocked":211,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/$beer.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.926Z","timestamp":1792181787926,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/$beer.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:23 GMT\r\netag: \"68d0ef93-e90\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zvXOURaXUaunrMgU4%2FcvF5ST2T4MzU5Sq8tWNcTdsP5qY8bgpTFbOPuvorB3oFIfekBDQDNcRx3p4sKU%2B%2BhGIBt6b5rLazWOtjsBvxxzuP3YGoEOAcUITvgVNCFxU4c%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd08fd8568d-OSL\r\ncontent-length: 3728\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3728,"size_decoded":4457,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"11c8f8146d1bd9ffda9b1bb28eb920d0","sha1":"4a7f9d46444097576330dcbc2d67fde30d89af60","sha256":"ff5c587ef35bc5570aadf0c6d9120d0464a25a269d6b879b2d436464d44f2d20","sha512":"0ee319af73ae6718131927264d3c142736622505a2a5f97a2943ed1ded4ed8b9e1190f0a0f1218cdcb013b9c4ed55d2d35f79d66a206ae220cccec0148f558f7","ssdeep":"","tlshash":"44716b2caf889eb1576faef770bab4d9163344c281452e454db67d022a5fa00e20958d","first_seen":"2025-10-31T04:50:36.918573Z","last_seen":"2026-10-16T20:19:32.058456Z","times_seen":96,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":221,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/valor.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.950Z","timestamp":1792181787950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/valor.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2644-a33\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ynONS8cJZ2LNGSoPknp3STc0w14nf7%2BpI2%2FO1eeD6sCjlCZk%2FyZztgS%2BKHmEfnHLsSjdMwbDXyS5CshIpg5TvSHSIGHSWzXYzMS30t%2F%2FX1NbtAqI2PePR7OnVuWM5ew%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0aff0568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2611,"size_decoded":3375,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"45489a98c1bac4c45028346d626ac0ae","sha1":"e27cad3223052bbe3f77df78cb35f8695e9f6c98","sha256":"4750ac5dbd97f77f3067d455e1330461ef7c9ec0bf5324cef27d9fd232e233b3","sha512":"a460a3d0c208506215e0d0b73027c53e2e670ab52aac2e1023819e59880bfa8bd5fb2a68c546d23aa260029b45fe1c5902e7a32cf09ff3f9e424d9fbde32f706","ssdeep":"","tlshash":"dd5129d787472483f99b38768331e27b25875c6081e21ac563085c47da2e0f56e02258","first_seen":"2025-12-07T05:18:34.054679Z","last_seen":"2026-10-16T20:19:32.060672Z","times_seen":88,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":247,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/punch.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.002Z","timestamp":1792181788002,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/punch.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d94-b7a\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X19jc%2FR0DvUO7Zcc6Yl5nz1USiD4hDprZpcva1ZZSkAfrXoriGoReQFkfktSFrHEIT%2FBNwxLdXbrw4EBD%2Bu%2B0yQIqrHvNkdOFOl8CnrXCrEHXbiXgeznsQw%2Bt9P5StY%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd13834568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2938,"size_decoded":3686,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"bfd594b1e97965618c3ac2d9146524dd","sha1":"c2321066b07752855b284d489a1c8e3ccdb042fd","sha256":"f947817c0873f9038f75c2fa720e3d3c74de87bc4ab0e35080ad42b82057d14f","sha512":"0114098f17cae729fee82136328e19155f51c39a6f3637748b4d46e40d87b0cc740e46ecc8e40b6e469f793c3349ec7adc3369a524277fad0c43364ece90d780","ssdeep":"","tlshash":"df514d9f8725a853f07729358466d320729136c0cc5a675ed091d30f7b4d8f5b8c49bd","first_seen":"2026-03-31T13:47:07.248953Z","last_seen":"2026-10-16T20:19:32.061922Z","times_seen":26,"resource_available":false,"data":null}},"time_used":500,"timings":{"blocked":318,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/favicon.ico","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:29.264Z","timestamp":1792181789264,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:29 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HQJPdWEEzxY4dD5Z5qWoYjCrW3%2FnfziIi5VG5lGafWZIg175fua8L9QAJMULDd1AOJ4Gx0ody9VW%2FhS9kCsfCXZnt%2BFZQtNjAsmYGNcbg4PXG1H6E18NLyZKg8cpnew%3D\"}]}\r\nlast-modified: Sat, 03 Jan 2026 08:07:02 GMT\r\npriority: u=6,i=?0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\netag: W/\"6958ce26-634a\"\r\nage: 1\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd6e97c568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25418,"size_decoded":25147,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"0852ee59bec12689159c352345987cfb","sha1":"8349663b28875435a09ef425cd95d64d5bc21b1b","sha256":"536f8422beceeee32e1021494bc2119519fbc649688da9efbdcd06b9359536b4","sha512":"b38726e698ba80f7cf36ea3f415d68ba92388a1aca057226c1772289d73e12672d6f93084f6c423df4ecbe838d961ea7576bf297b9658a1b8b9e043a16fa0be5","ssdeep":"768:T1+YSPSYeL3kil54VS8WjTmCW7MwVSkGg:T1/SPSYeLJkWj6cwVSZg","tlshash":"48b2e17239b94e7b6118061906b32be42a239ab2b50fdb17554aec41723dfdad13c72c","first_seen":"2025-01-19T12:16:37.598644Z","last_seen":"2026-10-16T20:19:38.081551Z","times_seen":392,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/luce.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.923Z","timestamp":1792181787923,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/luce.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:11 GMT\r\netag: \"68d0ef87-8aa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2lpPC1bBOl8YDHR%2BjDFZ28OV0dPXffw42t0lYuEDoHCJ24E%2B7wChRw0bI3ikYeVNfjIDpL2YqGRMekHXHHeRnOGhl75Tlwtt6V9XpPqHfTpaQasCAXhereDBoUb7Nk0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fd3568d-OSL\r\ncontent-length: 2218\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2218,"size_decoded":2945,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4af966e5a0f96195d0afbf43e0199958","sha1":"68ab84e208214ea2d300519d9b6e373754b0fc16","sha256":"2457fad71ccffbf744ae2d86b1fbbfbe9c05a037328cd29e539816c6f110ddf5","sha512":"0ecb8f5f586c56dadf97d4e693269799494dfba66ba17178263d63bbdff77e6e8c44cee0c45114c5f24cd34697f4f58690bdb111ac140f6b592ff1543c4baf3c","ssdeep":"","tlshash":"eb41f821737abad2c29571fd146d3f80b7882f734bc92257525950360f9d8a55c3b49c","first_seen":"2025-10-31T04:50:36.670957Z","last_seen":"2026-10-16T20:19:32.064047Z","times_seen":96,"resource_available":false,"data":null}},"time_used":680,"timings":{"blocked":216,"dns":0,"connect":0,"send":0,"wait":464,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fdusd.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.939Z","timestamp":1792181787939,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fdusd.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:11 GMT\r\netag: \"692d263f-2db\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XDYhD7kJRahT5QL7g%2BYmVkDITVjINwbMID3xZoY82qftaA3NExibKWFdMOoz5uxPZmjXclUs2uBFvxBVC%2BpU%2FGiwXJPBrEbeMGSM5fxB%2BLL%2Fi3TI%2Bu6iVbvwBkT8G4U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fe6568d-OSL\r\ncontent-length: 731\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":731,"size_decoded":1506,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"4dd27f2418c7f846c74ebdde3911c05f","sha1":"1b52059363c2fefa7ae0095807316f4d0b2e8e21","sha256":"85a30cf0133828dd4419491838ef2622892dc803d03b3fca2416f969117fb3bc","sha512":"40382da8154b04fe23120f3c6bb92f433620b1b5544fd39368946d1af9ca435ae72d2bb94136d969890a58ab4b61246a0df895132e58842d4be3871ec5310bb7","ssdeep":"","tlshash":"8c014472d9b07a0cdaf58031c1b9c5389ebed5201695598b03c0f9f3ab2abc6a097720","first_seen":"2025-12-07T05:18:33.891726Z","last_seen":"2026-10-16T20:19:32.065524Z","times_seen":88,"resource_available":false,"data":null}},"time_used":397,"timings":{"blocked":235,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/skr.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.974Z","timestamp":1792181787974,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/skr.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af320-46c\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UVmOprl2CS2dvEHed9xvvh%2Fa%2BH2HI73GZy5Ki3lE7LQFGLNEszx1jVaeGRQz6i3ZAOLdM6OImhZBD%2F4oqkpuHGyX0bLpBGrHafM61too6m6h9EcL6uwgIlr94%2B1Hfak%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81b568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1132,"size_decoded":1816,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"aba255f632ecc62edc6db500222819e0","sha1":"c3ab5539bd2956d6ca28e2dfecaf93222d2323d6","sha256":"8007e7e4954feb9ada1f5b898c7370e27a2d4e89ed785f3e9ae96e09d0c68036","sha512":"3c6d56b15c2d5bb130a548e876b1575d576925e5ead242f95ab48461a16d8e2a05645ab094d5b085120420d57f5cd71fb314704947f54b9605ab872b0a1fe83a","ssdeep":"","tlshash":"312186db3223c00bf82f0c734ed9e6b4a6769d15e410275ca757410ab8de3c99441d50","first_seen":"2026-01-30T00:58:37.96949Z","last_seen":"2026-10-16T20:19:32.068046Z","times_seen":48,"resource_available":false,"data":null}},"time_used":757,"timings":{"blocked":285,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/zbcn.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.999Z","timestamp":1792181787999,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/zbcn.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d90-f2b\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BXHdve713ANyG%2BCky6A48KeKMDEtZJ0J8h76J9xJ7TQ97P1fxrPpnRB%2BAqhA0LBmN0ENY80MQDtQRfbGwXDEFCYuudK4soXPAidJU60kSaV%2F5ZQRr%2Bg%2BzigYULuiNaA%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd12831568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3883,"size_decoded":4687,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"6617ecbbcba046d56b0335e5a78ca8b1","sha1":"0fc395a01a503de9950c18107257b880819ad483","sha256":"9c7daf2731e74132d6a801a733740ce0a45dcc4f4d39f85f11f316cd34dedb2c","sha512":"11f7a6b0ea6ba152eabebcbdf73c8e3b3caa3d1d5c0b741321e277f9ecb3a2e3339d18c17cefaa4e2a4e041314b47da5206212bd669a4f36816abb366d556c6c","ssdeep":"","tlshash":"a5816c7466288f0fc1e346b02dcd2cdad8b88c0274c182124ac79996cd2eed2e54cd1d","first_seen":"2026-03-31T13:47:07.237134Z","last_seen":"2026-10-16T20:19:32.069238Z","times_seen":26,"resource_available":false,"data":null}},"time_used":811,"timings":{"blocked":314,"dns":0,"connect":0,"send":0,"wait":497,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/SpaceGrotesk[wght].woff2","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.328Z","timestamp":1792181788328,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /SpaceGrotesk[wght].woff2 HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/main.php?type=css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\nlast-modified: Sat, 03 Jan 2026 08:25:21 GMT\r\netag: \"6958d271-c068\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zzsoUZpdkyMWdSzqvCMRcdWqF6ErHSMHKfK1t67m%2F8Kv6FCmxEFTAZiHfmYo3iW8UROpSD5cweYft%2B5z%2FYeshr5%2BFaNc0yhuZYuYFgSn3y2vxAFdyEPB%2FlnZ%2BRWWD1M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a4b9bdd1383d568d-OSL\r\ncontent-length: 49256\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49256,"size_decoded":49996,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 49256, version 2.0","md5":"0c62a8f36c27538912ccbbd5de747927","sha1":"b4509f04a2bed1ec04e7f9ff4dc33c69e8e263ec","sha256":"8e085aa438094f11487a836652edd5c054fa6a96f63fc7c282105ee3a4b08c07","sha512":"a67cdcfd2c433321dac9322b221ffa7aa0eab3f0258d7975c84e891eddea41fd456ee3c6f7e67762853e023ba0ccd3d0586d5d549a63fc0ae4ac62f7533dc074","ssdeep":"1536:pKXTCNqIqI29JkBq+zhVpQ0n17Bwnfen623:pKXGoaWl8y0nPwnGn623","tlshash":"a123f1ce649a7d788870eaa31dd73f146dfc984389d6e6e1e1c2da8d21c971809e434b","first_seen":"2023-05-23T06:00:59Z","last_seen":"2026-10-16T20:19:32.071235Z","times_seen":600,"resource_available":false,"data":null}},"time_used":471,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":318,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bome.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.690Z","timestamp":1792181787690,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bome.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:28 GMT\r\netag: \"68ca7a8c-722\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VuQoilrBdSMPu7AjderGCXaRoKrr%2F%2BZT3BgblNYT12eGAo8ujpfX5D9JDOt3Ei%2Bmc%2BuYgE8NLOxirDhKg%2F0A3ywwwVeksA9X3GcOoz%2BBOu7GTidqirWfgijv3g1U0Xk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd0ecc568d-OSL\r\ncontent-length: 1826\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1826,"size_decoded":2561,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2ee67630ca27073e70c283c447eea7b4","sha1":"bd0187a7b56a22b45a27d26c34a81ac78581c2b7","sha256":"2be94ec238847e6b6e13fc98cf9788e9862a94d6d13271732980a8c949ef9a87","sha512":"198fdad94f808243b485acf62ec4c9fee7925a52aa5b5e5d1d34f5032660b601b1c9beac484b46fed77d399f20ab6acf84f0993957f52832ff1e250726447364","ssdeep":"","tlshash":"38310bcd2f269469e31cef38580d1397129623133b588c5bc04b9b368da743bd3ec9a1","first_seen":"2025-10-31T04:50:36.898848Z","last_seen":"2026-10-16T20:19:32.07529Z","times_seen":96,"resource_available":false,"data":null}},"time_used":484,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/troll.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.712Z","timestamp":1792181787712,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/troll.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:26 GMT\r\netag: \"68ca7a8a-700\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nCPOiEd%2BLQ%2FfoegCoVFJ0JTsTY8nF3akPHFsWYK48yQunkEqkYfaKTEpPQ4xGzchIucjq0lWEOjd5qElCx3Xs71EV8bJZahxMnXLgqeG3ZlgCE4n2V2l87pbictBa0E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd2eda568d-OSL\r\ncontent-length: 1792\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1792,"size_decoded":2519,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"528183630197f8e82650294afed69ef2","sha1":"a7abafcd8d1da40d5f7a2a343fe137157d6fa324","sha256":"8d449425955cbd61d9cd040b45ec07808e9ca4b60a4502c89baca4836a1de543","sha512":"7515606f9b0d0b290ede4ebad082474b9189ea5080cc9c2caad2d562da4d17571c98f1eba86e7cde87476593dfcc8d54631fd1bfc8575bf6e7fbb506f295d75d","ssdeep":"","tlshash":"4231095309080689e139917ce8312b0c5822cccdf15367b9e321ba80de2b6cafb2c948","first_seen":"2025-10-31T04:50:36.983039Z","last_seen":"2026-10-16T20:19:32.079454Z","times_seen":96,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/kmno.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.742Z","timestamp":1792181787742,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/kmno.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:46 GMT\r\netag: \"68cb9582-306\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=51pRwKQfp0KFkPGeXExEgrDwdle8vI%2FzOf9Iul%2FYCdSvUK4uQgf4boB1lnxKouC8INdUTJ2yFE%2B68hIcS9Wj464F9SRLRS8GvLA1W2hNONhU7GDOxOOs8uqpFrcFiuE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd5f03568d-OSL\r\ncontent-length: 774\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":774,"size_decoded":1502,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8d087375b58ed9f89c5fe8645b9e243d","sha1":"d40352c1a7a1a82e2d5154a74576cc8082a86ff1","sha256":"2e5af2b1a8a1be971f6c5b2d6f9862692c6872fde421138b2370bbb2b9373bad","sha512":"ea2f32726997061c2b57a105784319e4554115cbd19eb89b30e72ebffad0103a604dddc94c93c59607caaa135dc976598c36bdf55317f43b3a0adf3f453a341b","ssdeep":"","tlshash":"d801c59803a02ebcd6249262075f3bcb0ab024c384f3dc21d5f68f9603032725d82912","first_seen":"2025-10-31T04:50:36.920895Z","last_seen":"2026-10-16T20:19:32.080677Z","times_seen":96,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/ava.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.759Z","timestamp":1792181787759,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/ava.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:43 GMT\r\netag: \"68cb957f-a5a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=89NhMR281gYy8yzE2Ybbj33owDHZ3ZSHOp3cs9kcz9w4aWqUI5q7Ziy6Nb%2B3vkcMVr%2B%2FHE7L%2B3yEWvu1m3ALuu89FlNA60xDeyIzI2z7SK52ojFHh4k7Xr5fwug7u6Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f10568d-OSL\r\ncontent-length: 2650\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2650,"size_decoded":3381,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x82, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c6eeb0e7247c9ed1df734ae909dd50e5","sha1":"87e951900ba24531b5b929ae992b257a93234380","sha256":"cdfb2ffdb5a7bd9a452021a295f620bd7f2240a64c6b7387e16a8ca87cbc60eb","sha512":"47e614b639e8da59e6d0943184da7769c5117c311c3cfe6c434aa7f2015143e9bc98ad9eb7ec4736bddc52805593c2605977dec49c63c439bdacd01a2d6dd017","ssdeep":"","tlshash":"dd510c7515baa121d7b80f0c12b0d760e6bd4e9d7a850e47856f85d13a32c2be53b60e","first_seen":"2025-10-31T04:50:36.908682Z","last_seen":"2026-10-16T20:19:32.081806Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mother.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.783Z","timestamp":1792181787783,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mother.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:47 GMT\r\netag: \"68d0d403-3d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rS%2BUM%2Bp3Q2hrbu6PFOVynKB2F8WFP7ehegMVVhOnbUNZaR5TstpD4iRhU%2B0YmUzpF9ndKUjWgBJ6gq1iO5rJ3h7s9tMeL%2FQz1nJIfTDRnho0CNVmtm9LX8ouAo%2B5Ypg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f1e568d-OSL\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":982,"size_decoded":1714,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"de59bafc67eae18d72ecb89f7a7e00f9","sha1":"23f716ec598721770f49b3ac3f7e2d35f1e33db8","sha256":"3abd20803b07f846753c87772a2562e0a56f492b088d5bf205c2ba8892e8da90","sha512":"dfc552a291289a9c731640b0d5a5f6c838e608738cab06f7735ada7fd5f6c943cf28409db350e0d68ee1deaa69097b256c98a34ced0805cd463d732a26f8c63e","ssdeep":"","tlshash":"001108c0cb887c10cdbd09d71d36c8f324f7a85b0af5ada81e419ea24338124c11aee8","first_seen":"2025-10-31T04:50:36.997651Z","last_seen":"2026-10-16T20:19:32.083401Z","times_seen":96,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/main.php?type=css","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.800Z","timestamp":1792181787800,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /main.php?type=css HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:27 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1hiXZlsK19fqD2zHoZgKxxYBW3tp4fuvbcGCr1%2BVP0veNc6Q%2Fi0163dIqUJH30dldYYZ7tpxUbebd586Lu2a9SiattSSbyfu363D6bdIQpjujlS2b01NY5zYxjr2Tzs%3D\"}]}\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcdbf28568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20489,"size_decoded":6555,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text","md5":"4310bb97fba506d8ffd307bd83ed3dbb","sha1":"9480f25c08d76c416f6ddc332a908bbf68c9eacd","sha256":"6a151d173b63bc31237c9461505f833e4bf4b6f1cbb448da1eb8a2352ff7642c","sha512":"3fc6d4ae98b9bec1e73437f8be5d02da56cf78c7758acdcbc246e5aff455dfa93dc35f8545dfae21b249ac249c2995ad0bfb48f8fe83f9584bf96c752ba35993","ssdeep":"384:CnWY8YVUwII+QMxy+xnzvgfsrFEzuupjLX:CnWY8jwI9I+xbgfsrFEzugfX","tlshash":"5f9294da2ba600053527d4a477939fab337c8607c10addbcbbf5605c9f893dd91a2788","first_seen":"2026-01-06T13:36:10.186069Z","last_seen":"2026-10-16T20:19:32.087675Z","times_seen":47,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/lockin.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.858Z","timestamp":1792181787858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/lockin.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:45 GMT\r\netag: \"68d0d401-548\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CguqJ8MtW7GIXTdguIYSQRJbdluOlF6zlGfX6SYIOSU0s6XBiqgSVjRxXY83Ozrk2cmTq0e0miBCJPqSDkMTLzx5GTyiGGiYNjFshLUq8StlSjce8mVICs5NpmIwty8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02f9f568d-OSL\r\ncontent-length: 1352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1352,"size_decoded":2075,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4cac29be575138c633b92bf3b8ca7dab","sha1":"51261b4aee9febb55ce3f25c08b7177edd94f8af","sha256":"35cb82fc5d9ccf5361ff72e19636bccd9024e26215ff586eb7b3573b2d121ac8","sha512":"411ea7ba31c76a78806d93d6b2a621e1149e556aac51f2001fd03ad8ae6e753b088b99d11af772449a562102340feca35d4d8dfca7860eca724f0bb8283403bd","ssdeep":"","tlshash":"6721db1d312f84106f81aed7205ed664456d747c33f7c9b8599ac1862fec89d616c23c","first_seen":"2025-10-31T04:50:36.941171Z","last_seen":"2026-10-16T20:19:32.089425Z","times_seen":96,"resource_available":false,"data":null}},"time_used":342,"timings":{"blocked":169,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/titcoin.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.866Z","timestamp":1792181787866,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/titcoin.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:21 GMT\r\netag: \"68d0ef91-4dc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uQV9xEXlAMvcdTAFt3fyvApNNhkdLdRbvnrt5LFqnFOaDZZnOIacIv6ZOc%2BHT0m8mc7FjiKlWmKlkIv0IF7Mn1vr2w7BE9E8sS52okgG2JsRydYrVxZNNqvkCTBprHk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa5568d-OSL\r\ncontent-length: 1244\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1244,"size_decoded":1969,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2d65131ec0d2b3cb9adeee59f8100c6e","sha1":"ce05cf7315622d69a0bfd3a3b8ab1ea9f7170ad1","sha256":"0a15d28e38f82c33090e8290cf9a4e43277986ab438d51a19ca8913a1408c298","sha512":"ff2a5151e231bd4f384ff2f9bfe88caeb9e2549921846622e9451a21776a54f704e6b7694f19ad84dbac75e51549e5f371f614a730548fe75a0352752aeb3add","ssdeep":"","tlshash":"1921b73070ab9cd6faa1e19208b8544bcbbb7ce40603ae6e08fced1405f42082558f93","first_seen":"2025-10-31T04:50:36.804576Z","last_seen":"2026-10-16T20:19:32.09042Z","times_seen":96,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":172,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/mew.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.688Z","timestamp":1792181787688,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/mew.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Sep 2025 03:50:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68cb818e-eef\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MiVdGsixkMG14Zxfd3Z7bbTaTECc%2FCwqRAwdquSNnqRm9Mm8%2FpuhbLp%2FlLv%2FpXPNpK2n0RaFfQGpkyNG4nAcAeLIabEoBDwn63PN66hvCwXz5Ik8H%2Ba7q0lTqf6vyr0%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcd0ecb568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3823,"size_decoded":4392,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"c68928f589405abc4ecd6bc53c28958d","sha1":"d99491e86f5e76c981dc5383698cb5f3f63029cf","sha256":"3093e3a988753fae305e52cb8208bcefc2908143c58e7088faf6f382ac0594e3","sha512":"bb6833f6c0566a5196a38146417e08791f50a66311ad673ba3bfa8e878680fdc9d87958e7ddd0d1a4dccd06be53d7bb591a15b5718ef1885ec85422d13aae1a2","ssdeep":"","tlshash":"4e717e3245d9c0b4f59608ff385a127ded0c9f601602908b15dd7d9f7db619a84d225c","first_seen":"2025-10-31T04:50:36.696443Z","last_seen":"2026-10-16T20:19:32.091481Z","times_seen":96,"resource_available":false,"data":null}},"time_used":503,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":503,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pythia.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.746Z","timestamp":1792181787746,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pythia.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:51 GMT\r\netag: \"68cb9587-3d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Aq1TD4sLvmEhwf1wDEdaWNCEROYHdduXBwnXdh6el3fy4oE3irpQfYlaGKZKLSPKE%2BW7qV8dyFpru5XmTLtbM6X727zV5U%2BHmaNkUkTnp0L8tnRkMT29BJAMamBj13A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd6f05568d-OSL\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":982,"size_decoded":1708,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d9b22244032e62070307c6e6a9babe29","sha1":"a1426181b6d9c374a675a4e13d1bede255fec9cf","sha256":"2ce1185fd5a956399ba52422ac237c7102a1b19811d02aef074db14fe1d94df1","sha512":"1784d5bed2e8815adbb673b709ca5ecf6be35fc2209a449d4498027b250108c91f9f1b650b1c20ca2d566371fe852279fcd7d957d1d360a66d8591ddb5ec3951","ssdeep":"","tlshash":"0611cc664a2b28b5f1466a0df13d6d078c21856cc6fc1de46819bbf30cf0224f1b863d","first_seen":"2025-10-31T04:50:36.827315Z","last_seen":"2026-10-16T20:19:32.093814Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/inf.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.910Z","timestamp":1792181787910,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/inf.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:07 GMT\r\netag: \"68d0ef83-5ac\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1S1MJS0ccGa39EcTGCpoQQvoOuhdHwMQec%2BM%2FMzXEDR%2B%2BjzjAuN0g8jramJJh6eOqBG%2FNSL%2F6g%2F9cZhIcNCIvame3YjyYBK4E9ImyXeAaaCsF%2FF2ZYW6%2FFW36tr%2BKR4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fca568d-OSL\r\ncontent-length: 1452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1452,"size_decoded":2195,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af41f54c78107245839582192d605eff","sha1":"9c582629ae17ff97055687cbf04800c46b580817","sha256":"156c2a35fb76cdc56f6914119b4cb48855b94e8edbd93aab51e2bba98530e675","sha512":"69570102e2540b82d088e8506ba33f6c3e5b0c5125a3ba1cd2a914dd775af3cc780da61f2b590e9880a42a837b4827933c458f21dc3031697708e3df5968f513","ssdeep":"","tlshash":"6631e9102d75bf82e025770b35bc30489b1f29f5c69ccb2090a2e725196411a8e37eba","first_seen":"2025-10-31T04:50:36.856777Z","last_seen":"2026-10-16T20:19:32.095257Z","times_seen":96,"resource_available":false,"data":null}},"time_used":374,"timings":{"blocked":211,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/penguin.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.969Z","timestamp":1792181787969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/penguin.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af320-511\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jj5YJ1Wh4YqLx7BykvRUEsxp5fnaGWDHIXI8BdMJlsb6jTFQ81umBT9KFm71KFqK0cKjJmvK5T6EM26OLHwgIjmO0WX%2FHeU15lGYGfxd9rWQk3LCchHKErV%2BXOsC1R4%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f815568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1297,"size_decoded":2004,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"a06a33bcb91d2394cb305883740a2623","sha1":"6685fd952a9b02f520e645894c08d7fd14a289aa","sha256":"995c0f5569f6a5edc57df147eb4b2469a18300f7a408297591489466cb715f43","sha512":"359fcfa0f98d8bbe2ce43576054daed85cc2ec1f9b03086dbab12cf8d5ef63a6d276a43710d2e5474bd5f569af4362a0ff1ab38fb98de3ccfb80a467c21849da","ssdeep":"","tlshash":"a121c8938738ea2bf1d50636480cd22542422d48d2185e2fe691d346d924af57c429d1","first_seen":"2026-09-19T08:07:19.842274Z","last_seen":"2026-10-16T20:19:32.095984Z","times_seen":5,"resource_available":false,"data":null}},"time_used":800,"timings":{"blocked":287,"dns":0,"connect":0,"send":0,"wait":513,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/buttcoin.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.972Z","timestamp":1792181787972,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/buttcoin.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31e-74d\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FKwOT%2FNhekvwmhhbRtnYCNm9ue1%2FdFToplMfQoSikV0Ha3rakaDtltP3M2AUU%2BRo3wCH%2FR7WiRpuwajELO9XP2VwBQyAsMVKmSr8VrJvi7nVKXnWb64hJ%2FBihp%2FcIKw%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f819568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1869,"size_decoded":2631,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"95e35c1606ab201e97d4193db5d2913d","sha1":"ffad5f8da70fe88023dfb1f883abbf2bf2c483f1","sha256":"f6616063c85e88b149ac5b5f61146f82364e0f8f72f64631329ae6e91d895468","sha512":"191419fd3473f438f761a46e5378e8324f2a6529d87ad4b4fbeda88dbb239fdf3412fb09b0de3ba062c7efee997aba2c830dd9569422ae86c06d4e381e270eec","ssdeep":"","tlshash":"2731eb96521edc58eb4f537dc04a77a84b5b321a922012381e9d2974f71bc77e871326","first_seen":"2026-01-30T00:58:37.975258Z","last_seen":"2026-10-16T20:19:32.096642Z","times_seen":48,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":285,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/crclx.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.004Z","timestamp":1792181788004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/crclx.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 06:52:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca1d92-803\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bCrK9OrfU6AKiEQUu3NHZJyy41BxP%2Fzn5A5LHrE%2BaVIjbfYwuP1goNVx%2Fz5LcoteJYY0e9u%2BYtWw2bRGUzmYu4GEwEC1Xw8sRVg4W0n9NS0clSVdsVNMlcNJLScEmCg%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd13836568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2051,"size_decoded":2851,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"2f7cb62b1bf09b2ed0883636ce56086c","sha1":"02fd71c4416b947446b9daa5d1d2c9cc85b89504","sha256":"cb527b6514ae983597ca9e451160b83a3f0181ae64af5de2fa26bb1240967346","sha512":"9068ac58fb5f065e30fee1c57911850cb4614d838daae192b22fe21f3baba0a65080665cca610bb991d49324b777e6380b08c6abdc6fbf82a227630d3b80b427","ssdeep":"","tlshash":"92412c707cf51219d43a8c2bd7846106d6b59e8f307dc63242618c7553e3d7098de25a","first_seen":"2026-03-31T13:47:07.064388Z","last_seen":"2026-10-16T20:19:32.097423Z","times_seen":26,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":322,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/griffain.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.730Z","timestamp":1792181787730,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/griffain.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:44 GMT\r\netag: \"68cb8ef0-1a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c9%2F5KjDR2O80ikkuZksDuz5HZmKQERk3D0IY1Ac0%2BHDAd8Y%2FRk1nnMA4WdGIlK4J1wF%2FIanX9qpmzjr5h6RRGSN73kJX%2FLlReAXmo%2FUDG2U6QD8brHM8OGdy6IQAy4Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ef5568d-OSL\r\ncontent-length: 422\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":422,"size_decoded":1156,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"29145c705a6fc62bc642f42311aee369","sha1":"5d541626f54b8ccb493c23341637f486b6bd462d","sha256":"c06582e29bd4e36422b53e335b968e12c62740081d02430fc073cdb6d44ae5b0","sha512":"c8fbab0fd8462ed697e9de317bdaf7a39368dce3d59ab0cd5b7bae2e98abf090be5d137b4d25dd47390c50a503cceaceb772cc429429b2621b12e2402fb8d6ae","ssdeep":"","tlshash":"33e02343410053a1468667b5033c33ce03c16d03d883d359d97623990c895097982c72","first_seen":"2025-10-31T04:50:36.974284Z","last_seen":"2026-10-16T20:19:32.098205Z","times_seen":96,"resource_available":false,"data":null}},"time_used":506,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":506,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.642Z","timestamp":1792181787642,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 28 Jul 2025 04:49:58 GMT\r\netag: \"68870176-698\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vYiMgiBnMCYvQ65FHKqxNX1scLlucFuqdNfyzCxprmj1FR9u%2B9oJih0IxXcdcKSO6RIQqElk5McBe1SHzcwSv4zhzhNRUyFrE4x6%2FIsyz0hG0WZq%2FTrO31C4p%2BZ%2BnhQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccbe91568d-OSL\r\ncontent-length: 1688\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1688,"size_decoded":2421,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f27c42676bc602022b1c1ee762139caa","sha1":"f8b4acf342f32da78bb4f6beb259b1cb4be1c529","sha256":"669f3fa9a24239a660cf447c65a0084deae11860bdb986ba8d9a590ddcda5723","sha512":"7ebcd922fea97b7fc2ece7ab81936182149413ba27ca55a7e975dc32f09eb86bb2d87615d8fa04b6380d708c931ffc775c920a458c7b8617266a3c565cfb9dc6","ssdeep":"","tlshash":"f6311dd9c3dd55e0d161d87d497313b454cf1ade3509acd01f6f869700e59f2610d875","first_seen":"2024-12-23T18:04:32.267995Z","last_seen":"2026-10-16T20:19:32.100182Z","times_seen":331,"resource_available":false,"data":null}},"time_used":503,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":503,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/moodeng.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.706Z","timestamp":1792181787706,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/moodeng.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a90-70f\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rTCbiBEXxTy6QkFjf3pS32FSKWzcojbF1EcaIkZatoujh7DtXeYRgdWcQIiPEKRPAoD93iQcJKe7qOdOcd8MSw0VCJGul4nVx6N37znvEHV51LmkvQB5EofilkBMqco%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcd2ed6568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1807,"size_decoded":2599,"mime_type":"image/png","magic":"PNG image data, 30 x 30, 8-bit colormap, non-interlaced","md5":"1660266f4355411ea70cd86c699cdee8","sha1":"4e79db7f905891f73d06729ae502f945abf9ba82","sha256":"d4c940270a96d09665fbc3653e8e5542225e0204dcd816b38a3c1eb42e33ad03","sha512":"f2bdea284c579d0ae8eeaad1cc98ab0c6ea3c057474f28f0df982bb63b579201c5390579567b8d6eb6b1ea180384624cbd928adb839b9fe7b6be9c7c2127706c","ssdeep":"","tlshash":"c8312d92f304ebe45f7a4870e210b385f630354ce64ad75c78c1957eac5961910cf7b1","first_seen":"2025-10-31T04:50:36.961031Z","last_seen":"2026-10-16T20:19:32.102446Z","times_seen":96,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/nub.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.764Z","timestamp":1792181787764,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/nub.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:48 GMT\r\netag: \"68cb9584-462\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gMtiB8%2BPPXIEZSSbM5c4S4DwSdaaxe3Iy2wPy0QCiyBTvWY843p8ik43O%2BzEQtzklVkBhymrERl41jEK0XPs4Va7%2FYmLvjjkr6InQdJayb7If5GnnSYf6HQmFUtlQJI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f13568d-OSL\r\ncontent-length: 1122\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1122,"size_decoded":1851,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"48d4b841849caded28441c9d0927d581","sha1":"20c804b45a3b783ac6d90d517d3ff3fcc9510f1f","sha256":"cbd6ee5250caa8b4396786a77a020cf8e9da855ac11165baf341abef248404b7","sha512":"d536dc7044aa6a7d81db6c4daf7f1fa22af76ed262d9cdc2b47bc4451398ef416af5f65b7cd81293733c4bfd04f208b3606c9c71818ce75b0c2dfa47efd0b95c","ssdeep":"","tlshash":"2221f982093356cdbb606a648ce20f49454648fe4dd644d8f643646f17d02e7f30005f","first_seen":"2025-10-31T04:50:37.003074Z","last_seen":"2026-10-16T20:19:32.103193Z","times_seen":96,"resource_available":false,"data":null}},"time_used":487,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":487,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/me.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.767Z","timestamp":1792181787767,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/me.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-3c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bCYQsjc462NeGgbJNkkbKyequ2xQOA9fJ9u6bjB8FiH0PM5MSt2MCeu%2FdXx4JNKVZNhaeCRTb4NCyokOsUytfGWDasRQ9fOXulht3vtjqbeYsjFC9L43obVeTzjMtqY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f15568d-OSL\r\ncontent-length: 960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":960,"size_decoded":1684,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0130c3f750a129088a5033fc0f5712fa","sha1":"87e5a1a36df391d9eaf76c188df1cac96f2d2aa6","sha256":"90b50a4cfa3e1aab959f841dd001e9a55caa9db7c2592cb8c73ba5de550c4d55","sha512":"1932496793ac9db6263a7bf17d176eb955857e5d9e63c3725bfbfca5002b0045398a5a6a53d8f4d89c670259b5211c9e12ed1adc3832ad842b21163f906fcc22","ssdeep":"","tlshash":"8911c887d24aa12007727c362c3965ecac38d07c80a864b38254d94a5d620e1b7af0d9","first_seen":"2025-10-31T04:50:36.776833Z","last_seen":"2026-10-16T20:19:32.107983Z","times_seen":96,"resource_available":false,"data":null}},"time_used":507,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":507,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/rfc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.868Z","timestamp":1792181787868,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/rfc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:16 GMT\r\netag: \"68d0ef8c-b6c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KCcFB8mLPtuuGHAOjyCsv1cg8eqOjHKlgIZW1hvuZE4OqniDsRwgO0zEihCelBXmERskZXAU%2FyObAUHaj%2FN2%2BLqfJEiHezYfYHd8%2BE3OiRWhKB9wMTcJTmR2Ls3whVY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd03fa7568d-OSL\r\ncontent-length: 2924\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2924,"size_decoded":3655,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"939cafa9e0b39bc1b0969d27c9d17bc7","sha1":"312209a1a451ec09ab8f7d822db00a88aed71745","sha256":"d84556ce0d006366ac500ccdc57b32832f0ccd8a8d9e273e94147695c3135443","sha512":"503931850fc12da77b378d91d871420a35003b027972c0fa3ae17a8541368ccec2d26df77b3f9779115b8445a27ce5a4d00ee11277dd3234e2f2b58304bddd9e","ssdeep":"","tlshash":"8c515caf5328586fdbd72a186fc8a088010436b5990b9ffd9953ec26e861549285164d","first_seen":"2025-10-31T04:50:37.014578Z","last_seen":"2026-10-16T20:19:32.110971Z","times_seen":96,"resource_available":false,"data":null}},"time_used":649,"timings":{"blocked":175,"dns":0,"connect":0,"send":0,"wait":474,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/would.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.914Z","timestamp":1792181787914,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/would.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:23 GMT\r\netag: \"68d0ef93-bba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yfJJhWkORbB07uFakFIUp5epTV8WrwtFe87GFhb%2Fm9zL1Cxn2Dk%2B%2BhGZ8ItVSaX0uY9lXFaRSLnmAeJrLSZ15Gep36dW5O7BOctNOLXluVYHUzWGYZOKspHiA9zTH%2FM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fcc568d-OSL\r\ncontent-length: 3002\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3002,"size_decoded":3733,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ba1a4becf98f579c821fa53538f382ac","sha1":"f64b33755bcc063fceb095ce0f2b63ac4275e172","sha256":"962a6abf3677dc80a5417237318ebcf9efb0275329b826c36a054f791b2b8e65","sha512":"00f2a8e21e69f4166943f8c6a9172f88840462029119307a4644e384694de04ee80c20a5572c38a2ce3e95e165369e813ae0f45a40ab07600305a7c904f98af2","ssdeep":"","tlshash":"2c514d5fdd1555a54f53f871fc86362b8623d350e77ae710948481020c3ed7e8d51327","first_seen":"2025-10-31T04:50:36.692637Z","last_seen":"2026-10-16T20:19:32.112657Z","times_seen":96,"resource_available":false,"data":null}},"time_used":373,"timings":{"blocked":211,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/aixbt.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.853Z","timestamp":1792181787853,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/aixbt.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:37 GMT\r\netag: \"68d0d3f9-a58\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BYN6NyllbR56AFetU8La83S52qrrx8IrhkOs3bLskFDM2Sa1AwOFi74UXoljJ5Dt5Qi6K%2BiyjNJzRieZTfe1iTKLmp3rW%2FMxKkt0kUpdUk%2B3tN7IY165BT66xbVrdBU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02f9c568d-OSL\r\ncontent-length: 2648\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2648,"size_decoded":3377,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba80d8499e7a1839b58a51f036349658","sha1":"037cca9a4e95739b0af0a9f54315a13788e345d6","sha256":"60ebfca1c62cf79b9e64c8fc0bb76750567d3672773e229e8d469a41db2ffc67","sha512":"98ea48fcc95f3222db5f26bfb996d3f3c8ea1d0fa11bb5b024852cca705aa43437435f7c55e6d2c28b32476b95f8cb2bab5c18e97881f1c89ff7da5c935920d1","ssdeep":"","tlshash":"9b513c6b091649fd4e32fce77b9cc7002642156f6444ee46701bb4e1842a86979774d4","first_seen":"2025-10-31T04:50:36.703863Z","last_seen":"2026-10-16T20:19:32.115857Z","times_seen":96,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":166,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/grass.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.915Z","timestamp":1792181787915,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/grass.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:04 GMT\r\netag: \"68d0ef80-610\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=avFDL%2Ba7CnoT8KIusXXMO8oSL362aStkPp8BsGEr9w2vSrIQCC6Z2vixanWGQs6flzVWqDJhbe%2FEHiWPG9tdmOmVzIMUQGqlU6QxZh661dui0odIvIo%2B9KbnO18bbMo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd07fce568d-OSL\r\ncontent-length: 1552\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1552,"size_decoded":2281,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cf35534f81d1de514005ffacc46e4f48","sha1":"ce44c88d20a069c766ba6186521c31d6d25b58b6","sha256":"ef5b8f13e21d4448cd995466a8635adfe1715d9e35e8a9469077714ffee77c7d","sha512":"ce04a99e815dcb66474fb70cdfa09b068d4c5841aab9f987bd581f1264842ffc05ada232223ed4627287ca79eea63af509bd49ac3af387dcfa05b387cd16ab5a","ssdeep":"","tlshash":"c131dadc6a23c941d77d653dd5bee3644892b816714354355654d0b0e0a73c38820de5","first_seen":"2025-10-31T04:50:36.784401Z","last_seen":"2026-10-16T20:19:32.118395Z","times_seen":96,"resource_available":false,"data":null}},"time_used":692,"timings":{"blocked":213,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/io.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.955Z","timestamp":1792181787955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/io.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:13 GMT\r\netag: \"692d2641-2e1\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N%2FtxD%2B5VnbVYNTJIcnSo2Z%2FIgLrjPrGRr%2B82voY6%2FRdlviMQ9TWqZIbypvsgFAi6pmPgbWgjd%2BNj%2BO5aSzOB3EzCCwEN4WCY2i6oiAjF3vcmyamnP2OuXu%2BwsCNYgqo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd0bff8568d-OSL\r\ncontent-length: 737\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":737,"size_decoded":1516,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"ad5ba629bc0215ae0e7c3619579ff11b","sha1":"75dd539e081d5f7a67d066a1421b2325af9ebf98","sha256":"87364d9f768d44815056212498b70ea771bf72dd504f6e35f1810cbc4c485f54","sha512":"3679a7299e9969e8d01ec11cda3f8ab4d203dc351bcb163257c06373120bcdcb5b58308a2ccfe7b256f2e8339a8eba141ec9cb74d4407981f318867136ece1fc","ssdeep":"","tlshash":"280144b3ce5e6711d8d4cbf0626d6ce5dcb272c1213ab412cba1a231618605887f1707","first_seen":"2025-12-15T19:53:24.970328Z","last_seen":"2026-10-16T20:19:32.119465Z","times_seen":87,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":253,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/hehe.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.958Z","timestamp":1792181787958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/hehe.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2640-6ca\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h2eUcwKmgv8tlO9uVY67ZXpVDFf6Egov4TjwbK0Y4ye%2BT97MZxwV8UKGC2JDHp14rAHfYK7df4uFXrzBFJYepZJdSvt1oacIZcJcK0CG%2FRDUDXol2zmA3aengWLaMlg%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0cffc568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1738,"size_decoded":2464,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"82b8d514d6ab6c35d7bf468f4da5b6a0","sha1":"8225fe612ce47554af8a45c2690c60dc1aab979b","sha256":"f1ae8a4214e3d2b37fc125488050b0cdda1dc74f447da0bb213f12a5c05e1af4","sha512":"1e56a0fe8db6d65de91b3c47bc462c645ce48bcb43faef3d21e49acd1ce4d92c889c420ddd13172d20515af6d6e1582ca55f9023ea38ca968a7e5213437cce4e","ssdeep":"","tlshash":"7231d8ab97335017fa2665f34480de28626fd6c29248438ad1665b2474f8bd70c55ae8","first_seen":"2025-12-15T19:53:25.147832Z","last_seen":"2026-10-16T20:19:32.120725Z","times_seen":87,"resource_available":false,"data":null}},"time_used":725,"timings":{"blocked":259,"dns":0,"connect":0,"send":0,"wait":466,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/whitewhale.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.977Z","timestamp":1792181787977,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/whitewhale.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af323-6e4\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5DAm35y3%2FoMXOQIEUKkeh51oPLE6t10VhpGH9j4dE4dRPtteeiJQd0lWqAd5aMJuP1prbyXDfSqsi86YWBMFEd%2BsgsdJcAoQe%2Fg0WXWFMEW8oU6OrA7OhtVZFOu0Za4%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81a568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1764,"size_decoded":2512,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"4602b1e42f6faeba8554fbd418df7e41","sha1":"5c61ae9f0a71f398f0993a69eae33972dcb5ac37","sha256":"a01a092844239b4cbbd5463074a30ab1c407f063761a5a0bbef4085d5294e9ae","sha512":"4989d9f914c1e2cc5b2c23a3e697513fce3d385ff4850dd8af800e022477bad2a04f384e9319760fe96c1f7076ce69d05107c69452562f43d27ccda3d6ffe304","ssdeep":"","tlshash":"9331d85321325412ed8682730811c3357371a900818fafce5908fab2ea66be13da7e89","first_seen":"2026-01-30T00:58:38.077517Z","last_seen":"2026-10-16T20:19:32.122402Z","times_seen":48,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":285,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/9bit.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:28.006Z","timestamp":1792181788006,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/9bit.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 30 Mar 2026 06:52:01 GMT\r\netag: \"69ca1d91-1bc\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8s23KRfQCYcTyUd2EZ2pW8BHZ9guRWgsdhsIqoxqS0286uBYeL69gCDsHFTYA%2F%2FkVLVF8K7sAqktl5I%2BKZY6i%2BccdIM6y6%2BoUeTxHoC3iuuiu0pbJuAKl8jlLIT5%2FKY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd13839568d-OSL\r\ncontent-length: 444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":444,"size_decoded":1219,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"b81e00ed3ac34bd200395761fa96c579","sha1":"2875cef9cfe7c6575d3a846f7591fe7f6d3cf197","sha256":"4af8729c917bffc2cb8a75906f7fbdcc50599c1be10d576f7c15f8dbb26652ca","sha512":"8f5a2ce3aa4f6b2f8648669631fdef04666f845eae421d288c32b1db46be70eb2b2b68cc4d18a5941b49fbd0320d970d48a7f61ac4509b4e302fdd681715a90c","ssdeep":"","tlshash":"46f0a3a55a130586dba51175941504acd1370640a565303f03c75936066f400cea47f5","first_seen":"2026-03-31T13:47:07.157328Z","last_seen":"2026-10-16T20:19:32.123469Z","times_seen":26,"resource_available":false,"data":null}},"time_used":834,"timings":{"blocked":323,"dns":0,"connect":0,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/portals.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.774Z","timestamp":1792181787774,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/portals.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:50 GMT\r\netag: \"68cb9586-8e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oAcChIxeZHEpHaGGV21JcH2Oq7Pm3LMTh9HYnF37jxhAfGd9CkIjIJfaq8n3dhWoeOmziLM0swRsn0AsWNIisMOMjJMoLib0t8QyZZxZk5u4PaYiSYNKt48P1HzRXpY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd9f19568d-OSL\r\ncontent-length: 2274\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2274,"size_decoded":2997,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"65a0bcb7ae89dc51724d6ec79941f70b","sha1":"968beafd546d05faa063a9c3a360d818e9a8e97f","sha256":"86337e6a682e4650d92f66d688e2635237bc185632e2ecc5499d9e60348804ed","sha512":"d3417daee8aefda0464a2ed747b898502d3890f2bc6a67ed3da552ab9008da1d7baab57b6ad2e7078a88a793aede30f25a059ee3a0b70e5cc82b30b9898eb967","ssdeep":"","tlshash":"1e412b1858d2efe8f56c3d606f22f42041470c2eeb678e538d5359863ece4513f146da","first_seen":"2025-10-31T04:50:36.762555Z","last_seen":"2026-10-16T20:19:32.124423Z","times_seen":96,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/daddy.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.794Z","timestamp":1792181787794,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/daddy.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:40 GMT\r\netag: \"68d0d3fc-b8c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KDm9HmgkYTdiDJJSZbTgaPpyfEhBOyRz%2FaYGCdxjXwEvyfRt0XFnOxdF2DgFv7UfgpEO3XNjZZ4Rh%2FYClkBWCWFe7frctj5w8HQ1cEIJGZ6L9b58%2BwAzrhzbGmz0oHk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdbf25568d-OSL\r\ncontent-length: 2956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2956,"size_decoded":3685,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6a44979092da011a9b4ac65aa2913305","sha1":"8f63d3e8d53ee72be02746f2b35e8be202cb9142","sha256":"03fb88878ef74aa6653fa5ffb3cc8068f4df85dc0f627a3ac4073ae0ba5d748d","sha512":"e0813b12a29b3f492575e33463ef893d8006a5133a7f63dd7eb16e0479186109513038266715c22b168c703ca1961ac982f8fbd6573013784f26ac21803bfcf2","ssdeep":"","tlshash":"4f51e7a2d3656b5ccf24263429a55f15e1ad7f7ace28537f8a8600bb313c9864009e6e","first_seen":"2025-10-31T04:50:36.834853Z","last_seen":"2026-10-16T20:19:32.125387Z","times_seen":96,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/hustle.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.957Z","timestamp":1792181787957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/hustle.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2641-67c\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pAXD8J1JlYrezgxBykoTg0vilvOaEhI19jupwM8XC5c1%2B93tNGWAh%2F8x5D8ot5gckDfaZMabsLEZuY4BsIIVa9f2Qrz6qw4vyuWdVtstXb%2B3TKDHg%2BG5MDVrWxYrCFY%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0cffb568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1660,"size_decoded":2393,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"bef6a462c34189c595eb1f5aeacd82eb","sha1":"2256e59fd787587d78319d03a4d8d898c87e9c9c","sha256":"ee77a41f88664d99441c9e58cd34e2e90433827b3c0007d1490c96c52b966ff5","sha512":"226e15470d4ce6b9536e387f43e5ad569a5fec8d7a05103adf0bfc79843e63a1d0f81aa4292915293c6b99cda76b9637b2bdf56f10e8606621b99a0e65680b9f","ssdeep":"","tlshash":"9a31ea6347385703f6952533accee9b802d7c5029d3c41eab38a7505f4e64c16c62a88","first_seen":"2025-12-15T19:53:25.005906Z","last_seen":"2026-10-16T20:19:32.126235Z","times_seen":87,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":259,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/anb.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.966Z","timestamp":1792181787966,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/anb.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af31d-5fb\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QZCXngUJ7U4WySboC2wwNbB2u9G08rADiop9HEduSR98BL0Vw5%2FfSovuV0s2G0vgiB9Pc%2FKdWw4a78A9nbOzAVUChxqYKkfVrsYd1Oln6L%2FgZ%2Faseh88FuYhI2Mmos8%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0d80d568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1531,"size_decoded":2324,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"ce9827ae5c4b8ad41749e9adb091531f","sha1":"5c96abafc5c3756d2c2289d6518b5b9cb895e0e8","sha256":"f451714bfcfb2ac1a209da00d85ff3999f2fd42e23b842e5ad7790bc6910dba4","sha512":"1793c00052e6cea39bb1c37d011b53f731d4b27ed1767eb1266d2a9f1bc0d884865d1e4d3b968cc781bd8bb9f55a613a968c347f0332d2ea560ffd61138ae378","ssdeep":"","tlshash":"393129628755fc0ccb1f4136cd4a8d64d122f4c82374f6b6250c9cfaa8b240a72dd40f","first_seen":"2026-01-30T00:58:38.053368Z","last_seen":"2026-10-16T20:19:32.127596Z","times_seen":48,"resource_available":false,"data":null}},"time_used":752,"timings":{"blocked":274,"dns":0,"connect":0,"send":0,"wait":478,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/layer.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.765Z","timestamp":1792181787765,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/layer.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:46 GMT\r\netag: \"68cb9582-144\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yZ9P6RhDEwH%2B8D9%2BIlQBkBu7UZ%2BE8susM%2Bptv4VI95xkBQGebUWhD718bRW9d0ra5OnzDK6Ck1ZM4uPf8lOFhtFIo75t0evYkYezN3UuxXAIhWJbBmq%2BaVIy8ETGJ94%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f14568d-OSL\r\ncontent-length: 324\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":324,"size_decoded":1056,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b72f5d6a4916de0b7277319dc6d212ff","sha1":"d2b82b4c30d72459043033734b2b8b127b3e3597","sha256":"ce659f3c36fa349a63e3d449bedf97ad9923e466cbe765a04b138753ceca7248","sha512":"4a5bc7a236af6f251af0fb44d6380a45647863c5947048bae82e9dd0a6fb500fb7bf05adf751702a004e9f3f91ffa020d5ed6591bf268ba335ce6b51314aa742","ssdeep":"","tlshash":"85e02d1e961819c8e1a1c238fc2c23c2acb31610b8888a3f88c92ff28838aa01340c25","first_seen":"2025-10-31T04:50:36.983914Z","last_seen":"2026-10-16T20:19:32.128496Z","times_seen":96,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/retire.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.843Z","timestamp":1792181787843,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/retire.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:29 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:51 GMT\r\netag: \"68d0d407-5c8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dVRYomsGfCchHsfuPf5msDikkTI%2FnNqDtJQtj31hdHSk8kwZvyrR9fK9Md%2FOEfd5hJJEUKdzZj50TFOf0W4sQ3YYT%2FGnA9TCZauCDUG6Ik22N1afQGjjsm3%2BNOh9cDQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd00f92568d-OSL\r\ncontent-length: 1480\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1480,"size_decoded":2211,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x99, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"73f8c3c34e32dc10dee57c68be9c1d6f","sha1":"46a90f175352d9e4b9402d83f20853299a510450","sha256":"518dadc225db4ffeb904226e897aeaca47204b1030cae556623ffb1620c4e9b8","sha512":"50e170ca0b7c9c25e23bb451ed5caa2b3f73f5a4dabf51af9ab932b873ddf8f38f814ee4fc5a83dc7abb87f7d7867bd38962acb83e6ff1fe53f8cf50a46271f2","ssdeep":"","tlshash":"8d31195832473a22c4c82c2e5b6999d2e23322f33231ec6d0425baf46f38911ff0c167","first_seen":"2025-10-31T04:50:36.766664Z","last_seen":"2026-10-16T20:19:32.129372Z","times_seen":96,"resource_available":false,"data":null}},"time_used":2090,"timings":{"blocked":152,"dns":0,"connect":0,"send":0,"wait":1787,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/hnt.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.848Z","timestamp":1792181787848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/hnt.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:42 GMT\r\netag: \"68d0d3fe-966\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mqBYDr%2B6TUo4uI2gW4uLxxw8EAZbdBrjGpc2jW5Edxf862S9p9nWRs4PE2CIKpfaOAdAQSVEFeTR4efkVbUoMzSrztjcz0ZrarVHjZ1iwI0ERWjvAPn6FUsW7TBsadA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd01f99568d-OSL\r\ncontent-length: 2406\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2406,"size_decoded":3131,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bec99f9b7ca50eb2f86eac372bf70c84","sha1":"cf949397fc1bfa5738afc9f10987c675acc7267d","sha256":"78689338b5b79482a3d98a589893f30b2a8cb1907731a90c2dd3d92be40e5108","sha512":"436088e7b406314b4058724e94e74fe7e2e77f4e0fd74b31ae564d7a412d9e7cbe6719c75cfe2558f3acc53defd7f8c313bbce2f4ed6c787a58362feb378327c","ssdeep":"","tlshash":"eb413b7f09f138b4e8d17eac8ba2b6038637a4142c660071d18a59236016a3daa37f89","first_seen":"2025-10-31T04:50:36.935949Z","last_seen":"2026-10-16T20:19:32.130261Z","times_seen":96,"resource_available":false,"data":null}},"time_used":665,"timings":{"blocked":160,"dns":0,"connect":0,"send":0,"wait":505,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/blosk.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.927Z","timestamp":1792181787927,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/blosk.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:25 GMT\r\netag: \"68d0ef95-5ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sAXf8VZCzlgv5vU0UkKS6X0APsmtN6jt%2F1%2F21spGMR3d09DY7oHRq%2BAOoJnSls0WRoCXoP6IoKniYwmswiDXqPQdYCLz7YcAYyVmxrTEdKdK0Wja72YPG%2BKFbB%2Fb%2FgU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd08fd9568d-OSL\r\ncontent-length: 1454\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1454,"size_decoded":2189,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5d4125730404d6097c42e4f484ba9d31","sha1":"5047b74d0b625aa881255d4d6eee173c72ba0cb8","sha256":"b14c0738d43ba27e366ddae43ecb506fd3ec5f38ece97035a77e258d617efe57","sha512":"e8665e6878d72cdeea70ed9bf162074dc11f65e61e7f217bdb559a024edd06731165580edc9a9a901653c134bdaccbca47e95ef73b10c10fab7e09166d528fea","ssdeep":"","tlshash":"db31a8b24788635ded5867b451d04b80eafa3e6b66dba3a6c5400247e5a5080980d58e","first_seen":"2025-10-31T04:50:36.786203Z","last_seen":"2026-10-16T20:19:32.132659Z","times_seen":96,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":228,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wsol.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.655Z","timestamp":1792181787655,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wsol.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:43 GMT\r\netag: \"68c93113-26c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0N0PlUPTOxiB7UBqv%2FmFji%2Bb%2Frt%2B%2FwPn8qwzZlqqCj9oik687DttLtDZwNW%2FlCz%2B3GpMSgTCI8Z4qt3w68h%2Bs0%2BhyCsdzP%2FQDOOuhF8nlnq6nuzCkj%2FcxgZ7rcXxhrg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccde9c568d-OSL\r\ncontent-length: 620\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":620,"size_decoded":1364,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8547fa5ccc4675b4f3208fd43d51590","sha1":"ba297bf4e08ffc4c3994a29c1c0a4ed4751402fa","sha256":"797bbd8533cf1c0ae74b78afa4b44f23dae4596b47f4d784ecfaa319c68f2d8b","sha512":"3fbf3bbd6331e3b00efeca1c492c5212d9960dcb8390edc7b425d0ab9563d38f285974aaa47cdf69b3a67ee4ae383c2b5b32aba873ce9c930dfc110e47585f17","ssdeep":"","tlshash":"95f0e12a5b714927d429e53c0abb1396101cd8b6d03852ab52228e565f8be11dff58c0","first_seen":"2025-05-07T12:19:22.461777Z","last_seen":"2026-10-16T20:19:31.838168Z","times_seen":98,"resource_available":false,"data":null}},"time_used":560,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":560,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pengu.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.672Z","timestamp":1792181787672,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pengu.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:30:58 GMT\r\netag: \"68c92e52-418\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ei9DNmnUmFJSOadalHFDQjBbEA7tUFSUjBX4MvWGXSgxiegn6%2BYLAynD7q2i0NlDl6w1Yl7GsHy%2B9bVxsPwY%2BXkQm8ldCllXSHj9GGC0nXOjvAryBP3oSZS3QxIwNjc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcceebe568d-OSL\r\ncontent-length: 1048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1048,"size_decoded":1777,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5c6f83d56b13f7f4e5e9bed0c16b0e25","sha1":"9a94c349c07aa3e04efd50a158a263b72fcd8f3d","sha256":"77ba39ca007217e322188122e3d935f47f7ffd29ee638ef27c298705755da9fd","sha512":"e234911ceec4870a510f8a810893593a021e222691bf04dc5b1751057d7138e5dcd91e63622227dfa75f30dda654a3177c44e07d108c7daeff522ea927112977","ssdeep":"","tlshash":"c311c42aa9300607e40e967cc03db7804344b15830aa628e520fcd368dca344aef6a98","first_seen":"2025-05-16T13:51:15.637676Z","last_seen":"2026-10-16T20:19:32.133694Z","times_seen":99,"resource_available":false,"data":null}},"time_used":670,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":670,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/bonk.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.675Z","timestamp":1792181787675,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/bonk.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-46a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Nu2kDHE8LxnUUvnJWeeg5TF89tyfCPacgG6kqa0BwnkH35jNWS7RLqKdebtrUvVfrjjJOgG0jyj3koU20Ejb1H7DP7muR48XJZFuHYc5EDnXXlUl9UWVgMfJoMBRFI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccfec0568d-OSL\r\ncontent-length: 1130\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1130,"size_decoded":1853,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"675b3d39c61152966c8b8f9f2147be7e","sha1":"21e4f6b3a60b92d655ac77c8b9f9bd696faf7ee5","sha256":"804ac5a4dc8ccadb08d85872421f8d87572ed56ff328fcb5bc5f530080d62dfc","sha512":"bd2c3985fea1f302a7f20245c59b2a731e32497e96aaa9cc574a2152117e87b4238d7a0a7bf84bd02f5be89aaaf7e902f62fe78ad5a6692272af82ac4d87991b","ssdeep":"","tlshash":"7521b612a7634e49c72c153c846a7b1aa099f5610419788f02bec2513efb84adf289ae","first_seen":"2025-10-31T04:50:36.659286Z","last_seen":"2026-10-16T20:19:32.143602Z","times_seen":96,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fo.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.701Z","timestamp":1792181787701,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fo.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:31 GMT\r\netag: \"68ca7a8f-780\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JQJO0Lb12v82bm8jbtlsRHsDMqCgt0FZDW261wfmBRYAF1Yms3Sk8LbUqsvR3sgttBnAti8TlON3co04JktcUK0HHTNrtlXGWnV1JAZcO24dVhsb2hI5tVFcM%2FHz1NQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd1ed3568d-OSL\r\ncontent-length: 1920\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1920,"size_decoded":2645,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b0792696a40fe30e6118f0c91c4d9080","sha1":"00550fb3d0d63da43f28c80518fdb2f5f5f9d2af","sha256":"f79b7046e19d7c864c73d4b9de69efaa4f771620b0efb376ad0c1f638af15ed1","sha512":"6608ef60312a193ac9ce90afd7d159cc60bb3f5d3c6d3d4929bc520c4d431628168ff3e28c2a7968bf7a14217f452a24c06c67cc77e4794af3131898d8d8eb67","ssdeep":"","tlshash":"0141394712275a70dc07e2fc982327cb12bd8e0b9c48c52fd16a601ecd4a49f87985e7","first_seen":"2025-10-31T04:50:36.913797Z","last_seen":"2026-10-16T20:19:32.14827Z","times_seen":96,"resource_available":false,"data":null}},"time_used":501,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":501,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/giga.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.726Z","timestamp":1792181787726,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/giga.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:43 GMT\r\netag: \"68cb8eef-2ce\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MlE7tabJBdKGJVeS672BX6OoGxzr2wA%2FLpxAV4D5JB1SEBpbdxHZtTd4ZyK%2BecBQHgqr6kBh9GsjSuo1M1Ozk047DOYX1JKkvbQhxiAMFa0%2BFNRDOtDdBhwPM2GjKck%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ee9568d-OSL\r\ncontent-length: 718\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":718,"size_decoded":1446,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x91, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a2815d0bc203f23458b39054b6d80b13","sha1":"fb25e27dea490102d3ce8e5984ca7565a1ed8f3b","sha256":"69fed72f9cce7d8ad1128f893b5e06859812725e75ac0a7c983ece5dbe723f3d","sha512":"1f72a764acfe765cd699e5b74ba9cb24f91e30c68915573a560f899533b044fd5ed5c30f39b5d0d02090b55f9fa30154009332d5973a29c1bb11ab5240e0c1cd","ssdeep":"","tlshash":"300165a763935444ed3ff8781bbb0a292c02651f50aa0e55d48029005a627a1ae0961d","first_seen":"2025-10-31T04:50:36.991991Z","last_seen":"2026-10-16T20:19:32.149301Z","times_seen":96,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gme.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.756Z","timestamp":1792181787756,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gme.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:44 GMT\r\netag: \"68cb9580-30a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BitwDX0cqwOQcN9lxY%2FZ4GYSzt8jvX%2FOyIRzgc5jc8S%2FB%2FXeyH23mhriA9DD9gjoOOXtQsD1QrJ58cYd1JOcT3yy0dXu%2BA5lQlPQfiqg51WKCqQKifvab%2FZSIDoecqg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd7f0e568d-OSL\r\ncontent-length: 778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":778,"size_decoded":1514,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x69, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3efa1b9edfb525879f6501008d17a520","sha1":"0adc708aa7e52d6173dfd67c4aaa442a126257b4","sha256":"4a55611f26e8ac4d912f4461adda73ff4d4d4ba15897af28e9ace19ea24804a5","sha512":"2996173ee5aa9071da737e049161596e38e0004df2d34105c35cb8331cf1120dc5ccd6878918be62d170f9c66f6d5c4160ae281290b98a670d0011e0fc53f89e","ssdeep":"","tlshash":"c60175e16e76b44ef241fc709d0e3b326eeb404eebe29115d7266d8bd8ba1413690845","first_seen":"2025-10-31T04:50:36.7752Z","last_seen":"2026-10-16T20:19:32.149975Z","times_seen":96,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":478,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pcule.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.772Z","timestamp":1792181787772,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pcule.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:49 GMT\r\netag: \"68cb9585-5c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZIkjFRbZf9TCDOs9PfUDtLztPZXJhnWiuqmD2DxDTgKzYwB63PPAqNH%2FLESt8GQq4JsqGTjliWKoWeYJnbC2uahzRA%2FvEj76ub6FNNq9YHGTcjlHE5ugKMzbjEUkHXk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f18568d-OSL\r\ncontent-length: 1472\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1472,"size_decoded":2199,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x91, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"560dce60af9ae8c07e01d284a86c7b22","sha1":"2a5a876211e55692205a461c5cb1742dd9726c6f","sha256":"211d7c0f1df78daf4139733eca3983efb2386b09f2da12fe763145c3f95434e7","sha512":"cc101f3219a5cbde846dcf1483545c5a50ae6ab9a525d18d295dfe6c0df82d89699c73516f5a36c93facdb74f6125e8865a339af5a8c3e243aa99f141dc3c236","ssdeep":"","tlshash":"d931c9864c5324bdd9957ec885f9f2e4eaa671bec528f684132d61318cfd02193140d5","first_seen":"2025-10-31T04:50:36.701042Z","last_seen":"2026-10-16T20:19:32.15096Z","times_seen":96,"resource_available":false,"data":null}},"time_used":526,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":526,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fartboy.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.831Z","timestamp":1792181787831,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fartboy.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:40 GMT\r\netag: \"68d0d3fc-8ac\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ld6dOg2VvP%2B2D2ICedDTCY0MY6N1wm7WHkv1%2BI4Qq5ZWXMhDknIWKQQ4D6ddULOIBmXkXq1ztRdzsxsQbWy1CCDUhpf0hMs5kBxWG7PL%2FzAhloEnG9ltAUl92cweALQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdcfef81568d-OSL\r\ncontent-length: 2220\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2220,"size_decoded":2949,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d5faeb0217ae1dcc345f6b0c424e7b45","sha1":"08cf76f9c325db778a8e1381082a19f6b6d07d81","sha256":"1e25bc27c657ff46139836b2f032f368e4c0cf147d2c2600bb44af3fd2535b29","sha512":"9452b2628debac7501528faf5e15387ca23a9e0ef82c11d3dd6cefee82b8bb2040dfa0d24aba58d3c55cee9157aaccf62ffb4da489ef597ae99580d3e52cd75a","ssdeep":"","tlshash":"f8412b2fe850462ae805e5c044d9f41af1db0b0d7ba994a7c38d6f18c06669192644fa","first_seen":"2025-10-31T04:50:36.868688Z","last_seen":"2026-10-16T20:19:32.151965Z","times_seen":96,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":129,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dbr.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.718Z","timestamp":1792181787718,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dbr.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:05 GMT\r\netag: \"68cb8a19-e72\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HxVG7q415tn4YkK78VOGWfgKLbCYUw83cJ30F%2F4vRi4Q%2Bc9yknNJVZRXjmmIPTkUDL1%2B5eKpJh1FCsx5XciyQpThi8KGfgk2uMCud7PVtj16eqCmDyS8pPRqf4pTWxs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3ee2568d-OSL\r\ncontent-length: 3698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3698,"size_decoded":4427,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"01c743a994d0b584ee5b74aeb99bbd65","sha1":"990095ec62e88ec4faa16d4a6119b4cbce91071f","sha256":"48e56bf6ff547f6c356f2d96533015710b91f47e7c54805151f78750be8687e7","sha512":"604d29c40132af217385a70b64a739897efdfde12d0a9bea03cbca8457f2969b9de81b4fcf2c62f62a71db4e94985fe9a902d0cc8e2e358bbfe85f854d96f288","ssdeep":"","tlshash":"9d715e5ac7f10c115c1c931713fe2f169096e865749e2f9dc2d3a7d52eeb9e65002512","first_seen":"2025-10-31T04:50:36.773613Z","last_seen":"2026-10-16T20:19:32.152789Z","times_seen":96,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/melania.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.852Z","timestamp":1792181787852,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/melania.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:46 GMT\r\netag: \"68d0d402-1380\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WAuq1dwxrmybiBj8SDKezot8K4Dky2eA%2FHqG10Kzk5wRTH4rvkLTmpBW0Aadk8xt%2BfAeUUmKfh02T34FQVHIoDeEbBmqxcIi9fhCDhlwyj7LCgPyOuwHIEBtLFxoE1k%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd01f9b568d-OSL\r\ncontent-length: 4992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4992,"size_decoded":5720,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc5826ed1187ede2943cf39114cb5ad5","sha1":"ec59c551e72de1e83ef0dfc9234e1ef23352a492","sha256":"5992dbc7d89e2e615ce581c3b74f4ab27dcf2e985dfbbbba7e2f678c3eec65dc","sha512":"e65c6e8d46394008731e82eb574be2221ec32c685809b06de3e6a14fbc95dea06161853e9c5d8006497f50f5555dc71315c57a54ebf3327dc8723ace6d9ee22c","ssdeep":"96:c6MT0D5MdtbZPAVwzVwm+HaMKOQg5P0MqFoOrZ5tTAH:yYNMtKwZ/eMzoOZTC","tlshash":"31a17e75bf166281fd7f733454b05f6090a7373dd72289842a6513151287288ff8910b","first_seen":"2025-10-31T04:50:36.689047Z","last_seen":"2026-10-16T20:19:32.153425Z","times_seen":96,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":163,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fred.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.887Z","timestamp":1792181787887,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fred.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-73c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bbLuoVub599EIDu7YtAEJ1O%2F9RRupBO1f7sG5xII%2B39sfh0VFXR%2BDvGD4%2F2PM2F3sAHgIqdK9%2BidopqRuilJcn4r3Apde1ej7ceg68M2aWaGAqzrA%2BTh%2FAfpDA8%2Bja4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd04fb3568d-OSL\r\ncontent-length: 1852\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1852,"size_decoded":2591,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f7493da8e714519249d8802cb754c408","sha1":"e96874641df148fc109d22755c37d45440651098","sha256":"515a61d471ac9cc8b15a8e38acfdcf7bb645bf5a02d22627b0c461abf769aaf5","sha512":"4331f6687e836bff6b07021bb1dcdf9ef98192edc6811b8f0b808ca3c30b6ed90233536c9dc663d9d5dce807d0f025dd717b513d16243c9e80e567084f828011","ssdeep":"","tlshash":"723119e128e75605c7e5e27ec98242e2832be00c184e08c5c8e16593ea3d822ed5f9a3","first_seen":"2025-10-31T04:50:36.815774Z","last_seen":"2026-10-16T20:19:32.154229Z","times_seen":96,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":181,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gor.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.909Z","timestamp":1792181787909,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gor.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-4fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=drd0Qfs2YnQoKaZcVIrucJkv%2FSah2R86oAyBt8r2Tv37aL2zOWI8XaQw40dlDGaySIQWB9%2BBGK6wwNQglshPu6qRUI%2BEp2zziZAD65vZwel%2BYRykKaI8z4WycIGsJ%2BU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd06fc6568d-OSL\r\ncontent-length: 1278\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1278,"size_decoded":2011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 89x67, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"03a9a50b7dde15dd902814c1ce82a0a4","sha1":"b5bd597a7948bcd659852e59420d78d95fa33861","sha256":"e51207b4f48c1ed2df83aa390ac1fb3a45998538badb98b1dd413b40b6f89c28","sha512":"21df4510edf3ff1fd635d2e289e4157831cfc086173dfef0229d3b78f06964192ab441da0339c40480f72be48114c0e2ebe13a12a7fcd325c1dfb6f4fa185e85","ssdeep":"","tlshash":"f721ea180e07931e8b42e7abb90c7b2c50d114e907266d7fc55687187e74ba661f217b","first_seen":"2025-10-31T04:50:36.817446Z","last_seen":"2026-10-16T20:19:32.155141Z","times_seen":96,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":205,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/scf.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.935Z","timestamp":1792181787935,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/scf.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:17 GMT\r\netag: \"68d0ef8d-830\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RyHR6s1AC%2F8%2FZR%2F9Zfx4tsBpiZOSe9BzY5QFsgVFjTxiKmZTZdpjSBxXNrBqM337Ss5WMBhTZdS%2FGcXkeTc1HUcoiKPzfPc6oKDKbXskW2%2BQ%2FJqIHDtZOzsP5OmyxVM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fdf568d-OSL\r\ncontent-length: 2096\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2096,"size_decoded":2831,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dc2046c8bfde5310994ff08fcbe1b52a","sha1":"5f84bf495f18edaa4bfb197a7db56d0491c9d2c4","sha256":"50c366dfe8152bf6dc497233e3dd85505805fb74a8dc966f137ba19d167dee45","sha512":"93a0be5c1bf4a8dd29900cd6d82c421df45c4c8fcf987613b02bfd32c7deaff255dbc35b341722fc0e0e495f766d28db146a72b5c9b78f42617e0e8e3a17354a","ssdeep":"","tlshash":"c241181a3876d4925cae7431d6e3382ca3c8ed9ad4f6e7a236b010e4029e14a70b6169","first_seen":"2025-10-31T04:50:36.907252Z","last_seen":"2026-10-16T20:19:32.155697Z","times_seen":96,"resource_available":false,"data":null}},"time_used":397,"timings":{"blocked":233,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/2z.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.938Z","timestamp":1792181787938,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/2z.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263a-5ca\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vpX11qPePrq6y1zxUkZd8CtZv0hXv8HOlsKflfvJY7F3LUa%2FY1KhNMErRzhDfYfzSn8bh5xprp%2Fadi1035YHKXa3P0lT18XY9Nfu4sUkorzX3%2B%2BLke%2Fl3Ugu8rE3d8I%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd09fe4568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1482,"size_decoded":2289,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"26612ab4bf155f79bbe938865a455d7a","sha1":"1c2071e54355b2be50a95806632efa36b87c19ed","sha256":"4d9bbf0da36cbe68f66a902a495560f0473018540a61631b84f585f6ad82618a","sha512":"0035f9d08b6d87bf63e729212f802590d74d27098bfaa794ba60d2568475e939c5dbfe8f47b79c0c4bbbf31c1bb92f919ee8ff2faf6703a2fefd60acee430d88","ssdeep":"","tlshash":"7231ebcb1757caf2b31595f5cc7de2e908063d642a767a036a44fd91253b10cc542153","first_seen":"2025-12-07T05:18:33.941797Z","last_seen":"2026-10-16T20:19:32.157594Z","times_seen":88,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":235,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/cat.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.944Z","timestamp":1792181787944,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/cat.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263c-62f\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s9B8%2FNgcuqNNK6Nk4RXLB5wp3P7FwGF2ZUhQBMZqiegO6EMgj2nWWpg%2FS96Dd94tNGYMTZk7gvTeAzl8WeXQOMIpbFUzMvgobJYehDm%2F3lMAmVVuAg6A6Fwpfp5MV9o%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd09fe8568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1583,"size_decoded":1933,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"b9b89bcf92538c9f3435be7e9050c3d6","sha1":"781469929f714c755b274a2795fac4a5853f567f","sha256":"121df1b8df15ac5584f9672316fa526bbf19671bf74a13438b8b8fa46535703b","sha512":"4fc060ff412a3529b7a9743380a79c0b7064a9d3818a8e73fe75ce535d1ff43eb1eb417be2efd1024dbb1a5748512040814b05836f409915f8641b3f45e2c395","ssdeep":"","tlshash":"1f3163a337151b02f61606b954d4cfb0e3a6bd32daad9344c7475126e9ac1c09c847cc","first_seen":"2025-12-07T05:18:33.946629Z","last_seen":"2026-10-16T20:19:32.158827Z","times_seen":88,"resource_available":false,"data":null}},"time_used":733,"timings":{"blocked":236,"dns":0,"connect":0,"send":0,"wait":497,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/usor.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.987Z","timestamp":1792181787987,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/usor.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:41:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af322-ac8\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TC3oXx7LMZJim2eDAglFsoWLaWMW%2FCNPys3i6bWnHAy4lhHpIrcgbyCKfqSBRGvdsmcroQdBHS3UDmGIVI2wWZctPFP3gK28RlH7SQ%2FoXg010sTYgkEm4oTb6Q1zwWo%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdd0f81f568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2760,"size_decoded":3510,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"78870b26ec8bd702d4f3bbced3cb01d8","sha1":"94f4a4d8c42b901445a6ca0cf5d22b0760b0c3d6","sha256":"b18991afbf3c8eec763bb7e57a7885d96e88fd09add764aee289a00119226f94","sha512":"33ac6735c58e2824cea279cc3885ee0e0d4dde65ffaf2879ce50f6eae48a53da59f7a26b5a2be6b26e1fadbafa98768316c9a9e94912de0a5cbaa280ce0d48dc","ssdeep":"","tlshash":"8b512b6b63267502d76e187e0e34d5289715680ed10087e82a8ad38965784e46cd33ef","first_seen":"2026-01-30T00:58:38.225133Z","last_seen":"2026-10-16T20:19:32.159614Z","times_seen":48,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":286,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/ban.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.728Z","timestamp":1792181787728,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/ban.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:42 GMT\r\netag: \"68cb8eee-1e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jw1VG8rv0jlPVzOJGZ7r6CZksVkJP2S94s2ffwAgmE0vbUoLZ%2BygEmR3p5T5c4XicXPsAtoH50CIYZWPS4fKDGjP1aJq08D09pu8UDU7turDnCcesEQQbb60vE%2FdE74%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4ef3568d-OSL\r\ncontent-length: 484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":484,"size_decoded":1210,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x73, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9ad6dda76073006314ff8ee25256fe03","sha1":"2b9f7eefbe105fe890913bbbfa9fade4fedaba3a","sha256":"1b776c681901a2e2d18c8d79c0705701d489ff04ab6312c653a1b49ac95e728f","sha512":"cf283c98e0a3a5736556db72b1d891bd131a70a57b4c5bf4933d8e0bd672b231aadce44a3691bf6d7d321096378d2cd8b57bace37ba77f1b7ec2785012f0d385","ssdeep":"","tlshash":"c8f054ea922003c6254f65737560132431e5247ca367be3ae3470c144c20bb787df129","first_seen":"2025-10-31T04:50:36.882114Z","last_seen":"2026-10-16T20:19:32.160931Z","times_seen":96,"resource_available":false,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/wbtc.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.667Z","timestamp":1792181787667,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/wbtc.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:34:49 GMT\r\netag: \"68c92f39-892\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uGeGSJ5xKfr2%2Fb9oL536KRY4ylH1ERqbs5ypEF2XZAfbGKGNT%2B1J%2FNHZ9XsDtRi21lT58tbNYScgpHrl%2BPbEgsGWd2swZRSNGoIUKU1jkiXIS%2FT2lDbvVRSOAxJBU5s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcceea6568d-OSL\r\ncontent-length: 2194\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2194,"size_decoded":2927,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"54dfb6ac3eb5dbdc2886736a8a8ad40e","sha1":"f91f72930f84d572dfaa2ab433ea9e2ce6dd72da","sha256":"b2db9e930b0fe28ebfa5de84dea96e95ed97e007aca760112feb6e57d872e9e1","sha512":"1747e7bff68a5a0dc555befcd51b2b0a3d47b531001a892aee616519b1e83e88de525b7e429da4aec699e9784cacf79603b14ba69517dc4e0c66e28179cb61e0","ssdeep":"","tlshash":"99411a3b06848da4cf10077d493b179707953b982741c1b31becbf582c3b1ada7d8aa1","first_seen":"2025-10-31T04:50:36.990276Z","last_seen":"2026-10-16T20:19:32.161607Z","times_seen":96,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/yzy.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.695Z","timestamp":1792181787695,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/yzy.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:27 GMT\r\netag: \"68ca7a8b-254\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=awb9%2Bs%2BkOGtU7tWdMQrD%2F%2BwRNCkabNYnZIPu5q%2BeVT7wNohYfHMZSe1cUflbn6Th4GWKpOMA7tElCIBff8h1tKBDBI%2BA%2BQ1g9wBbuyQzPbB4GXu9A4%2FxES%2FTu2BYp6U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd1ed0568d-OSL\r\ncontent-length: 596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":596,"size_decoded":1336,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"134a1f24a0c3a369108ecaf5b5087ebc","sha1":"d6f06f42f1f69fa737f2da25c51ab15bf5fb041c","sha256":"4f260305478c7738f539072a3e1f9cff6fa16c6b62e87f33c0ccf70c5225960e","sha512":"a0ccf3eb8d7c4a4b830191945e80a7a1e4fdac6cedb698a971e25e153e412f67e196015a7dc78b3da2a88f6ef7495deb60d04fd4fee8824df655dfc522493d58","ssdeep":"","tlshash":"8ef0200bae237e51c02a703c48e2671ac048d085822aa5f333088915de27907e9f89c6","first_seen":"2025-10-31T04:50:36.687063Z","last_seen":"2026-10-16T20:19:32.162241Z","times_seen":96,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/buzz.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.727Z","timestamp":1792181787727,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/buzz.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:42 GMT\r\netag: \"68cb8eee-338\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Co3L43PsEWqFQLV4JsfJ5tLYsWCYmDKiKgwtTSAKcFrf7yyK4meiyP0iFAb%2BJXe1RPfmD1%2B%2BQyHlhc%2Byuk3sCOLtSJY8MWk1ctmKqm93i%2BidmC5vHg28oqU49CnbOvU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd4eec568d-OSL\r\ncontent-length: 824\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":824,"size_decoded":1556,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x78, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5b16b2bc71c10cc639ebf2324ea4d567","sha1":"58a5e2420a5801d3060b8ebffc6b35968a2fad45","sha256":"69b5448d0c6f3e933190397223691a6c0453edc9eb80a4bb8efeafa8839c0b11","sha512":"576225587f76ea96f3d1a5fbc6ae2bf76275c43eeb9f39e9ca6b09d79f0f3ccab9cedfc0547467cfc1a4a0b1ed07f7872c29fc03829f98417d1ada15f185d70f","ssdeep":"","tlshash":"0101861097f748f5c16a866b3e627ba301e7cebd563e26400d4ab39ac9400a7b93813d","first_seen":"2025-10-31T04:50:36.900748Z","last_seen":"2026-10-16T20:19:32.163117Z","times_seen":96,"resource_available":false,"data":null}},"time_used":496,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":496,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/au79.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.804Z","timestamp":1792181787804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/au79.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:38 GMT\r\netag: \"68d0d3fa-ba2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O1bn6xA%2BZu4RkzZQvWfFoNCoJB7mmfMXFzz3XFaNa7lE5TQlzp44zHnmqlFs93pzFiNwofjH2KWLBBdAYxMJnKx%2BtImuMrkiLSW98VKjbk4%2BQxTBnFX8lbeQQeFrruU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcdcf2c568d-OSL\r\ncontent-length: 2978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2978,"size_decoded":3707,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"783dd165d3727ae0de97c5a41df25bdd","sha1":"cf669f30e80cb98f8e5da8e1d977f8de295be80f","sha256":"69ee60996d1358a9858ff58bd0f2b61c7a17639e3f30b85bec1b50f528da072e","sha512":"4e8dbeebf628208ae569e76613e22a9804efb222be68472366276893b4fcb961211965bd7c27b4122ae745356ef9941f5f2364fb778df3d36bef1102e52918a7","ssdeep":"","tlshash":"4e516c88b69ed8bcd1f970371001f044d217a00826ebc09daf806261a7bf1ac6a4fa73","first_seen":"2025-10-31T04:50:36.764621Z","last_seen":"2026-10-16T20:19:32.163982Z","times_seen":96,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pwease.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.859Z","timestamp":1792181787859,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pwease.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:15 GMT\r\netag: \"68d0ef8b-932\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=00tMI6BaFHGY%2FzzWZqed027iK9CKhGiFVjyeAWkv1VXFsV%2BQxjxzQdl2yggJfYhhg%2FGBTMnUCJ6qxOmwwn%2BuQVvb8OJINfRkufEUDLlyPOBbKn0bqsS5%2BOhYVbA6HTQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd02fa1568d-OSL\r\ncontent-length: 2354\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2354,"size_decoded":3087,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"20492f42b6e0c44ff8fea5a93dcebeaa","sha1":"f17224e2403affa95fc3c14234e5c750b1f5f5c3","sha256":"1ab8c6426f3b80c42191c35f7fb76c97eeb44ba6319ed62fc22cfd44fc71c682","sha512":"ad6a5cb7e7b1281d184f7f220b1ff139e9d0ee9dcaf07c0c35a7bee98f18db6fa0c6134b4ecc2fafea1711dc2bdbd47fe430941602ae13a7d5c65d96ff343b11","ssdeep":"","tlshash":"10411a3e2a658cb76d36439c214f28807f0126d9142774ebf88a2245fe12d093768db7","first_seen":"2025-10-31T04:50:36.896886Z","last_seen":"2026-10-16T20:19:32.166137Z","times_seen":96,"resource_available":false,"data":null}},"time_used":651,"timings":{"blocked":170,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/startup.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.897Z","timestamp":1792181787897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/startup.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:20 GMT\r\netag: \"68d0ef90-2ba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rm5XL3rHFpCk1CtvYrQuqLtCxtHnM%2F3VGu97QFF8sPoaPE%2FQFxDkOEyMXU8tLK7BkGCQBory1I3bv9BmeYwAJPfxQnL6s7dXADMpdkGvKqJ2WA7PNdaSvZgGhF%2FJnYo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd05fbb568d-OSL\r\ncontent-length: 698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":698,"size_decoded":1426,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x84, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a860993143f148970190905e2699bedb","sha1":"00fc0002c065119e7661e03462f46b2e77c33248","sha256":"21fe6bce7e9b29aac5dfca9ee06b7cf4650c12ac5a0b5d50213106d604145ff0","sha512":"f8e44df03092344f8d0ed9b3d60c8de1ec0675431345fac29bdb17e0ad12f19604b40709cd6885e0896e1541f837e9b16865ae255f5e93f10ee8f9d4e37353d5","ssdeep":"","tlshash":"fe018835651e97d7a4a4f0303517634b4108a2b74438efc40eff5893687323e9c16918","first_seen":"2025-10-31T04:50:36.838607Z","last_seen":"2026-10-16T20:19:32.168296Z","times_seen":96,"resource_available":false,"data":null}},"time_used":678,"timings":{"blocked":196,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gohome.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.929Z","timestamp":1792181787929,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gohome.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-3b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C8VPUGl2EYWehtEg0yxEg92Jbhnxe8HRhh%2BDrT%2BsJrqDRfj%2BcDPhsRirC1%2FL8DLvt9KQBKZjPt%2BAFkiMru7EcQ3KMAY1ogym0BsryNA9ALe7l%2FpXGClNfXzL9NRR1Ps%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a4b9bdd09fdc568d-OSL\r\ncontent-length: 944\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":944,"size_decoded":1678,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x73, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"884c88aa96c856f26b9a9a564040e3d8","sha1":"3cb647235b98095fec96073a6668eca4ff1ae4f2","sha256":"fc82eb1bd48c752bf692264fd1f4039ed1bc1880029872d93abdbcdd3ad9346e","sha512":"25c5b0134293899c8fa633ecc0753533468edf662578b2488a9cd6c7aeac1c5fc18d47f0b1870fda98f3de24be946793ec3f2537e81be120dbc5d65b1b203101","ssdeep":"","tlshash":"f011545e56200a40e5387eda8c6b768816d66174c87e2dcfa1789002acad9faa041c28","first_seen":"2025-10-31T04:50:36.995667Z","last_seen":"2026-10-16T20:19:32.169031Z","times_seen":96,"resource_available":false,"data":null}},"time_used":716,"timings":{"blocked":230,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/dsol.svg","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.664Z","timestamp":1792181787664,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/dsol.svg HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:36:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92f96-1f37\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wJ3S3WF7n1Td8S6kD8pqW%2BNHYR61d6aF6OJVDPuq5ubTNekQp%2FhwTkaYWOlkwVqju1ldi4D8Gw3LkQrwlrB09Hib9IRvQMLj1hiBpbN%2FG5nrUuFvzZf1F%2Bi%2FGjvhyj8%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdcceea3568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7991,"size_decoded":1873,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53b1389218ef221834c9c151014a0843","sha1":"386fcac9a2f6d9e8107c7b7383f5194cadb588aa","sha256":"3f8b6763ca76ca895c81bbf33aea58855e9a3a1e27530351c4ad7b0c2ace5290","sha512":"9bd422474b5f293c5561005ef15f21122301db9d63495c2e7acc59437c01718316fd43385a53b69a4c26f373dceed6a7b6c59db2eb9d335d65fb947bc6102f1a","ssdeep":"192:UWpGFsOZSB69c9WpGFsOZSB69F9WpGFsOZSB69Z9WpGFsOZSB69G9WpGFsOZSB63:0949t9B929Dt","tlshash":"31f1f1f6d28c83e990078778e853d9cd68882c7e9f915d8502c6bfab54b00f14e59df9","first_seen":"2024-05-07T00:26:36Z","last_seen":"2026-10-16T20:19:32.169689Z","times_seen":101,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/usd1.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.671Z","timestamp":1792181787671,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/usd1.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:32:02 GMT\r\netag: \"68c92e92-726\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J%2FoiKbHXShK59V%2BnPOx8%2FsQNSo%2Fenq2mo8zCMpzStLE5e4%2FmSLsRhW5SrjHbmTbZN%2FVOuMkMy5S6leTHqX8cxZPVQnhI2c35yORgSOxPSSIwzIam5KQ2LExdVREdH0U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcceebd568d-OSL\r\ncontent-length: 1830\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1830,"size_decoded":2565,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5e808a8d721bddc770a526443b6982ab","sha1":"cd67633ffd7ca5b54f98d6c46df309a9b9f88e8d","sha256":"474b49b4bd9842dfe27698818f432da925ea02ff8010cd3ebffc2150d6a8af55","sha512":"0f5b7119bd2fd47df9972abdf07d48c24b4e66c77aaec359f882bba0803dd53d699c537d33bbe2f19c8a5113b178010fde1f4ea6a745c8a563517c8bac7b783e","ssdeep":"","tlshash":"ed310bda63150246c866747cc6e5e36553f2d50110e1f897cd25895d8cc6462cf1ce5f","first_seen":"2025-10-31T04:50:36.878179Z","last_seen":"2026-10-16T20:19:32.170337Z","times_seen":96,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/pyth.svg","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.679Z","timestamp":1792181787679,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/pyth.svg HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:27:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92d6b-4cf\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FSimEjWEGXkLlG4ZM2ezyBTXbTGec5leLipbuoLPHI9IMM3AqZVEI4fn4fT%2Fbi%2BMWhfRAsV07btdKHnILaP0VE4PjoznlwSrd0Rw2C3Gxzd6D0n6C1o8aKSApKaAKb4%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccfec2568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1231,"size_decoded":1319,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"86ab8498d12ae85a981c736f4c1ad7d5","sha1":"ac8b4a5ba8c357cb0e039ade01a9bb5edd15d2d1","sha256":"f3c88fd9f75cc92e361dba733d133ef55072a63d70d3bbcb37ed7b8242cdba64","sha512":"7e5519d9d8197b21a46dc62a5e0bb85ab1f3861fd3d69cb53f06762164fd4555930cc0813d08d46659cade0ef25cd7dc08a91114fa3859d75c8a219bf42366cd","ssdeep":"","tlshash":"152132e83358054a41d9c3e35b20929c1b7774d7e80d0a9dd3241f298ce6caf9e96682","first_seen":"2024-08-20T11:34:03.163097Z","last_seen":"2026-10-16T20:19:32.171037Z","times_seen":99,"resource_available":false,"data":null}},"time_used":521,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":521,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/jto.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.680Z","timestamp":1792181787680,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/jto.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-6a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GNcsfmbbPfEimejVIy97MQ3MaLf2MeX16NEJ4foP6Coy%2FpTJfeUnWnt6z1x4znkXsakhPYwW5xhayx4ixfORfRlLzV8m0yPLW5VnPfVa6tcSnz0MmhfVXaH8KihfXM4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdccfec3568d-OSL\r\ncontent-length: 1698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1698,"size_decoded":2423,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1a5096a9ea764b61bc67a458ba2c8077","sha1":"d042dbd8d9829cb313c9e8bdbd95a356409d8dde","sha256":"09c8631e454b7fb7f335d1ecde16200923f2aac2d93b8030baab5620a80bfb4b","sha512":"d99a55b171be1b6a8b7c826a61a6d5cb7e8ee690b5d470e20ee743af155c773a5b9a3adad20edbd1b12174f8998d3c8424a3166afaf54d42e0e998b5075c7433","ssdeep":"","tlshash":"4c31183680a38d27c738ed3c3c4b6b124032680ca1047f6b1a419e9c0e81c2fae5ceda","first_seen":"2025-10-31T04:50:36.799812Z","last_seen":"2026-10-16T20:19:32.171812Z","times_seen":96,"resource_available":false,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":498,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/render.png","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.683Z","timestamp":1792181787683,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/render.png HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:28:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92dbd-d80\"\r\nexpires: Sun, 15 Nov 2026 20:16:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ziweZNSrOOTvPH9uBSu3mji6Wrbb%2Fwzn0RzDdnfILc2mYZ8G4tOtV2IeJMrL35EVpt06VQJBIRxKcUDju%2F7aw4Od2B3l8J1him32G7joXaPHEEYI68KAAicWXOexdjc%3D\"}]}\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b9bdccfec5568d-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3456,"size_decoded":4257,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"01d36203a8eeaf7cfb91c33b4e9538a6","sha1":"fd6cf04600cbf2cd9948aaf6b5cf94891e321c2c","sha256":"00849d5c83021c8dafb484cd0d7f4c52af6efab16323f77ae2428f7b665ed7ea","sha512":"c20a7ffd7320facdac9587a134f28ffd9e8ecfb93c9ea7a32139c08bce203481848ca293b8cb5bbb72415d9022578f58096fed82dd6cde8d1162618f127713e3","ssdeep":"","tlshash":"52616dfbb84ec424afa0e27f7c20a59ad8782e761905b7d594317942484b2464b4a7c3","first_seen":"2025-10-31T04:50:36.684578Z","last_seen":"2026-10-16T20:19:32.172691Z","times_seen":96,"resource_available":false,"data":null}},"time_used":699,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":699,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/fwog.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.715Z","timestamp":1792181787715,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/fwog.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:05 GMT\r\netag: \"68cb8a19-786\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vUfYCcyLk0CsHUnNV80VWfqXeEg97mPPJ8uTiMXPNQfdZ3IQyQuSHYI64ZhhuCeYWZcATLExPrIhpIggmJ4BPuediqqSVaeRlQqQ7FAsZnVtHWU38odbkhrIPXOJJ48%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd3edd568d-OSL\r\ncontent-length: 1926\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1926,"size_decoded":2649,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9c3378d746b0b35beac848b6111c7b57","sha1":"acc09866f44dd0f2395ed98fe390d45984579d33","sha256":"d86a6fcf1e14e183291f01c8401cb72e3950e255cf966c2e088ba29ab1f9499c","sha512":"9ff641ecf69141961ec68e72d57a341b276bbfbe474631f4c119ae5a6bc52aa46d7d390a41db37c815fd7f6dbaacbf11b6140b9cb43cc64670eb1ff72f084c5e","ssdeep":"","tlshash":"9741ea9875ef5b8b8753bdd79692d38654a3486b43026622a740f7442206cb0e0ffcb7","first_seen":"2025-10-31T04:50:37.011068Z","last_seen":"2026-10-16T20:19:32.173412Z","times_seen":96,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/chillguy.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.735Z","timestamp":1792181787735,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/chillguy.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:44 GMT\r\netag: \"68cb9580-3a0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i3Wvfn1Nofl%2FF9f2rDtbdU9IGeJqsDXQ5bHWj1lqdnLXA4Itdr6KVEoSCNcqfDHuqX1RGkcnRotQE1gYOkbkre%2FecuA3TqfduQN2CM%2Be%2F8KF28pvHpM4bqJDjI0kOBs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd5ef8568d-OSL\r\ncontent-length: 928\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":928,"size_decoded":1658,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x99, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c1c65f1d46ec29a88119791ad4fae14f","sha1":"5deb47be2e0d890c5243336cdda2bdcab4121e55","sha256":"2ba51302119a769f6022765727576f772cfe052b7b851697306c17768c8c8728","sha512":"1f9f225bd91f35e3a1c2d4f6960510495584d623df399205e8dd43bd9640445fc77b14cbf5a48027beba772df14de5210e0234fc6cbbf70bc4b8ae32c4418987","ssdeep":"","tlshash":"7411f77ec2460ad0cd5ced401df84e261c904e0bc2222f216cdae0d93c5605b228fc08","first_seen":"2025-10-31T04:50:36.851565Z","last_seen":"2026-10-16T20:19:32.174153Z","times_seen":96,"resource_available":false,"data":null}},"time_used":502,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":502,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"raydiiun.xyz/files/gp.webp","fqdn":"raydiiun.xyz","domain":"raydiiun.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://raydiiun.xyz/","date":"2026-10-16T20:16:27.770Z","timestamp":1792181787770,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"raydiiun.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Oct 2026 08:45:19 GMT","end":"Tue, 12 Jan 2027 08:45:18 GMT"},"fingerprint":{"sha1":"16:BE:CC:E4:A9:3C:50:6B:C9:16:25:2B:5C:2B:B7:CA:93:89:83:22","sha256":"D8:F4:32:34:50:62:19:A0:22:03:79:AF:E4:9C:5A:30:4A:9B:48:4D:9B:60:37:90:EB:BD:01:04:33:33:5A:F3"}}},"request":{"raw":"GET /files/gp.webp HTTP/1.1\r\nHost: raydiiun.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://raydiiun.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 20:16:28 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:45 GMT\r\netag: \"68cb9581-2f6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FzEvCUpM7sL6ARQCB4q3Qk4HGPQMtkzRhIxpQESAKCosrR%2FhdczgmHtMy52i0zoBR9ArVGQ3gznnU0yG%2FL5qe4SCjBxLHWQO8ig2f1hoyHe1eu7JpqRaJlG9u6L8cWk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4b9bdcd8f17568d-OSL\r\ncontent-length: 758\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":758,"size_decoded":1486,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15bcf7ed1df1314b691a6d69e2b7583a","sha1":"bf0d18cefb973265c65a08418f84fa9c1b3b1edb","sha256":"9a2400bfe0a2d9cfb7a89b0c1bc70f7f31746747b4ace23889bb189c7bb6f750","sha512":"0fafd93d43926396fdd02e74b39b71442047fc27bce09f448551c708788f181555dba99198a59d327a21e64865f4a74ded23b8398f1182970c8602da54fe16f3","ssdeep":"","tlshash":"e0017590c120f780575d4b0b94dea13a60324182807050b23f648a8ae00d4e94944b8e","first_seen":"2025-10-31T04:50:36.992848Z","last_seen":"2026-10-16T20:19:32.175861Z","times_seen":96,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"raydiiun.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}