{"report_id":"a1efc4c9-65c3-4908-9c0f-240b978e4a42","version":6,"status":"done","tags":[],"date":"2026-02-22T02:31:31Z","url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"172.67.201.65","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"title":"Cyrex — Game Software Library","dom":{"size":80930,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"98a41c90a9d14ddd3b72dfcf4aad9ea9","sha1":"f6c4f894a17bd36ce26822c334e9283f6ce579a9","sha256":"8404d6657a932214092636a01b85a9e19ad6798156de6ce186cf219ecf9424ab","sha512":"df5b76133a6bce35f306d34462b1112d353cd6adfa7f579b0a12cf2444afe04f93942da336007e252094588c43c007c71e4433a68609281d7d3f1eb122f319fc","ssdeep":"768:mNkFy9HwPVPyuuTwPxgkzL1KWF4O6mBcghQLcr4Wd1T:7DtKuuTwpgkzL+s8Lg5T","tlshash":"6c83012835f3507300a38281649afb0b3f97d667d92ba58677fd4fc64f87ca88817526","dom_hash":"domhash6ea7a322ad6f3d5b5cf4ebf81cbb5a6d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"172.67.201.65","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-29T02:31:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cyrex.cc","ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-21","domain_rank":0,"first_seen":"2026-02-22T02:31:32.929485Z","last_seen":"2026-02-22T02:31:32.929485Z","alert_count":284,"request_count":71,"received_data":5613296,"sent_data":31897,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-02-15T22:26:45.957139Z","alert_count":0,"request_count":2,"received_data":254186,"sent_data":1005,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-02-15T22:14:55.382377Z","alert_count":0,"request_count":4,"received_data":34784,"sent_data":2124,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-02-15T22:32:42.929582Z","alert_count":0,"request_count":3,"received_data":6169,"sent_data":1334,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-02-15T22:17:53.373077Z","alert_count":0,"request_count":2,"received_data":32932,"sent_data":1089,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cyrex.cc/js/script.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a2ca53dcf5084673968554d5c4f632a","sha1":"cdf7bdbba1447ae7ff1df30931fedcf12df26242","sha256":"54a78eecccc8be7af9601ec49c5d09fb491ad32c34a90e36661da76095d11a19","sha512":"3f7083b0c92700530eb9e6fbf8c9c661598e580d3da778ce6c26eaba85cd0ea463479b323b67c92cff7d8ded8ec9ac9984ad4ac532b5c04554134b95517b5437","ssdeep":"192:j2Ug0IkOuLrwrH300eoegPP09DiD30JPDiDlM50VtjZY:pvik0LZctiDEJbiDlM50V7Y","tlshash":"91f1016a06792132417b63b7ac87174dfb3061ab712168893d2cc5c90fb2d5295a3ffa","size":7777,"data":"","first_seen":"2025-06-16T19:42:38.984078Z","last_seen":"2026-06-01T05:43:19.040444Z","times_seen":56,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"fb29d53d79800944f29e4a9af54c26b7","sha1":"6dd2d3d90ca489ad12c919dc80d3c510563aba6f","sha256":"89ac23d77f5a7a0dbecd2d227c82fefcf4ae6442bb172f453adb1dfc2aad769c","sha512":"9e91418e97e6365917f1f9febb63023d98ab0889c71817ce1ee9e24a9260302111d2e694c08c282f9ce3dd7842ee64d95235db2420744e03e964e2c39f115e7d","ssdeep":"","tlshash":"4eb0125337791430c5bbb49a43d753ace03362033a81d23a7e1f83048d44782d0f90c4","size":121,"data":"","first_seen":"2025-06-16T19:42:38.99778Z","last_seen":"2026-06-01T05:43:19.05478Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/js/catalog.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a353d3dd0a7dd769c2a30915bbebea5","sha1":"bc4cf2bb02e24077244163facb642092ab745ce5","sha256":"6786b13c9483c30d865fafc55cff1843d2981ed4ffa448a35fab1b8f3f29bbf8","sha512":"8f7bd2ce18e75ad5da9abab20b3df201036ae3176573a64f57826cd8dffc671457affbaa74fac4fe7db698dc757a66bb12a58b6922b15fed5bcc952236726b1c","ssdeep":"192:fIlNigI5o7axWsbyAZ6hmmRiriujifiupiMrK4VZ1K:kigI5o74WqUhziri6ifiCiYK4V6","tlshash":"3f22fe6d24791170c27b737eaa9b6608ffb1201765009a893d9cc4446f72da4c3b7eee","size":10056,"data":"","first_seen":"2025-08-13T22:02:56.878167Z","last_seen":"2026-02-22T02:31:38.334629Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban@main/context-menu-ban.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e48548ddd9350ba3f5c30c8d99749e32","sha1":"7afc8f719c94df3c381ae900549396e6328e5bed","sha256":"f652a5ad83bdd0ef356da52f2706fc1f3c482a247975b6cce70672b9a7f45c21","sha512":"7ade8db36f0c98a2fc62113b3ad0272be9a7efcb3af170a1e7c4cbd18053702b0e19fb65038ae7c83ae0d9ae3a6ed5f9c5d6edb6c100089fc824b4707e251432","ssdeep":"","tlshash":"27112699682b68a0d5ba3bbf4b67c459fe3115634409a140b88c4e99bff2034436ff68","size":1080,"data":"","first_seen":"2025-05-28T05:35:30.082414Z","last_seen":"2026-04-17T20:38:10.099882Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban/console-ban.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f8d1400290074a7a096d4a5f3908f352","sha1":"dd6b63c48ca8a9e3f24293ec8b5961f99c079718","sha256":"c4e23ee4ebb1fbb675775da80d27968731779e7a4e29e97dcbc192019a570f01","sha512":"9095f46712d82decdc4eb9a64c5624b8a8cd8acd8530e824a042ce120b6174a02503a7e8a07edcd1012600adf6f13083cea904df3042214afdf2f7293abeceae","ssdeep":"","tlshash":"9851206873e132256367b0a19c9fd90a7130482e12c8408db64cc2e85cb553c8b3eeec","size":2684,"data":"","first_seen":"2025-05-28T05:35:29.996837Z","last_seen":"2026-04-17T20:38:10.103785Z","times_seen":49,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban/console-ban-settings.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7792df524c54284d917a65814abbe8f7","sha1":"57fb24ff23ff6bd3a0f5e6bf6072629e7a604182","sha256":"92adf746bb5c571672f831b9da8c575ee52eb3b66b48f09e367d0edc01e99b49","sha512":"5fe4c9a42809138fe5c82844db90727ab26d963c352d083309f1ecbdacd288317c4f23d54e7b2c7a6d15f5aaed177a1c7a0c287fc909d198ef893670f117bcd0","ssdeep":"","tlshash":"7bb012b5684210074432b188e419050ce547852a85a59168798d80586f3482124024c1","size":98,"data":"","first_seen":"2025-05-28T05:35:30.02399Z","last_seen":"2026-05-12T15:41:54.704096Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/js/join-to-panel.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e34de8eb2888a86add62f4afa8f8cf71","sha1":"a100f9c444c0df26174b79eea42ea3ad4638e18e","sha256":"e2308d6f1a7369d8ac81d531549e1d763508ad3f595d4a8d48811ff6cf9ff5e6","sha512":"fa2ad443b014c5fd64e8d834fab4f7c8d4a70bbee8732c5a67f1b484f7f1df2d0b5a53da7039976db10003de438cfb84c681d926aac6bee7b41dc5766c0dfddb","ssdeep":"","tlshash":"f9d02220d8182de2803eb3bcaf26e890b9371de2d00461013e1c4e1caf3002f877af54","size":214,"data":"","first_seen":"2025-06-16T19:42:38.975387Z","last_seen":"2026-06-01T05:43:19.051052Z","times_seen":56,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-06-07T23:52:59.505715Z","times_seen":85463,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cyrex.cc/images/Restaurant-Tycoon-3-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Restaurant-Tycoon-3-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 91810\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-166a2\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nmJz1Sc0RtnfUkESWs7HdvcHTBw%2FtUczIldFoxAHaSeF%2FdAbP8VYGqtJM%2FG2zFwpnU4bzj6tiNmhITXN6c3BgKhl3qB%2Bgaq5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f062efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":91810,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"30c3e11ede3d99af4ab5e4a1ea0f5579","sha1":"19624fadf669534a7cb09d9adae8fae9023c70eb","sha256":"6f547af863b0b42f9947c6d7ade328b6d4e0740396e4e02edf5b942b38013322","sha512":"75fbb48445a000d062939b12fe87cce2d2c730c44c8e4da6a072c232b5117d06144697e3334cebd62d675154df9a117925e9980f11175ab822b6cec5b6b02cde","ssdeep":"1536:4H1VJPCGbb0dh5i7x4lULEzwBO/Zj/fHnqSJHoXGTKTQ8m0nf/gj1KB9:4Hjd/bb0uql9RZj3n6yu/Y1KH","tlshash":"669312e17548d657ed83c63b5cf221299285306f2fa8ca61e51ff31ca3303c697e925a","first_seen":"2026-02-22T02:31:38.269622Z","last_seen":"2026-04-08T17:17:29.924418Z","times_seen":2,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Escape-Waves-For-Lucky-Blocks-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Escape-Waves-For-Lucky-Blocks-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 116912\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1c8b0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ejE8gcmMhLDHXT0Py2YUrRPgx2Emp%2FIeQwdCUC3odarz%2FSiD5PJ1H3a96kgcSpDOJ4xwrj2VAUXmIjvwVxlo3JFyG6S9toN9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa6f1d2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":116912,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"55c2d618396293a4d4d35e169c357d9a","sha1":"afc5bf24de2ea1d7dbac3e51b6c7b0abe260dfd1","sha256":"81ca89ea945f1c2786ca4cdf8e9011572092eeb4dc4f1c62de96818a43c7b24b","sha512":"5508c6bf5a9bc74263767da69ca66a5493a16707df6173afa00213fe74cf5a824b7d2ba9b17a95a8de6a4d87fafc1cdd3070df769561bbd00e3cd14bb21da053","ssdeep":"3072:Qum1ZlNK2f5vj0xLC9njhul5JGgUfYa3xvefiEdS:Vil1xvIxL+jhuodgoxvcrS","tlshash":"21b3123e7b7f23a5cc52a23843f97368519a6dfec758b240514b296296481e1d30fa2f","first_seen":"2026-02-22T02:31:38.273468Z","last_seen":"2026-04-08T17:17:29.92831Z","times_seen":2,"resource_available":false,"data":null}},"time_used":382,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":270,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18752\r\ncf-ray: 9d1b10aa2e382efa-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"6421d693-4940\"\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 691655\r\nexpires: Fri, 12 Feb 2027 02:31:04 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=mq6YZL3FL%2BYeQGdb4rJES%2FQjo8QJ1KWG%2B26A6yYenPKPaGWXe7DTh5xf5kyGux5ZV2QAoq4I%2Fo1AHX1SsetqeSnd5Zpjg%2FMo2NRS2BQQFtlFWAzRp0V9IIbRderfIjmNo7r%2BfKYn\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102025,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"ded1c367363e8b20bdc6a19b8350a737","sha1":"8c06d82739d14b094ff6d9036021a252bd1d985d","sha256":"1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf","sha512":"89e71d2e66ac925ec2564aa45cd43f647fd72e5bd664e2728fb632eed71e9e6a43d72a404a8ce9993fc4d223ed985201e3a66676d01cf5e341bc7d07fd9a6207","ssdeep":"1536:OwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuZprfZCl:S709gMGFiyPGuZpfZCl","tlshash":"2ea3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-06T15:05:25Z","last_seen":"2026-06-08T00:04:47.559914Z","times_seen":51018,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":11,"receive":1,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Bee-Swarm-Simulator-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Bee-Swarm-Simulator-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 113874\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1bcd2\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hl2dWOBmseruc%2BgYcbu289swQLjCs6rIW5BH%2F8RjsM5BNCQHixrcRlBLeaD3vNu3mgP8dmarNe88Y0Ehoi8fnfDjq%2FfMRBSq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3ef92efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":113874,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ed28da9ebf6de82734eef842aafbcd50","sha1":"5de866c42e50adc1fdc144682a5ed850d9203ded","sha256":"01233ce421aad70d1a3173bd67ea29ddaea39a6c94d1dab234cdc65cf1f6e9a8","sha512":"de0b279ed222a569e8a3d91ac37b94bb3e8c7e3800bdc56f47850643b0f00a93ff52b185563d9e3e3a2529aa06ab63a2c4abdae66175fa307879d0afd319d87d","ssdeep":"3072:SstLqzR0BS9tzLRJrBaqG5KblKjHu+BZeM:75EujLj7","tlshash":"5fb312b00b76122de4593d3651b71de48219f2df7a42286ba528fbf8f4f8d415b6c0a8","first_seen":"2026-02-22T02:31:38.277272Z","last_seen":"2026-04-08T17:17:29.925189Z","times_seen":2,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":270,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Scary-Shawarma-Kiosk.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Scary-Shawarma-Kiosk.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 89022\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15bbe\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bRGXMk4woG4vekCDVLBpj%2Bq1tGAnIulZpADSslYE%2B52rGxHAN5%2F03B6ELGUXIUaCwSSpKPDXXWugaG25UYUkY5d6nKoBvkO5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f0c2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89022,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e7f4950580fcd95d02babc22229ed344","sha1":"8b5a5e5fc95d79f94480bbfdfc4a6a644ca2547e","sha256":"9d460132d2ad975280652b69d1a44f1b491f8b70d3b5b36ce21131392950b79e","sha512":"49735bdcad2a8f945219ee1c2a49bc6da24e900fa420050fa10cf246d8d16ae61dcee89655fdf5415e306541d8a5de14ea6f682b0cd69883597a5ae342b9ae1b","ssdeep":"1536:P3eCG8Jil+vfdRLkEQLdZtfVQn3LnaRaKQxFAGhVh24G4Q5ILQwYN0YmpUqUNL3W:PuChiEvk13VQ3LnaRapxKGhlGlIswslI","tlshash":"a8930269178aa4b2cc7da57c3c9e030c10f63706539a4ec7377e868df508b6a6f819d6","first_seen":"2026-02-22T02:31:38.280275Z","last_seen":"2026-04-08T17:17:29.913707Z","times_seen":2,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Brookhaven-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Brookhaven-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 69904\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-11110\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Njig89JO%2FEOecpQvqu%2FbOwTajb3ckc8sWrw4tAnov4fB6mT9F%2FhvZ7pF%2BgJwNif5ncUp9p6K9J4zhG5zEQ27mLgbAzXu48xk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa6f1e2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69904,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"82ccd4daa631c08f1127bad4020f2519","sha1":"e6896a1827c03cb63f57f78be973d1ae5fdc8deb","sha256":"21a9ed1a9a230e3004d64ca5959c5a3c7e189c4774d89311f300598da5fda9d2","sha512":"d2089fa051c5d80b2bd02e6f1d7ce77c87f76cf05fbda24704a678cbd6f58a750aa7bce7114b1ab18311920c06773d42c4e3b755ba7a701bce86185503fe493f","ssdeep":"1536:PUxPMJoVPXFgUONTE09RylTbE0pCtsasF8xhtURxL6jmGnivVKU:PUxPMJo9OTOTg0pcsabxPURFMitKU","tlshash":"706302cb89396b93ecbba07849bd46f5e471a3299f74715e0e6dfca020905d973e41c0","first_seen":"2026-02-22T02:31:38.282702Z","last_seen":"2026-04-08T17:17:29.994488Z","times_seen":2,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":165,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Anime-Eternal-cript.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Anime-Eternal-cript.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 97972\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-17eb4\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hpOSg7VwteY0SyaFuxvfdFeqxhDNTp7V8ZTVVQXmFw0TCDbMGIUHrFyh4GButHDLGqv4HZugNgk9TZbrZbf7Y9RmKZOVdhz1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa6f222efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97972,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d0eeb0681e1f8ca765235aabfbd54962","sha1":"6fbeb7ce22f90c2433e937c7297694494140b6a0","sha256":"35cfd9d9e2b01123e893929ff7214f72d33184a7846eb8957a596a921b2ad71c","sha512":"01d4145b72a23b7838245af988d5fa2306c22306dca68cd2dbbc708199d7691ca6279e93ac6948c74cc3e7a1a0cd336f0b1503fc666c63e866023d9709517740","ssdeep":"1536:KtLrfFrLW61+2p0WvFcwaFqDwENVB4Aw8EQ9qSaIS1E11nEcNMHMg392f:KtLrfFrq61+fWdLERQUjIS1E11nEttE","tlshash":"7aa30266951e43bedcf3933cae6f5b2625420bd5dab28172639b8cf3d82de124703006","first_seen":"2026-02-22T02:31:38.285034Z","last_seen":"2026-04-08T17:17:30.003407Z","times_seen":2,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":240,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"16:62:FB:B8:FF:3A:46:6C:9B:6D:CD:92:D9:4D:14:3B:59:48:25:B1","sha256":"85:9A:F5:D7:C3:BC:CC:6D:01:3A:9C:71:F9:24:07:98:12:7B:61:7E:2F:43:CD:26:EE:39:8E:AB:76:AE:FE:B8"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cyrex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7816\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 00:03:38 GMT\r\nexpires: Thu, 18 Feb 2027 00:03:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 354447\r\nlast-modified: Mon, 15 Sep 2025 16:35:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7816,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7816, version 1.0","md5":"25b0e113ca7cce3770d542736db26368","sha1":"cb726212d5d525021752a1d8470a0fb593e0c49e","sha256":"9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526","sha512":"a0d331e62ab4727f49ca286a1ee7fb81cddc5bb9edf71ef84f4bd4fa1552069af1a82752011ba88fae80862d034135926b7e99d70e59d626d66d4ede90e94c30","ssdeep":"192:Agw5ksLwlyK8F2BXU96Fc575OI3+ga534SlEFwTG4ovej9be:Al5y8FSUMS5VOq1KISlvS4ov+4","tlshash":"a3f1af19d5de5a73f80032b45b6911ba7e42fa83bc68bbedf8046a10ad542cb467cc91","first_seen":"2023-04-05T13:48:05Z","last_seen":"2026-06-08T00:36:47.512003Z","times_seen":258342,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":232,"dns":0,"connect":27,"send":0,"wait":16,"receive":1,"ssl":201},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Volleyball-Legends-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Volleyball-Legends-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 83932\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-147dc\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gmGAfW2FSOP61Ajpc4vBKCCx42t%2BQaU7YHBO7m1UUO8K0ufqozmCY69xcohCgYULWgWNnc%2BOG9Lv%2F6QBz9wLlLAtnXlUDF3I\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3eff2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83932,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dc1cbd09ce41cdfca100e23c915d159d","sha1":"8ebaab9a0f0630201154c3a3de432f6926e34f88","sha256":"c63262ef89f7ab6bd8ae7a7d35bcf255f972ec8e89f04b097efc4429ec1a766b","sha512":"922593eb8cd85e5216786b6671e8b1211343da3ced1f9b5a395155f88da526a7e0fcb9c30fa907bb67da4c50bc473a84ef745c1a6bb0dbaaf2d8a9dd0d649e92","ssdeep":"1536:BWH4cLC4UvL2twdaQnxXHLC0n1vV7KBp1F+Cc3A62PKQnYJ:Bm4CBUQwdaQnNrxn1hKBp183A62lYJ","tlshash":"c2830239b36347e0df3cd83a64739b2963e24b58a078585f3ad4c46eb971986df0421d","first_seen":"2026-02-22T02:31:38.288336Z","last_seen":"2026-04-08T17:17:29.971552Z","times_seen":2,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":196,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"16:62:FB:B8:FF:3A:46:6C:9B:6D:CD:92:D9:4D:14:3B:59:48:25:B1","sha256":"85:9A:F5:D7:C3:BC:CC:6D:01:3A:9C:71:F9:24:07:98:12:7B:61:7E:2F:43:CD:26:EE:39:8E:AB:76:AE:FE:B8"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cyrex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7748\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 00:05:02 GMT\r\nexpires: Thu, 18 Feb 2027 00:05:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 354363\r\nlast-modified: Mon, 15 Sep 2025 16:36:26 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7748, version 1.0","md5":"a09f2fccfee35b7247b08a1a266f0328","sha1":"0da2d17e738f46d2a09e6fb7969da451719a9820","sha256":"cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446","sha512":"5e3f9a298003b84250ec6801e08ad2a4ff8845d4c3e13ea61bec37da24d26ede13b436257882124cc0c27e9a323ba92e7d23c6ad3f48a7b75535f5ed98813a0e","ssdeep":"96:0g6vAF/FXh6MmoI56TEwosGU/DbVF/QBT1gaHEYT6u/w3hXLbJPAS772+6haAftj:zp6x6TYpoDYBJg8TRkbJPAS/2+CzQa7","tlshash":"f3f19de65d1e5e8980f0102f6f6efce767950d88141dadf9a9e72f884c6ba1b04c90cd","first_seen":"2023-04-05T13:48:05Z","last_seen":"2026-06-08T00:33:57.043693Z","times_seen":241919,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":103,"dns":0,"connect":15,"send":0,"wait":16,"receive":1,"ssl":93},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Swift-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Swift-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 85882\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-14f7a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MWEwdIIO8Pt0iPdB6%2BnRS%2BYrJBGRuZce%2FOsbEUXoWhhXziqPEDnnmBOv7KmoAD5XaIB0aN084eV%2Fhlg7FABpcvsczTW9gax%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3efa2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85882,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0be6c7d0ebd9dd158123e22b5ef6013","sha1":"224a399e82d6b0985bf35ab642d77217ecaa1be1","sha256":"883bf63d4eaa0fb8d5b715fe06f224c813efde38abf75a51a44236bcac890b08","sha512":"b9ea443fe83bf485d8da923c7bd0076188d4a491088a7196f5fdad2ccac9fab54c48700589909a26ab33c0148811377071ff1e525c22e1603c5e94861745c8a1","ssdeep":"1536:Pq+3OYD6dRDB3fn1qDjox8iZEbbdYO2S/AUep2R6EMPZ3bsVZvmcwN2tlLLKgvZZ:Pq+3OeebPn1qeDZK67qAUfMPZ3bvcrzH","tlshash":"2783123749ba27e7d8a6c07a31dc488a5330de684376f608609e8f9e06b5d077f5d4ca","first_seen":"2026-02-22T02:31:38.29199Z","last_seen":"2026-04-08T17:17:29.939958Z","times_seen":2,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":217,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Velocity-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Velocity-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 69302\r\nlast-modified: Sun, 08 Feb 2026 14:05:37 GMT\r\npriority: u=4,i=?0\r\netag: \"69889831-10eb6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ha1e%2FLE4HgV5C9CRUQG0%2BebN6Od8%2F4%2FpVBVKZV9zZXguo37RIVkrz%2FsUwUVUEPw6uV6CH6feG%2BsLcNs6ngNmYV2bVLlXHDsV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa6f212efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69302,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f12fa9dfa8627d42505a4670ed9acda5","sha1":"e0a81a2f2781656d534c817747c9283d87ace79a","sha256":"a0b7f7ed2fc6f65251b7e367ef80fea428147f28930a75f7dcddbda8a9c90020","sha512":"fef05855b5fe31707e7f847cad58a7aec1c53f5d76bf2b2eb203a1801ade1811979fbbdc5f1ac97ac5075c1ac55f578050cbc28b40391363578cda6e2174cefe","ssdeep":"1536:cl9rbcC0lmC41doU/6gKSjcy4bLVTppRo52hghIk:cjEC0lsN6f77hTppW8hs","tlshash":"216301448323635ff02782381eb2753c28d644b25ce7214af7a1d9a6d5e48c5b35fea6","first_seen":"2026-02-22T02:31:38.293948Z","last_seen":"2026-04-08T17:17:29.983016Z","times_seen":2,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":155,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/The-Forge-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/The-Forge-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 75812\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-12824\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TuIUPNPBO3HsAWtsb8Aqs6OXvVUo4SCC11CLTWBQD31nPLaY2TCjnntFMbnhN773uRPxG9OJ0mhjavWemOb%2Fw7Bi0Nhv2iBU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f0a2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75812,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b7dc540c926723a06fa3d396aad33f5a","sha1":"c43bd463daca1f622148148ce8f3567888ca8078","sha256":"4e5e4f81953d8e8140843e385ab810d5f133525f7a6b9988d058c9047362ea1a","sha512":"42ae9afcbeeadcb2cba35fbb498494294420c246225acbb8afeb2fe70605c56b070e6f74b844c1ed1609cf1c43a8f4978e89bc936ebec6c8fa25fb3681ba1de8","ssdeep":"1536:sbw1Pxu7tMNjzrxZ6cY0RyaiAnnNJ1yE91aToBQyL9WRXTsgXVQvaX2es:sb0xuIbvYUiYnoOQyLMRXQcVQvM2V","tlshash":"147302facc7f71ddd91eca7dc9b841b59045f9aad73bbd1021982f4180116e68b4e384","first_seen":"2026-02-22T02:31:38.297166Z","last_seen":"2026-04-08T17:17:29.955874Z","times_seen":2,"resource_available":false,"data":null}},"time_used":362,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":247,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban/console-ban.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /gh/amphetyze/console-ban/console-ban.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: master\r\nx-jsd-version-type: branch\r\netag: W/\"a7c-3WtjxIyoqePyQpPsi1lh+ZwHlxg\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 17651\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\nx-served-by: cache-fra-etou8220032-FRA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 1115\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2684,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2590), with CRLF line terminators","md5":"f8d1400290074a7a096d4a5f3908f352","sha1":"dd6b63c48ca8a9e3f24293ec8b5961f99c079718","sha256":"c4e23ee4ebb1fbb675775da80d27968731779e7a4e29e97dcbc192019a570f01","sha512":"9095f46712d82decdc4eb9a64c5624b8a8cd8acd8530e824a042ce120b6174a02503a7e8a07edcd1012600adf6f13083cea904df3042214afdf2f7293abeceae","ssdeep":"","tlshash":"9851206873e132256367b0a19c9fd90a7130482e12c8408db64cc2e85cb553c8b3eeec","first_seen":"2025-05-28T05:35:29.996837Z","last_seen":"2026-04-17T20:38:10.103785Z","times_seen":49,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":6,"dns":5,"connect":13,"send":0,"wait":15,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/CS2-Hack-Menu.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/CS2-Hack-Menu.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 79148\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1352c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r7Q7rU%2F1jfkyInpPxN1PrZC8%2FNZmgP3Q%2BMNhNPCr2qh9vsQkdnSl2QSK3KHuFHTIs7vZgN8fTfbBcCxa4lCX0mZJ1CDnXZ%2Fi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee42efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79148,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c87fdd3deeddaf5d50ba1d36c7757c5b","sha1":"9818cb7b1555e06961a3d7a0eebee05e07f35c1a","sha256":"9faf48570c30ce600bb5ebba02c3500ff2d4c291624f287ec1d32532eb10de43","sha512":"39edfb28b3cba341463ad4616688ebf555ee792d858f2fc18ab0616afcd0cab719506753348eb55e8cf5d0541b37d5b4b901f6d1d12bd807098138b3d58118bd","ssdeep":"1536:vtBTcQ8WPUww7G3HIlT27gJm6eFSRqpp1dO9GvhOZdoQS3NOA/3ksDHTKoC+c:vt+S6Dm6e+qppGWh+doJ3NpU6TKoLc","tlshash":"ce7302b2df1a0275e943f27840c73a94bad51e77d4fa3aee64074648df1110386ac9a7","first_seen":"2026-02-22T02:31:38.301898Z","last_seen":"2026-04-08T17:17:29.920487Z","times_seen":2,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":218,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Hytale-Cheat.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Hytale-Cheat.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 91886\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-166ee\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KzeHLqNF9lEEPrr3BhZXJhIL80tOYHJw8Eh7u7Wc2rN%2FLFQU8L40HZ2lvWSiECqcMUE7XEDnBacvhPWKJzF%2B89tN78likZau\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f392efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":91886,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e4d329e4a547769ab02bc69e3f46ddd8","sha1":"c3626aedd7a2c225f907fb18734d805167287599","sha256":"318627780f59b58cdb3384dd4e66e68e62cd8c5d920de7b916b554a2bbeabf08","sha512":"1c05eff0d93d6962947898e4a004cb4b6f0bfa7c7cd92f9c49a398ae3799f7b637eb486ef9d93bcef21a8ccc89f7dba6f34181cde7d998a1c7878580ff054861","ssdeep":"1536:MpzKZadoAbqXZLhNwuUjkZ+ipS7M8f8a3+EKVl9VShWQyHNMXvU270X36asZfkOK:M8EIXZLhN9UjkZZpYZ8OKVfV8WVGU00X","tlshash":"b29312e935ce592df5f9bcb49ee6348861f67a82a06231d630f06041c09e2ce70f565f","first_seen":"2026-02-22T02:31:38.304394Z","last_seen":"2026-04-08T17:17:29.895455Z","times_seen":2,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":241,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Arise-Crossover-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Arise-Crossover-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 100606\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-188fe\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aVKVRk64zB9I%2FjIf%2BKt2iJiCYK5JtsRZXUZIhvKrObtR3f03KTfBs44UXnFhr0I6BIv2Gs9SLzpIDorvKTk76aPzZFIXKgTG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2ef62efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100606,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a5ba98c6e0eeaf9ccad7868c3d87c7bf","sha1":"df0ac4a4f78021d1cefdfc3b8ab455578d0eeac2","sha256":"f3334681d4d8f7c14082735e41816230059c047888ecf23fd46c57dd8b8dc8ab","sha512":"4daa1f908e1b7185b84d1878738e48aff8828127ea1c44e9e843bc7081e4fcc8ed451afb398e2a943452b556e30f0a6793f35224ec61a6959b49837e7c73e1d7","ssdeep":"3072:KMF95EsdNsvjSi9PyXHebR/Fb/5zNDhM3Xx5:FL5Rav+ieHebR/Fb/pMXx5","tlshash":"c1a312d906fccb43e6cad83a9de42049ab803d24f3f2e142a562ff37575165b570712a","first_seen":"2026-02-22T02:31:38.30657Z","last_seen":"2026-04-08T17:17:29.888714Z","times_seen":2,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":245,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Blind-Shot-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Blind-Shot-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 86906\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1537a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DedHGpQEECJLTwDUgfLKMEA4pCKwYSpGcJyiYVHK6%2F1NSNKmvJZONmPQUEfBIOSNo1Fkl520OCmRgroV0lJjeTgDknVXpY3x\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f112efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86906,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8eb8638d4efc0adb66f0f35c88ebf23","sha1":"62d9ef21589144f21f0ffb934580c1b88d361946","sha256":"1bba1eccbbf18b760a50ac51d03dc86ce87feecba99e9d35e893edc2cd243fbd","sha512":"fef41c5a6cd7549161fc5a7a61c18cdd3d15b61e6064cd910089979764b99172bdea10f6a9e8d02ed81c441585c5d0b13e213695202a7a55b5212ef70db2b8c5","ssdeep":"1536:zRhxDhfjzBqhznLwk1sMOHHc6FGoZ1jh3Avk0XqqwPvqlx0yi/bsjGicq0c:zfzfj1qznkgliH/GoZ1aMjqwPvWwjsjv","tlshash":"43831232bb955a3bd1318f35cca719ecd5a3dbe9521103835ee05942b803b2a1f685de","first_seen":"2026-02-22T02:31:38.308884Z","last_seen":"2026-04-08T17:17:29.91772Z","times_seen":2,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":215,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Tap-Simulator-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Tap-Simulator-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 85950\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-14fbe\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xCkdMh8NQ4Vv6rtBqAOkg5ppfpj7d5HsP2nwMXFTCiUaxBtqFBjqSiiswMhj4cWxGJCWAVlx2PRu5pQtfuY1uZcS4ufRY%2BYi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f192efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85950,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"83993232f698cbb359246f62ef9fb89f","sha1":"447cf7f49f8c7c4f7d959cdb268211a8d39850d9","sha256":"6fd9379153ae53e914e7132ccb11872e40293db28193485883afd221f536e3d3","sha512":"97107469fb0c08d0b48f666a2aac9c6ad9a713b07848323e19cd030f24bcd635745bec1a82d453bc3bbd2486c9297ae4c3b1304f76a2ed14d4289f0ece527ad5","ssdeep":"1536:7FAPK4qa7A0wkCr1yV9kKJcwnQX6+3SB+jqfszhOcTX21TwgWEOrkKiCMigojN:7FAPK4qaU0w3ByV9tJnQbiDsccQwREMZ","tlshash":"9d830277fa3c9362c427d2bcf156eab789a03492379335941a6b8315b1784d7c7228a4","first_seen":"2026-02-22T02:31:38.311193Z","last_seen":"2026-04-08T17:17:29.907787Z","times_seen":2,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":205,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Among-Us-Mod-Menu.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Among-Us-Mod-Menu.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54110\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-d35e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JKX%2FMEbjUVaq2bGa2CE9OlNDqebVsTJ1YDFCGL41XL3oQSyZfC1EKZNIOU2UVOE9e7miCrFYvGmGjtz71ismqcKDs3aEGZeS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f2a2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54110,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ac68269b143210b874e2628326243aec","sha1":"e57ae3e52a7ea5936878332c26a7dec60cde2398","sha256":"1bcab5de3fe586f753d6f161bc8fd7323235b36804c5edab5ad21a5595691f41","sha512":"8a2eff886d4b70a760b5cd9f9e3f177563073f73a72ea00d8c5fd737a63a22d47fc1ae8dcd1ad18dbad3a94adaf94fe44b96e2aeab7016fa26f3f6d3fc0ea835","ssdeep":"768:eYyEPAWCm3aQmfjsW4Ur7Q+aiSc05cgxIL2DS8dVivAY9sWyKs7+HMK:eIdarfjz4UrE+aDxIL2DS8fivxLyKAi","tlshash":"c533f1b5cb72a33eea24fc3514a07380f681f56d83d6ab62d46443266764a90350fd7b","first_seen":"2026-02-22T02:31:38.313641Z","last_seen":"2026-04-08T17:17:29.962009Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/CS2-Skin-Changer.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/CS2-Skin-Changer.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 97232\r\nlast-modified: Sun, 08 Feb 2026 14:05:37 GMT\r\npriority: u=4,i=?0\r\netag: \"69889831-17bd0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5XTNo2q2qNXqWABJ9unCfeslO3lEXTLVcgYKH6LOGO4Vt8x3gbsu9KkOFU1Dnus%2FoTk3bgB0vB2sVewqfmDHYDs%2B9ToaWyb8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f342efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97232,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6fed831eca61e45ece4369013134c9dd","sha1":"68b3ea99907b9b2bdda1bf08a50c0cee8161de79","sha256":"ed9f2d3874d38c3b2e2962e5333be13297708f073305de2167067f3d3bd0cbb3","sha512":"53116d043cbbcdd5b6dc8fc59d56da520fca52e006ea512ff4553bfd16d0ce26d50f1d52c20d976fb75cf3df73a2fb598df7abc78ddd52cd8c091fa6e5b6f479","ssdeep":"1536:p2kgkzi8MnoznJOAhWvmPGQl0Yfgqw0NIcm+3LGgD0gxTsD57mebR5++tKMSpc3o:p2uYnozJ/iXoTm+b1Agm5tbR5DtXSCha","tlshash":"169312f0f991434bdd79ed3e5e071ea5038193a5db22b20ff225562573ad687e30b422","first_seen":"2026-02-22T02:31:38.315708Z","last_seen":"2026-04-08T17:17:29.972587Z","times_seen":2,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":241,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Demonfall-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Demonfall-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 92226\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-16842\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BgOd4kZ9bXmRZhGCzcXjF8aCeBXln8EwGEWOCuo%2BQrpGsnrnnoVfl%2BwpbLPIfRn829kGlYbN2tN5DN8gmh2egVuG9Gk0WmCX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3efc2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92226,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f69e9f7a1a999373d66df5d88adbc3c2","sha1":"064290f4abcfc18150b5523399b21c27c3801c20","sha256":"99ac5a19baedc506f5d647870bc02a13373c21f675c16c1b3ce0bcbaa98463c9","sha512":"35800aabc4cfb16e1b86cd9b22670385c545f02de33857c67983a875a73ba563014e900dba77bb8e8adee368a43e33ff6577b23d277d35a14b956f068b3d4686","ssdeep":"1536:unEHnOF9TbkGNGHFs9wWJ3qPLffIZiT0dhksVlv3PIMfLDnpJ4qRU:unIOfT3F9wqajffSFvPIMfLDpiqK","tlshash":"8c9312e92c8a9375f213a4f64cadd6b121e367e8bbd137d070a7390598d144438ba38c","first_seen":"2026-02-22T02:31:38.317809Z","last_seen":"2026-04-08T17:17:29.956927Z","times_seen":2,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":232,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Dragon-Adventures-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Dragon-Adventures-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 89458\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15d72\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HfjKyyqhusc6MLk1Ll6oaghn4LgbtPHrFKv9A%2B6Vbzaw4bz5vcQvvUHIeJB4a1HHsM4MhT3Cx6pf5A8qfGTgbo4lwRHnnH8U\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f0f2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89458,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e05bb3a4ab536335aaf2bae2cae777b9","sha1":"a035b5b2d35b27f96ece38142bfec5e778ddeed5","sha256":"920d3738641212ae73fdd21c2a115eba5beb5026552a0d1973e58da4eb03c2de","sha512":"2889c42731430422b6c5c840860cec91fdd98a58e6915a18d895fc02f9aef91770c307891c238184f00559dd490d22e6177ee382638e6fee4ddc53a46a45a8b1","ssdeep":"1536:JUs5FCoS32dOzrUtJcgXw9dqWsISk+jiIm4UD5R7rdi5t7TDa3rWWz0R/x72vjyD:JUs5sJyOzr4JcgXwC9m+jiImzD5ZmeKV","tlshash":"a69312fcb817cbe1e685837388e056d196371216e0e93a55b352beb1f94434af21d0ec","first_seen":"2026-02-22T02:31:38.319836Z","last_seen":"2026-04-08T17:17:29.991745Z","times_seen":2,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":256,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Escape-Tsunami-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Escape-Tsunami-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 89604\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15e04\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WgZe8owSmYMzz7sGN4qcu6mFLNBJd%2FPgQEpDda7VkuqskY%2B2EjXXfEwfZCIJjGUhEhAp8hJ3Nhyv6KUvKJlT9lZSJJPGjbED\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f152efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89604,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4fb9dcf0472e904419fc77ca63ee2091","sha1":"b29d890c9915325018d937382a8b7be8b9cb39f2","sha256":"40d3eeaaf39ba732898bf4661d44ca5266dff4e29c99fc855b6decf242e51c57","sha512":"f9d8f1d706a8dfb3fdd1195448b6b3eaa4a804af20a90749f6061cd3d33976d37519af811aba59a5ec3bf39111e6a72a3e5ffc88bae68c406d867f549ae38f9c","ssdeep":"1536:/Wsgr4vBlrVmun6p+xkbmS00gRxe6i5VzE+L1DaA2Q/C1Ju2MzkiysGUrfRvDM:/OrgTIuhkaS0D3i55Es1DeDurzkrCrfy","tlshash":"04930270db2957f0d3206cb848f06e47b6193a5c83e07b107ab9f139d3a07a9958bf91","first_seen":"2026-02-22T02:31:38.321986Z","last_seen":"2026-04-08T17:17:29.914758Z","times_seen":2,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"16:62:FB:B8:FF:3A:46:6C:9B:6D:CD:92:D9:4D:14:3B:59:48:25:B1","sha256":"85:9A:F5:D7:C3:BC:CC:6D:01:3A:9C:71:F9:24:07:98:12:7B:61:7E:2F:43:CD:26:EE:39:8E:AB:76:AE:FE:B8"}}},"request":{"raw":"GET /s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cyrex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7884\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 00:02:49 GMT\r\nexpires: Thu, 18 Feb 2027 00:02:49 GMT\r\ncache-control: public, max-age=31536000\r\nage: 354496\r\nlast-modified: Mon, 15 Sep 2025 16:34:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7884,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7884, version 1.0","md5":"9212f6f9860f9fc6c69b02fedf6db8c3","sha1":"ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b","sha256":"7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f","sha512":"67317495f4b53e20a9f31c034e456e6c37f387dffb2c092caa5159bc441cfcadd02749ffe5bbed1d580d5300a59e48a767ef2c6d9978b474f84c1a2cd095c126","ssdeep":"192:xLFDbKO9E3rS3JWBRO/J601FSS5ZUbik3Zy2f0:pd9J5W501otlI","tlshash":"c3f1ae4eb3f2cd1be40982e53a0fc90b1c578272681fd772d067a22517893bc8db2c81","first_seen":"2023-04-05T15:35:34Z","last_seen":"2026-06-08T00:33:57.015143Z","times_seen":352991,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":204,"dns":1,"connect":30,"send":0,"wait":16,"receive":2,"ssl":175},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cyrex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 150124\r\ncf-ray: 9d1b10b009a50daa-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"6421d693-24a6c\"\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 606193\r\nexpires: Fri, 12 Feb 2027 02:31:04 GMT\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=w1nfryNX4kIN0lp34W3xe2qBHdJaxDCLVgsB41HZR%2B7C28Oc%2FYQTPc%2BOQb0fdHm58VyS33K%2F17sulpQNfxN4i2dnzrM%2F0kYDAlyBRYXiOQA1GUloXiUM7aSQigOGJbCQtrDtR1wC\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":150124,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 150124, version 772.256","md5":"c64278386c2bbb5e293e11b94ca2f6d1","sha1":"6b99aa650bd12a36caa14e0127435d8f4cd3ba73","sha256":"7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880","sha512":"0ccdc1515510d902c0b4a48b863c48bad86e1f766b1f9c890a64e28d91ee7c6d488241c531fc094d15b29c211da71e092587a987e24ee8e67ef8ea99c284e821","ssdeep":"3072:7sCbk7w0ZXdkN6iMjif3Lr7x7wAtf+D7gDk1feXDLnurWHqrNIuv5n0:7sCbkFZXdC7MaLr9w2mIY1feXXurWyNW","tlshash":"28e3123cf2c6d486735f5aeadb79636894fd0a2e74ecc67d26b982112048f828174d1d","first_seen":"2023-04-09T20:30:06Z","last_seen":"2026-06-08T00:04:47.566792Z","times_seen":37678,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":15,"dns":1,"connect":0,"send":0,"wait":16,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Fluxus-Exploit.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Fluxus-Exploit.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 65374\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-ff5e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zflA3kkllqOtCt24gW97PCLyp1TbKz2uM%2BIX4zvVvBbstZGOSKBnjvMSv3D7mzUy5kRQETjsSv8cvBN%2B2PfVrtOItUsMrbR3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3efd2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65374,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2e5f1ced6ab93723bd151bcf337ab5bf","sha1":"736a7e4957b2cfea987a79db384db03ceb91fa11","sha256":"350f9ed2a22cd5db91054c449cf86f271f143afd4cf6c18ab14cea029bb21623","sha512":"95d9dff53c694b55112bcc0792ad13f33b5ac53b1cc56a773a6690ce550ca0148dd14acd14025109dd71f58b842807f5ea7e55fc9fd12fa82256ac8098e317df","ssdeep":"1536:ii7C3ODbSwt7wtR9AwwgjWS0zHpUv87tRFN+zj:iiLbDpwtRpwTSEJG8RC","tlshash":"48530231c6b1da31fc37d2f8e4f02ba952e7534bef6a9952cf59106e0d1aac5161c884","first_seen":"2026-02-22T02:31:38.325945Z","last_seen":"2026-04-08T17:17:29.891259Z","times_seen":2,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Garden-Tower-Defense-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Garden-Tower-Defense-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 95118\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1738e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rz7clRKrgshAqg6Us4mPuK8HeSFKoZYuQFX8i1E9qE127cE4MDw7%2BfrsDgp%2F63IShBThDT5pWgVV5vlSeeq%2BkUEC7L5wYu4N\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f022efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":95118,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c5b9be5faa114b1283bd44a0916661a5","sha1":"9546ebe7a86ed26d2d7d3a878962937262c0b8fb","sha256":"46209de400488dfa16d6b37f3169c2d73e3f8b02b94ad19ef74be32bea23e75d","sha512":"ef07740261eccba03b6bc6386e9b135d1f1eab22212785ea9ceefa0afe2944952d563a527479846847cc5d7e3b1afb34093d33b2fa927cfd3cc073ccca75b5cc","ssdeep":"1536:334LEDcQRDFe/8o1GxR0mudKz9dncyUodUvb6ZtHqYj91lDR+T+xykvEyR+xiAzT:3UuFPouYjZodU+fPjdw+xdvwoAzZH2K","tlshash":"0b93122bd2e7a785cd24c8b24be569dd87d62e1883637f8935938331359e21837361b3","first_seen":"2026-02-22T02:31:38.327724Z","last_seen":"2026-04-08T17:17:30.01538Z","times_seen":2,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Arc-Raiders-Cheat.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Arc-Raiders-Cheat.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 88960\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15b80\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RpBm2Kw2ehN%2FSh7qaiZbisbErlDD5ktvFuMtM4RMtjdWYKnBSj5iEQU7yedHrHKxaixrhBoKPzWomaein9TSISyJ2YDj32%2FX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f352efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88960,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1a97fd89a472ddf3346eb95d3af7cb16","sha1":"356966e7dbbfbb625962bf84a5c99cae2c2c4d94","sha256":"c2a0446bbf11ff7d890be71587b7dffe429e4e9b09895bf0d8499772ceaf4dfa","sha512":"24f7e381667ab5c75381e1a1f9b3cda215fbe1985c8fc24918fdb9f8d6afc63d2974c9a5791360d4dabf4da6adcc4ec4c2b6a11c3207275cd15b12fad1b5711d","ssdeep":"1536:5Aai0k9V+tkNtvSdycp+HSq1bEFZXsIVO/jzhVKy8hn2dlMiSrQ8oJ3HES9n4:5AIkjlNtveIHSwELXJV2jzhXEWltJ3EZ","tlshash":"df93022583583394d39a833f7deb4ee053c7bb678b57474a4f1c22a5326a0807eca44e","first_seen":"2026-02-22T02:31:38.329471Z","last_seen":"2026-04-08T17:17:29.918493Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Weak-Legacy-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Weak-Legacy-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 83180\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-144ec\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QqlX9SBPY02HkW%2FaMYDzer%2BTPz%2BtCjia%2BhTlxLvD1k4G3NdBGYZ2yOJP4EUkTUu3h8XciB4Aq%2FD0zUg0S59hDih6GYjtMZiw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f002efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83180,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"960b03813b43bf6ef45ae0a8a317155b","sha1":"aac223a422ff98bd01fe9f4f42b930cb5684198b","sha256":"14601a653d034caed45a746b674ea799bb2d010a1fc383fc43e43793efbf4379","sha512":"3465ad22e0f88c9e5f3abb7e1162d3bfa41e480cdfc6e7c7d9b7b314d0b616bc002dd36dd1179a3bdf26a7385598bceb195d510c757e40f8c2b62e05ce6717ab","ssdeep":"1536:4/yZYLmAF1ebR7kBM02TMwQFA09ZH2HGfOAhTytdEGUAqt4QaY5LmE6moYuO7g:4/mYt2hkBhBAoWHGOAlyDkt4Qaix6BY6","tlshash":"e78301fd154c43b9c621cff549645923ac232658fabaeec10be60b39714c2f29ae41d7","first_seen":"2026-02-22T02:31:38.331222Z","last_seen":"2026-04-08T17:17:30.008916Z","times_seen":2,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":197,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Anime-Fighting-Simulator-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Anime-Fighting-Simulator-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 95408\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-174b0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kn%2FCLuPUtWq94WiVKDPolOzV4l4HY5FGdWD12XCpZMOmlJeoCQH3oP1O63Iub%2FvwVm4ZZZDqpAbTIwFZTGhjtcXQKm09sVhW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f122efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":95408,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb06c935ed4e72db49de319eb70dbfcd","sha1":"3e78aff3da297a00b8f9a2d3bc91a864a5a1335d","sha256":"778ea4ca6154da74f9be4fa5945e2d6cc72920b72b7bd8659d071b1f5acff58a","sha512":"aecfbac95f24def7e89c942be7a5e190de3d617a99e7a706bbd2de430254fd1c78191a935c5e7abd1e10633a685726adc4f0c7b8e33b43e00320aacdb284b983","ssdeep":"1536:kAYb7X2XYWWfDai6WR5Z66XP/pR1K3mheocXJ72IVc+7ziqkXjmIOGDA4obKP7T+:khbbhdL0+Z66X/82kowJ7JcEiq6y8Nu","tlshash":"0e9302ae2c6092bed0fecab9f4414b97d6d17a331a1cba03343432764472f562d592db","first_seen":"2026-02-22T02:31:38.333062Z","last_seen":"2026-04-08T17:17:29.886127Z","times_seen":2,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":234,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/js/catalog.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /js/catalog.js HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Sat, 06 Dec 2025 17:46:10 GMT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=3,i=?0\r\netag: W/\"69346be2-2748\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ME2%2BRpzEY%2FSdwl9I1a0VdIkYvBtlQISuN%2BeUKJqEFvdaF20xXgwnfAdCKd3uxRCctwQyUzrFGveFY4QdT3HzMikUaupvjoko\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d1b10aa8f3c2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10056,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"3a353d3dd0a7dd769c2a30915bbebea5","sha1":"bc4cf2bb02e24077244163facb642092ab745ce5","sha256":"6786b13c9483c30d865fafc55cff1843d2981ed4ffa448a35fab1b8f3f29bbf8","sha512":"8f7bd2ce18e75ad5da9abab20b3df201036ae3176573a64f57826cd8dffc671457affbaa74fac4fe7db698dc757a66bb12a58b6922b15fed5bcc952236726b1c","ssdeep":"192:fIlNigI5o7axWsbyAZ6hmmRiriujifiupiMrK4VZ1K:kigI5o74WqUhziri6ifiCiYK4V6","tlshash":"3f22fe6d24791170c27b737eaa9b6608ffb1201765009a893d9cc4446f72da4c3b7eee","first_seen":"2025-08-13T22:02:56.878167Z","last_seen":"2026-02-22T02:31:38.334629Z","times_seen":4,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Cyrex-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Cyrex-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 72836\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-11c84\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nfKP02ji8ZSIv2RhVeBIQmkGXwGgt5Wy%2FtZqV2xBJ6pr5Dbp0ZH8%2Fe6MUStCPH3Bzy8l38Z4Pme4scD1Mj7hipPcesrOz4qB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee32efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72836,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"855ab4ff58ee7bb844ae6a6372d163ba","sha1":"c12c17b13ff42de95aca9794b26107212516ddf3","sha256":"2308dab17ad0c797737022978d7f86d7094ea6ecfa69a2908c14cd083f0538ba","sha512":"377f5e032bede0dd65aae606b870a3d4d04488a824839780e29d86bae92fff1a6ca36b9f2177dbda8b21de9d507813d5c54220c84fae1cf258eabf2a41bdf04c","ssdeep":"1536:4gLPGULWZSiM7Gg+/06d2G7tReBs+cwZ0juA2B+hpIYivjUOt6:4gLPGUuSiM7n+/ZBtEVSHtUYSjo","tlshash":"d16302ed5eee9693c377d83980f8c67172e29fa2e2712315757c76e924704882e4c389","first_seen":"2026-02-22T02:31:38.337478Z","last_seen":"2026-04-08T17:17:29.969387Z","times_seen":2,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":313,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Break-a-Lucky-Block-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Break-a-Lucky-Block-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 87846\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15726\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JeJTtolFBeW1xVNACZYjJaW2B6fNNFRKiLwlnOpDPqVR2FK%2BehN%2Fv8QIJGhWtLO7yfTUTs4MKPtRfMd12CjefCRNAqCjCTYU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f1a2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87846,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"97d98107188440c5ec244fe0395c8562","sha1":"c5f14d50b33d36998303f4cf9367e00b0dc44201","sha256":"7a38a1ebac7f7878ed3adda967c5ab788c0755f531c3cd018d390b715e5952c2","sha512":"76407d0a53056b4d3b7059176b898ead936fbafea8288dc9041382b1acbfadce49c5497cda63fa18c6b983bcda47727f112a6b40b919cd7bef68f4212fd9f850","ssdeep":"1536:7lcp4TRgcRw1owvH1heWFmRh6DwCqVM6bS0o/sVpKlJ1vSxbXsG4VyzfOZQgupvq:7l+45w1owf1Q/RYUC29LospKr1vSx4GE","tlshash":"0e8302ca5dd9d334f45d7ef8ccee728684c22d274be685ae153ad82a43c8485fdd8086","first_seen":"2026-02-22T02:31:38.339136Z","last_seen":"2026-04-08T17:17:29.932441Z","times_seen":2,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":244,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Murder-Mystery-2-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Murder-Mystery-2-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 86426\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1519a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dy9rtmLYqQuSD7exEecdFbWHD85s8T51kJsvfZYeqHii5dNhJ3FE9rPpNc%2BIFd8wdCRJE4Auw3ckZWAdqzLcXi%2FZypFlkvep\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2ef02efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86426,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5a48c8e5c19f69587b509dccdacd3454","sha1":"3fcae90269daceb156db65bf3751ff3082247650","sha256":"6b69f663d88ebe2926cb16ab0b9bee0fe2873b1ec3c96931d4b1349e82e7c05f","sha512":"75f13dba52920095d71137601478fd2a89a5cc16293472ca62f01bb0b0c58d3dac599bb90dc3e2916bd306af0289079931ecc7768ea3397284194b55cf2509b2","ssdeep":"1536:18RepEefMzAceLjBhrVkk3aGfm7/3qL0EYr4+0L8DuMFYr/SpyuPDl:18Mz0zberrnaYm7Pqwi+I8nsaxP5","tlshash":"b283122571252df2cdb5d372adb4c793e3aa2e0bc3272ac6b437c51cc6148b6a9981d0","first_seen":"2026-02-22T02:31:38.340581Z","last_seen":"2026-04-08T17:17:29.887361Z","times_seen":2,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":253,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Steal-a-Brainrot-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Steal-a-Brainrot-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 58208\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-e360\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cy8pACM2ULokFoCqPDM9NSsF8%2BUPisCM%2FLj6TA2Fi%2FqRmOiNxSG5cE6uHyW24raTTizrHUWe2nTh8wgp3VieST231dbaC2mD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2ef22efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58208,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8cf3607f55d416a4a5189ffb670b1b4c","sha1":"ae3e620b521a18d6d8f911b92e37e90d3e9edeea","sha256":"61a2d4aceb26db265d2465bc86fa34f265cd760b78956177c725d9a6788d5971","sha512":"8fef0ab88c2b61f569497864874ab5399c5f707a55b5b5a236d5b7955e1cbfbc54f4374c33e7badca61044eb9c7b0294f60280b1d6fb86f5014a607eb35bdd85","ssdeep":"768:AYywawjrrXd7fCpiqD1PPuXy4iOuTLe6/S3Yka4mqIC4coNLEazMhIukmdLeohi:AWrLljU1P3nLPLDhBC2NLEDFi","tlshash":"0a4301b5557a9776ea76c634230002e4f19acd243b6b439e372cfd283942fe457de284","first_seen":"2026-02-22T02:31:38.342139Z","last_seen":"2026-04-08T17:17:29.893171Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":121,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/BlockSpin-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/BlockSpin-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 81666\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-13f02\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CGXoEtr4CeuwWCRzvb1nZ43CuD1vjaCP5lyRCO6ZQVvXLkJV5XM92U%2B7gV766AxoccfHbQ1VTN31idZ20rDt7IzcaG5dYH24\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f042efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81666,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca4cb838ac0411d88283706f5743c0c9","sha1":"285e3518ed10cf8f76cc9713a66e66b6d803f67e","sha256":"060abbbe82fa8ffaf8494ef81aa37112a0c39e278e3bb7cf4b2b1f22a9e0cd22","sha512":"66b4e1ebf6f5dfd7a16fa2d677e3bff02e0538f163e4d3934b22b6c0447ed2fee18c5e0e47e8210e1786ec7e1b637fe4532a163b0e7f05fc8ef4b126f78fc654","ssdeep":"1536:AM1swXKdbzYacmKe+5eWPECYuFvEi19EW5BeSNodM+0NKGjB50Dn4F2fC:AM1sZdHfRKexWPEBevEodeSmu+uIn4Fn","tlshash":"1a8312db1b6bccafd015d63a05453ec6f5ebf934a618b509e43edaf02022148eab571c","first_seen":"2026-02-22T02:31:38.343659Z","last_seen":"2026-04-08T17:17:29.951134Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":213,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/99%20Nights-In-The-Forest.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/99%20Nights-In-The-Forest.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 107210\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1a2ca\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uSZgm0nDfKKz1ftE5gKUf0VeJuUlTmNwkSg2HvI5HA22LuUzeNm1BIZIEw6djvnuh9q79NeJ4wbE1pF8IuhoXazRZ4rsB8GX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f082efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107210,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dfec8e46433fac00d3cabf1fd061f4c7","sha1":"cc47aca94fec5cc5412b4893cbef537267e8e49d","sha256":"4936064f2ce704f4e4a7b09e2af736e9c3ce5041424f4be20b07e5185e544c20","sha512":"a23c93b6e1bafd4bd1b8e5e5fc747b6254a0d3a0013774df51caa1169484681a12313d05a204347a5218311064cfdb64fd47dc207dc00364b90fa2f7f2bb3b0d","ssdeep":"1536:8cDnTU8NIZ4+CmSjaRa8t05fTcKPrP0I7Z3cXqC3TVw6g2HVy2u81UpqPWdmRKi5:8AXNIPwaRcfTcKbP7m93BTnDuQUAWG5","tlshash":"7fa3126aaf6dab2ef90207745e9cb6f17b03792283a16771214c322db52914337dec60","first_seen":"2026-02-22T02:31:38.345031Z","last_seen":"2026-04-08T17:17:29.979788Z","times_seen":2,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":246,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Genshin-Impact-Mod-Menu.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Genshin-Impact-Mod-Menu.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 89726\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-15e7e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nSOAKnWbG49vhApigX4QGvwr3%2FBgiowZc9wlrkj0%2FQJr9M01TrDLnJXGKXbPxR%2FhG%2FNqcciVKBSxYs9PfDtzFAUt52OH66Wp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f2c2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89726,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dcb4b75eaa453514a016bf99626f257d","sha1":"9c69ffd2ec5a0c2312dd1e5f6cab9f9796e6a9e8","sha256":"74a733397041083bb45796c8ad26bc477db32c433d7067c661a2ce3e61d72abe","sha512":"49eb81927a54664660c39ddf47559ade26bd6275bf5dea50add0d07eb6b0ed8004925688af2b4d51680a524653870abce176542dfa080c5987958b1b6fee9afe","ssdeep":"1536:0cqIEKLhk6+Kof674fW2/8CZjM3zY2fNCz2hFnoNVY3lJUhbi:0ciakpKEeM8CWNf62hZdx","tlshash":"db9302393b2a93ffd6bac431559bb7b8f1f67babd02d71a071108b3505898c41ea4066","first_seen":"2026-02-22T02:31:38.346406Z","last_seen":"2026-04-08T17:17:29.995949Z","times_seen":2,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":215,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Violence-District-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Violence-District-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 79394\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-13622\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b3RqQqzSBVoT7j%2Bpfr0zHh9XfjGKINVvEPNGIKxK61nwwi9%2BWEDbj6ZpcApP29ZVu4lge2kdWkDxoMNk2Cq02HSw6MzvxNqs\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3efe2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79394,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"23228c81d6270a4df1115c61d68305d6","sha1":"21e6c2898165317452e0045077cb41843a59b0a2","sha256":"72a97a01c83372204bbad5e7441c1585d3b2d237dc518e9e0f2fc0a4b7255372","sha512":"e14118fbcf45c7af0bd88a201e72dc134f3f5f09c72f85c6fcffeeec824ecb2e967835b14d7a739eb2a5a52f2bae6cc8b3c55b143e9809ff49c50d6c87825284","ssdeep":"1536:I9kMk7AyAqUvbx72f1NRqDESbthE19xRdSGUgTLToZr9panf:I9Nk7hSvMtNRqDESbjixBLToXp+f","tlshash":"0773127dd1a7a522e17532b4dfb2abdd2208f20b53f54673ae32912b22d8d5023c746c","first_seen":"2026-02-22T02:31:38.347793Z","last_seen":"2026-04-08T17:17:29.892184Z","times_seen":2,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":210,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Fish-It-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Fish-It-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 73944\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-120d8\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hzEC0pFj6W3jnvNvpfYtDmqv91N3wuz3EVqf2Tj8%2BPL%2BZrBeBt2Rm7M%2B9zAe6oBfUCE2PT379L63cySd59JXK7Cm4UOq0p%2FE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f0b2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73944,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1f82b2365d83a02d841a0b72fbd1963a","sha1":"a68e7f29777d6cac0f65f8eb25f64290a0e61b5d","sha256":"0f612252602540f6a504590c1a7ddace10ba8299e525abcf66ba6afee437eb33","sha512":"b1b9d4fbfede08566ba95a5a8a6af5e88233c4876540ab487f48f21086a638d7f5cf65032a7c3bbde2a7f4ff81e16d35c31f1d2a1b726b2542721607d4a4f532","ssdeep":"1536:Ai15mi8lVEKWWXVDQg9X9bxcmTKFeoDtp/pitkgnaWoqDp3B:AiPmnlX7GOX9LKlv/InaWoGx","tlshash":"0b73029d9c4a3020d267f2bc4077ffd6d898b149f3f902ae992afc557a49d0d348d229","first_seen":"2026-02-22T02:31:38.349143Z","last_seen":"2026-04-08T17:17:29.977682Z","times_seen":2,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Luna-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Luna-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 96654\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1798e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6OuSR3jddY3g26eXBnXmK%2BmszwLH5hfJeSHj%2BCuenG6isl%2FykMIfviT4vWy9nmbug3hpSKsChumx44vdC0P9fnNbEOHAuzEp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa6f232efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":96654,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"55c42f501b2da335381158b5caeeb321","sha1":"40496116da54f3370bea530b1852ba5a64e4a130","sha256":"188ea4a1ac0f73cee19dd93b34437378800b8db20a150a6bdae3424de8303e5e","sha512":"7916fe061bd4314c458617d7eed33d2e50044feff986c908f6a63ee67d8b2f888deb98d343ac1c311f4d0059cfb99d1a43ccbb57dc46189d8dd492225e0e0a9d","ssdeep":"1536:hBLAA8E+Uf5rmN0Qx/pcLpb6Lb5+/Xm3xH8Au8q5qwAGcOiU1jTCMe8J6xR+KKdK:hX8E+Uf5r6Tx6p+wvmBNq5m8P5X6N","tlshash":"8593016dc91ba258dc97c9f9dcadc7a8918bf2647932644c84b1c32668498f4f3dc4ec","first_seen":"2026-02-22T02:31:38.350427Z","last_seen":"2026-04-08T17:17:29.931153Z","times_seen":2,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":233,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/js/join-to-panel.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.257Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /js/join-to-panel.js HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nlast-modified: Sat, 06 Dec 2025 17:46:10 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"69346be2-d6\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BQjHgXPdof7WdAqkZjE4uzPySTVSD%2FBSgiRSqZMLeTeGdj%2B63Oymsg5RM9kWUY2MLN8W5z3TWk0iFX6Y%2F%2FGADM52AGOV4C7T\"}]}\r\ncf-ray: 9d1b10aa8f3d2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":214,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"e34de8eb2888a86add62f4afa8f8cf71","sha1":"a100f9c444c0df26174b79eea42ea3ad4638e18e","sha256":"e2308d6f1a7369d8ac81d531549e1d763508ad3f595d4a8d48811ff6cf9ff5e6","sha512":"fa2ad443b014c5fd64e8d834fab4f7c8d4a70bbee8732c5a67f1b484f7f1df2d0b5a53da7039976db10003de438cfb84c681d926aac6bee7b41dc5766c0dfddb","ssdeep":"","tlshash":"f9d02220d8182de2803eb3bcaf26e890b9371de2d00461013e1c4e1caf3002f877af54","first_seen":"2025-06-16T19:42:38.975387Z","last_seen":"2026-06-01T05:43:19.051052Z","times_seen":56,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/css/styles.css","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /css/styles.css HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 05 Feb 2026 22:53:30 GMT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=2,i=?0\r\netag: W/\"69851f6a-a280\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ff0jJYkCh7oeRNbSRg%2B0m%2FTHAsJ5yuT%2B%2Fpshiwfkqm0q5brvXAy%2FTQ6vqYHHwv0H5otbItI80Gzp0Z1kIv8em%2FXwY9EiECnI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d1b10aa0edf2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41600,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"702a68fa33a95cbf2446a3a66692dfc2","sha1":"5efc13bc2b385c2ef2fc66bea861e94dc6975041","sha256":"b22cadd3655b6d35cc76163210de8b41aed424354c9931bfc0c29b8e9044485a","sha512":"ffdb3ce2e08c5eec116892bbf15080336524ba97bae6381292cddbc5556f5fe7edde9d03bd99957284686c8f7c425129d5aa00beaa0f9401a22cdfcb98671741","ssdeep":"192:J0UlZqbsSPsYMOGbo0xaR9+RtgH2Y43jDKLPj9/Wct5ivWePSe7qc4MP/uTH7uvC:gBf+UjlaoWX4","tlshash":"9813e05cd61612136137b7789ff24709f7a490639e0242be3add22454ffa2bc8262edd","first_seen":"2026-02-22T02:31:38.35405Z","last_seen":"2026-03-22T15:57:20.800869Z","times_seen":3,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":90,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Rivals-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Rivals-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 84592\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-14a70\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9%2Fqv2doUaQMA%2FaWufjkMcskMwq9PMvv5aJZIPNIlGjxz3vF26xPFqizk6ILjRvQVKbMqzCJFbCR9KWnz%2BIEgLSmkt9LVaiSv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2eeb2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84592,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d5929b3961b6ea796c7404606d3c3dfc","sha1":"2b1467dd1958c15d53367ee2318d5ce4e3da65a5","sha256":"3638d5e8a7ffdd74f4c6a901f1390218635d2542ae2617bf450d7a75e9f355a8","sha512":"32c38008f42387ab93ef949839ba61cf826c23b20c7df7d24a973e7bde51f7f43fe1ff10e984998396df30b388aa1c61a453fdb302b22547be67f46f76937282","ssdeep":"1536:yYzsSmjnSHQWwByqZl6T+s+eAgYdckktGNfO7tWrgB39SXlmdmZtqWK:yCs7jSwrqT+JeArdckkUNfO7taO39+EZ","tlshash":"4983029dc86c9727f317bf3c182b5262fba126908a1da38b5069d2953531ecd077e34e","first_seen":"2026-02-22T02:31:38.355646Z","last_seen":"2026-04-08T17:17:29.976782Z","times_seen":2,"resource_available":false,"data":null}},"time_used":388,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":274,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Dandy's-World-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Dandy's-World-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 83100\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1449c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6A4%2BOJCjxRzPChAxXl04E8EYFD5heIWsen16o%2F6eiOSEccJTNrUUpPzUY66GdMhQbb6DOdb0uEhrseJQECdHrSS3wl0avfsg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f162efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83100,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6baf27b958ace57e339fc8cc981d64a0","sha1":"c4a6d31c819d2400ae25e5d49c849b0152b10941","sha256":"daebf799042e9dd0e09e5cf8c88507775c7a0daf24ca96c4987ea93c1860156d","sha512":"151e466f6314281e1aadfbcb15ef0827883ef217bc49647c36e75e1f8710a049d6bfba271e2fcd9c7e71a4b1e65da7f45c134aa507ad7ad2d90b6dc28f7e8777","ssdeep":"1536:Imx+a9jPgCwSprA9mIip5SLOZMgUwJzwUvHldG1h4bqBkbu79hVg5Q:Io9zg1SemB0OeUJzwUvHldGgbH09TT","tlshash":"f28312775a26b750ead7f3f0058e647d662b603c620ddf98303e62250c16afc6dec221","first_seen":"2026-02-22T02:31:38.357218Z","last_seen":"2026-04-08T17:17:29.938302Z","times_seen":2,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":209,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Grow-a-Garden-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Grow-a-Garden-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 80048\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-138b0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=38CJWlpf24z88FEakGLdDXP8Ewq1yFCQoWDF1m3BwGpJLNVh7kv49oxPiPf8WCFUYRbzi0mIbtDAjijsiW9pdny7ltLbLOQt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee62efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80048,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6a0e212f6221f4285337bd19bdc4771c","sha1":"1c388d342d9fd0cb6070260887e18474d7b7b484","sha256":"d67e795e12e47113dd9d700535cb1314b74dcd77bccd392083395ea6779af5b8","sha512":"adad754acabb1d2cecaebc113de8cba3bee31da00ba0c4083f6d0c94f9a75e593869796b0d3eeaaadb33012d455716704b8c233e2072fc0f14cc9e1fa5e8211a","ssdeep":"1536:A4iEnTYmFg4zqck+s60aZCFFSjafO4WKiqmqfvTI5p7Pojzr:AJEsmFq/BPaEFeafaKiqmqkQzr","tlshash":"c7731234d3d66307fe2184fd42b6d53aec966cb7eaf20a1034750ef952da400aa8781f","first_seen":"2026-02-22T02:31:38.358767Z","last_seen":"2026-04-08T17:17:30.012243Z","times_seen":2,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":311,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Fisch-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.085Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Fisch-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 57916\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-e23c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9tmTNi45TD%2BnxGDSRPyx5BFK%2FHCbILs7dyX7i9aRsYxrzobd1GwCrV3nCwDG8tyFlKml6cC9duvnE%2FY6VBTledQEKtKtjt%2Fg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee72efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57916,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8b981ebc9c01c7a8efc0ac9a594d43d","sha1":"f90a5157327c38f9b6523b1df5a5e1efbb174c62","sha256":"1a3452c15d1a19d5ab266b0fe90c5491eecc2d7782a034188837721bf5560570","sha512":"e9dff52e26471df9cb037ccf1374dc7b88353aacdc9f3935b88bf95403a84c755774737f4b2cf817c29267f613daf7737285e54ffd68496eb746be40b5a05511","ssdeep":"1536:fuhEeur3iLuNh9/slAZ2vzP+j52DrhSDs3dr:fuhEebLYJsqZuzP+j52n","tlshash":"7e43f12b4e9e4251d7a6a934ccc93f92ae9376cc505325e50c1d2f382ae59826b4426b","first_seen":"2026-02-22T02:31:38.360296Z","last_seen":"2026-04-08T17:17:29.916048Z","times_seen":2,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Arena-Breakout-Infinite-Cheat.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.250Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Arena-Breakout-Infinite-Cheat.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 90552\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-161b8\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QCdjLeUy%2BEaVG4wf6lHQz3Z3BZIJjdE%2B%2ButPjBB46fScRi0ax7xD7iuSMS1Xd4BN0NAHjSwMYGrmDbQfvvL7JeynVMFYGVvr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f372efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90552,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dac14453acd95061a73a24b642498496","sha1":"c2bb17aa67c3299cc3b7bc17acbab31cbf646373","sha256":"f9b2b6393954f191f752d86aaace773b298ddc08cc8bceb7e8aee726d5286e7e","sha512":"363b72a501b4565e7ac2b0a2bc808b8e3ef6e58a39939fd56782c3ab9e813fb9451cb82f314d1f30259f99330285a73bc458ecdbfb73431ec5de986f0d07eab1","ssdeep":"1536:HhpJNQ9hxAMn8s7MhWO3TvcQkeAD7tXsZGkuPKZM0aXDXYQ8WFfkl9YpnsgMYV6:HHihx98mM33TvcQkeAnt8ZGkFloXY2fo","tlshash":"c593120af87ab926cc0b81b83ef09901ddd6379e0b62258683389428f7977157eb17c1","first_seen":"2026-02-22T02:31:38.362494Z","last_seen":"2026-04-08T17:17:29.984656Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/favicons/favicon.svg","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:05.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /favicons/favicon.svg HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:05 GMT\r\ncontent-type: image/svg+xml\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nlast-modified: Sat, 31 Jan 2026 22:51:56 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"697e878c-5e3a\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KnnZBwzV5Oz96vTMzoQ0xkJr6jp95dqjFkohPzKxFTnLxdoxWzO6O%2FDpgVe0l1WTSCIfU%2BaMjePtEHxV9bYZqF4XFd9P5CJN\"}]}\r\ncf-ray: 9d1b10b198852efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24122,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4b77d845615a8c9001e0994dae8dd81f","sha1":"40a831a8daaee26804e11a52788dfa1a85e4ffe7","sha256":"05ad716ed9ec9895463ce8f72062ba2bf40084e407a6fde4e34a4367517b9059","sha512":"c072cd1df09035d67a9271293e392f7f45116d3dd345fa7719d070d7ca450c6cd3864087f1ff7405177b377c772f93254ed2a27008c0dcb0e5d6059d87940760","ssdeep":"384:a86mt8JEN5O10DGmUdjoZ4i21bn9NW4suZvnw5VWACF2UAQQs:a86VJicmDGmURF1b9s4suZfIHCYUVQs","tlshash":"4db220bcebac915d1ac347e4ef69d0d2430e72f8361896c4957dc5b1b6436aec48bc88","first_seen":"2026-02-22T02:31:38.363932Z","last_seen":"2026-06-07T13:59:00.262707Z","times_seen":5,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/catalog/","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-22T02:31:03.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /catalog/ HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 02:31:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z%2B01xPv9YhCiy5hjZ8RKzyQkJw5xmKmrxWueB5RQ1qWV9Wqbtaz4wbRniBz9SBmLhz%2BtPGTm%2FIfpJMOg8DKMbayRn6jT%2Bge3\"}]}\r\ncf-cache-status: DYNAMIC\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncontent-encoding: br\r\ncf-ray: 9d1b10a7c8c40731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}],"data":{"size":73855,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"f9e1546bbe4c1b4f646af087f005921d","sha1":"c4b349fd4e4d125dd9e227a2ff75367d98796057","sha256":"bcd4a43edb1ff1eb49fe5c92b0f0bddc740f21e1af71c1f1bcbb5fb5da2201ef","sha512":"154e70b3fb05bc166131a00e6ef84433c2587cfcf126e0d4f61a3c9256ec3e8778ccb4891f3dd993260f5af47da28008121b7bcb74193c2959c3aa57dcb1b61a","ssdeep":"768:akkBQ95Th755KVPxKIlISYW0526pBtMdQhWXIWt1d:Y655KVpKIlI5Ddh21d","tlshash":"2073742938c3906310b38686541afb4afec68657d61be64076fcabcb5ff7d248c27152","first_seen":"2026-02-22T02:31:38.365256Z","last_seen":"2026-02-22T02:31:38.365256Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":32,"dns":19,"connect":1,"send":0,"wait":111,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Solara-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Solara-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 62656\r\nlast-modified: Sun, 08 Feb 2026 14:05:36 GMT\r\npriority: u=4,i=?0\r\netag: \"69889830-f4c0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OHe6r4bO3YbAND3%2F9eI%2FDX0TMnME%2BeQUabQjZ%2Bc5UZcS6ZGDPC%2BY7LT4%2BCPu4qzeFxuyPR0cKk8B2wxvscR%2FpnNlttanQqdJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2eed2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62656,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"435cbfc5cae6135e7ad915fc3ea86fe4","sha1":"f6a363153ef42bce4d4dfec1f7e967a48bfe1d53","sha256":"cf735c0ceb9bafd959e556dfec37c2322f984ada58719885938afcea0aa3697f","sha512":"289a40b3e16aeed54cb30ffba9711f017e0b0c7f5f62cf2fdb22774589d1665766343cd86ea4887f31f2a27f96457dad34da617e4193f2caa2af530e8536c604","ssdeep":"1536:F9i9izk0FSl9DYbmZ04Ykln+QqjHukbSxqtWbYOyVF:FVzkMK9Ex4Y6nVqjxbo9YOOF","tlshash":"5053f120d795c399e00ef3745cd92a39f3b92e398d28325672e97278654ac74223f48d","first_seen":"2026-02-22T02:31:38.366765Z","last_seen":"2026-04-08T17:17:30.013959Z","times_seen":2,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":182,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Blade-Ball-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Blade-Ball-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 90762\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1628a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3dXElXR9HkUJbkdTnzw7edE1zgA%2FyCBgj9axw2M6cm8KS7caMpMuwdRJS4tEpwfvoQ7XUeqfnMIIx7tNO7Bhog8ZwqnneUAT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2ef52efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90762,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"664b320106252487e36b9ecaf6edbf96","sha1":"4e3f8790bfb392b3abe41e65d9e573f520534b81","sha256":"ee05efa260734d89394311b7f8033edfec26d0da79ffc25ddf77afce67c49a61","sha512":"9f889f9ceb65794b771ad132f13e076ef5e528ca6fbf4cad70589a1ad6a2ade79a794ed66ad916ec1db2ccf809425e4a8fb72d0921d86ce5542f44a2f2208192","ssdeep":"1536:8gf+FZbC1XZgxIQcyles3SHZ0pVpfAT11y+A7eVQdJwkcYftUTQF6fNQtaykp:8gfWC1XZyIQcWS5aRQ1nBQJwXToAkYp","tlshash":"fa9302b9c917b7a3d627ef385dc63ddecec620b657621888232e53404a57725b4e00eb","first_seen":"2026-02-22T02:31:38.368573Z","last_seen":"2026-04-08T17:17:29.978832Z","times_seen":2,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":202,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/js/script.js","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /js/script.js HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Sat, 06 Dec 2025 17:46:10 GMT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=3,i=?0\r\netag: W/\"69346be2-1e61\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qLyOEsHGIgEalJgrs38i%2FEcDY78UonbCZpkPL8ZdGjPr9YC%2Fn7S1Osjxtukx%2F%2BnpQtgvbkOy%2FzrxXj5uYNLyrgDIZRXBgM%2BW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d1b10aa7f3b2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7777,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"2a2ca53dcf5084673968554d5c4f632a","sha1":"cdf7bdbba1447ae7ff1df30931fedcf12df26242","sha256":"54a78eecccc8be7af9601ec49c5d09fb491ad32c34a90e36661da76095d11a19","sha512":"3f7083b0c92700530eb9e6fbf8c9c661598e580d3da778ce6c26eaba85cd0ea463479b323b67c92cff7d8ded8ec9ac9984ad4ac532b5c04554134b95517b5437","ssdeep":"192:j2Ug0IkOuLrwrH300eoegPP09DiD30JPDiDlM50VtjZY:pvik0LZctiDEJbiDlM50V7Y","tlshash":"91f1016a06792132417b63b7ac87174dfb3061ab712168893d2cc5c90fb2d5295a3ffa","first_seen":"2025-06-16T19:42:38.984078Z","last_seen":"2026-06-01T05:43:19.040444Z","times_seen":56,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban/console-ban-settings.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /gh/amphetyze/console-ban/console-ban-settings.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: master\r\nx-jsd-version-type: branch\r\netag: W/\"62-V/sk/yP/a9Og9ea/YHJinnpgQYI\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 26204\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\nx-served-by: cache-fra-etou8220087-FRA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 86\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":98,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"7792df524c54284d917a65814abbe8f7","sha1":"57fb24ff23ff6bd3a0f5e6bf6072629e7a604182","sha256":"92adf746bb5c571672f831b9da8c575ee52eb3b66b48f09e367d0edc01e99b49","sha512":"5fe4c9a42809138fe5c82844db90727ab26d963c352d083309f1ecbdacd288317c4f23d54e7b2c7a6d15f5aaed177a1c7a0c287fc909d198ef893670f117bcd0","ssdeep":"","tlshash":"7bb012b5684210074432b188e419050ce547852a85a59168798d80586f3482124024c1","first_seen":"2025-05-28T05:35:30.02399Z","last_seen":"2026-05-12T15:41:54.704096Z","times_seen":48,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":23,"dns":6,"connect":26,"send":0,"wait":14,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/amphetyze/console-ban@main/context-menu-ban.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /gh/amphetyze/console-ban@main/context-menu-ban.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: main\r\nx-jsd-version-type: branch\r\netag: W/\"438-evyPcZyU3zw4GukAVJOW5jKOW+0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 26519\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\nx-served-by: cache-fra-etou8220154-FRA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 310\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1080,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"e48548ddd9350ba3f5c30c8d99749e32","sha1":"7afc8f719c94df3c381ae900549396e6328e5bed","sha256":"f652a5ad83bdd0ef356da52f2706fc1f3c482a247975b6cce70672b9a7f45c21","sha512":"7ade8db36f0c98a2fc62113b3ad0272be9a7efcb3af170a1e7c4cbd18053702b0e19fb65038ae7c83ae0d9ae3a6ed5f9c5d6edb6c100089fc824b4707e251432","ssdeep":"","tlshash":"27112699682b68a0d5ba3bbf4b67c459fe3115634409a140b88c4e99bff2034436ff68","first_seen":"2025-05-28T05:35:30.082414Z","last_seen":"2026-04-17T20:38:10.099882Z","times_seen":46,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":5,"connect":13,"send":0,"wait":14,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Forza-Horizon-5-Mod-Menu.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Forza-Horizon-5-Mod-Menu.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 73148\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-11dbc\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tQuM8qEC%2BOxRZhmR%2FFbVEWyVXmfRRg3ysumqWINUxFBcdXDPTiVZT%2FHfBHLBiwONz63em%2BeW5DZyJtU5h2lzJ4w0sIJjEu5f\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f2d2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73148,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e74e65712b7a5a114def30591ad8b5cc","sha1":"8ae979cb1832a78c9731aa592dc2b0eefcc8696b","sha256":"a4c650809680ceee7f03661caa9ab738501555d9a23bce0f08c829bc917c0f98","sha512":"5293058591e7bdc55dfb4e53378ca9210336b3d24f937afc89073f62a1a136487ded073f9132ae385bb89acfa0597cd1843e909b1bb2bc96459ea7cba3441895","ssdeep":"1536:nkfEwLDbCJoq/N4k6fqby1REcwaYEC2+7qG/XX45FzV1:nkflkN4zfEYjYrpk1","tlshash":"3763129add9b22c4cde9f136fc8a6bd1b2010745f2452603ad82b81d33a66d03f7f466","first_seen":"2026-02-22T02:31:38.374901Z","last_seen":"2026-04-08T17:17:29.9087Z","times_seen":2,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":188,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Minecraft-Hacked-Client.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Minecraft-Hacked-Client.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 97312\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-17c20\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bDJGtDZYkbPpe4FdmG7ZlXZ7ab0wO0%2Fbym6xxiy%2FKVE2plBL6oignT0DjSr1OTsmlwCCLl1uFcKjailiAOeBJHfFgGZ9RxoK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f3a2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97312,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"934295197d9b908fd65f77d7f830632f","sha1":"ee52b1187480547b6c77a4555836fc45151cd6ee","sha256":"c652e35beb6dbc121812ae1cebe4a09a7ace08d4394ee2776520480bb26e3e87","sha512":"96e42910d0cb3f86705531a324cc9ef4ca917fd5983cb444e64ca2be002cb90fc235ef4f0d5d99c27746bdd8de92596f5bd948d2f09a19cf7d1a69844a2bff3d","ssdeep":"1536:Mwts0tDdaFghCJ8ClfRGxaWa+grMR4bY5byPl3thJup2hG+HE9zWpQoVr/X/VDoz:M50asM8CxD+grA4bGbq9vspBuT1VBEqm","tlshash":"929312baed077367d36fe37924a54c91dbb3323a85b8ba352e316d4c8e56c019c58302","first_seen":"2026-02-22T02:31:38.376286Z","last_seen":"2026-04-08T17:17:29.905913Z","times_seen":2,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":248,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Arsenal-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Arsenal-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 101656\r\nlast-modified: Sun, 08 Feb 2026 14:05:37 GMT\r\npriority: u=4,i=?0\r\netag: \"69889831-18d18\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wWl3aHVJj0O3xffyn%2FcmvRvPyr9AY2OYzBZGsqt6vngLMkSDIF1t3nlrSTlELjUf9d5NI3c0jvr2abgRy%2BDYk6E6pqSfFaz5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2ef42efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101656,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"08d8b3727f1e1c2dff7dce080520cc64","sha1":"89dea2d622f9af2b1183e677ed5bcec5ec012d91","sha256":"6f95d40a3a95cfbbc56e2c75fa7e6f20f84821cde3682a6b57f42c3680a821b4","sha512":"d51f2d6824064c617c7d1dee96bccbac49e55dfa9116910bfcadd708809402277d95ef58650518c4271914ab760c5edc12d0b379cfdc707392f48d6398962d87","ssdeep":"3072:7YfVlC9yv0V2SsMjxOvvqxce3jbzEAmmm:kNFv0VKMdAv09EAFm","tlshash":"c9a312f4da7bef6afcad483b5d817c94e1e1fa0ab759b26093d5094b71000d836c346a","first_seen":"2026-02-22T02:31:38.377555Z","last_seen":"2026-04-08T17:17:29.936876Z","times_seen":2,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":283,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Hunty-Zombie-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Hunty-Zombie-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 84318\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1495e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=08YMuhq%2BI2bH1BGjYeyTfRrtDJrY%2FH0AOJsaycId426UDpWe1vDDfLyIihLhj%2BVORhYlvLiI0t3OOhbasGM86dKGt6WObKnG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f052efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84318,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4eb68ccb3c108c1d6492336c5b46941a","sha1":"102efd5aabda5fd46827bc801f6bb08fae23a2b5","sha256":"e5ce2726977ff214623056c7bc7d2985e20b9c3ecef13bd3f7008c4ea22711b4","sha512":"87890bea3373d533eb963c591c99a397e22ed45c12edb15513746ae5dc2505816801113763201a3033982356801a5cfc531888968599120f93d6b9d3fe168127","ssdeep":"1536:RZKLFXy++rz8FlJSXMQcY7lRp7KE86HYkN+68Is4ehFWTSeuetw:RZKFXJEzCJSVLnp7KEc6+BCevfeK","tlshash":"71830238c31f6a13d93576b624cc4998f64b7d4e3f170281bb243a0bba572afe344652","first_seen":"2026-02-22T02:31:38.378835Z","last_seen":"2026-04-08T17:17:29.963268Z","times_seen":2,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":187,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Zenith-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Zenith-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 78394\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1323a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6yQ2JUme21mr01Qdx1pDz7vaJGehXJ2wE2UqstmFBQhQxBP8Fmnn9mDDFDpLqqmsMcyQ0sP%2BmisEfI9cZr%2BEbSu1acSSYi%2B1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f142efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78394,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9df2848a05536e2a9bbfb5683d51b9b1","sha1":"706e54e40884d7c6813bfcedaf5538bfb958bc86","sha256":"303ad2d4e485a09213387cc3804cacabe95f2bdf0eec5fe2bb99a292ff83c300","sha512":"cfcaddb069f95e8126eb8959af11ecb15b9cd399153f8101b1eb1324327daf1aa21e0d108664a441262bd3b06e414422b58f4c4cb0bb5457f35a5bd1c5c01d7c","ssdeep":"1536:sxglQqj1n8xdwF1cIAhSmjaBI1Pyr/TOSIcQnaKO88XPbVt:sxglBi/e2IAh/jaoyDTqX7aXP","tlshash":"7c7302eaa67bc01ef3e47d75db8183c7e06d7710e3d0961a0152ac202af55c6e2da53c","first_seen":"2026-02-22T02:31:38.380144Z","last_seen":"2026-04-08T17:17:30.010102Z","times_seen":2,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":188,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/KRNL-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/KRNL-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 62688\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-f4e0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x58dcNeXEv7icbnp%2F9OPJ3kjtEFDTbwAjJ3Q3xiRqriSCmH7WwdiPVQdlMkpWYmLEjpqphs3fr7xiso3Pt0%2Bl5QlG9wIvE%2FR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee52efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62688,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba77030a052740e95fc466f7f807950f","sha1":"af96ba4756895891cfa478394995c4c8b2042863","sha256":"6a78a83b3045aedbd2390576c7c0b06b134ee4e71f0bbf94c61434ae7a44209e","sha512":"2d78db1d53ddc5f38d24fea4494618c6e2eebf65194d80b55db41ea413390bf925d847bb4e1f9c5d3962f14f6ce60bffbabdd92e53d6bfaa4e6e8066e4f6d42f","ssdeep":"1536:VFwZRo9iG65jJiSHsrTdfGZaFcq2IZlP+lilUd6PU/PlrYS:VOrG1SHUd2QBlHUQ8nlv","tlshash":"e353027fff524e1ed620fb34ea9340519a2770dbe6dc6d11e1885206b696cc6ee89210","first_seen":"2026-02-22T02:31:38.381494Z","last_seen":"2026-04-08T17:17:29.975885Z","times_seen":2,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":146,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Hypershot-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Hypershot-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 85766\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-14f06\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CzzxO6boTWhnbhBUq0SgWnKgu%2B3kvEtVb5cnWsnwoE3VR0Tx%2BkGUsfvnIXz8pE7kzb5d%2FsGtXhzjjcXhxjOFCljjFV%2ByDTQl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f032efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb31bfbc1d54cd0689baaa9bb4bdf4ab","sha1":"56c6e9fd37708ae13885a9a8677f223be5563264","sha256":"ecc5796cd67a850199de92be41c7b864a4f44ff5a7c7dce5be74111fd2b2f0ee","sha512":"6b4ece877ea06a478b420200cf7282492614a1a3e6f2422e3910a3d971f35759e2b306286ef4b99be8a8b4333e0826847589900e3a11b19f286ce630e06a618b","ssdeep":"1536:M26M/Fnt2asRTL/UrsE5FQUfsXNBok4gZEMhH4qlJ4UARvl8KHdoZ:M2J/WrUoE5F/fsdBooaCYYil8K6Z","tlshash":"f78302e3cf6a7319ed19e93c32eb2b4ba289a64193b06f50385d915d338559c804dbbc","first_seen":"2026-02-22T02:31:38.382849Z","last_seen":"2026-04-08T17:17:29.91686Z","times_seen":2,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":200,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Racket-Rivals-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Racket-Rivals-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 108986\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1a9ba\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kbvd5OQCFeApxmvBLZTIyn6ig3ylfuvKTjGF9AU0rSOS1gUVZWmpu7Te3Efn9Zog9EUMl02VFzK2Mb2mZr6VFroJnc6gaa6g\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3f072efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108986,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4c0e47cc78ea24d1771f7824091e7041","sha1":"c9523fb85d1e3791f4bb4c371a520228f3206f13","sha256":"8a01088e5361db2bea1ac18b983d1d273b81d8dda2986ad3196264cfd954b6e0","sha512":"1cdf88bc9b252553c8946e7f92d800948336ff097ce493aa664ab0549531387b7f671ed4247f9e9b33189dbd204e4df5422b254acc9440c741b8046ae045bca4","ssdeep":"3072:NePhL3c1SpkVFG4b4Up2bekSVkrXonwaFl91qz:kJLc1pFd7tDH1qz","tlshash":"fdb312b3adc6abc4d1fb9c3e5dc210c1b2f0122abcb59142369aa31c270319a5f865d5","first_seen":"2026-02-22T02:31:38.384071Z","last_seen":"2026-04-08T17:17:29.930254Z","times_seen":2,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":275,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Jailbreak-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.085Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Jailbreak-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 99432\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-18468\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PGMJ0H1W7jUV7f7vp13gd6gBgQoV%2FEpGX7gMmj3wcncZkQFuUlorfqjw%2BKRn5mJDNWLwXNvcl%2B4xsjFSpgePW4Nl%2By6E1hOd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee82efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":99432,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"01fa352df3121fad74cd63c11aad7864","sha1":"df5359cfc1a93fa8ff8bfa231a3912f3be84e920","sha256":"b7c4ea36d676a567074848ccabb98612a1f8c940674bc44879f9a4da114cb665","sha512":"c00ecdf77f05b24b2eace494683655a8fba2fc2210defc4abb6f4d617225917574e7adf5bcbe0403697521b97be5939fb98d2a99e1b12e2a02ab8237bbbffe07","ssdeep":"3072:c2OHos3H7qDg1+2Jz/RfDnVYIBJ/pOU4cRp4i9mM:KXX1rRf7VYgp46GM","tlshash":"d8a312356d2e909efd43c2748bfbbf6af61edcb0721024d099a13131f9625125abe2d4","first_seen":"2026-02-22T02:31:38.385387Z","last_seen":"2026-04-08T17:17:29.947727Z","times_seen":2,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":305,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Ink-Game-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Ink-Game-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 110162\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-1ae52\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ppDl6Jmo7DN1Lgd01VbjErdLqxOWsXrXuZz2XG8lINVPoac6eStZrbHEC2beMbF9i8GrRN4F6rO6hQj2GFLQc5NmPIo%2Fh64b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f182efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":110162,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f3f1404a83bbd5f054e07b2cab5d2a13","sha1":"9cffbee5970a25b2f66b4f137701de6290404ee1","sha256":"8675b454476168a6d8658ab2c21560425c18c3c8c6fcaa3e4b4d633bc48b7d30","sha512":"fd9f17622b54e69e4f6ec5f7687d49eefa84d9661b4ab3a20d493043c359ea2c41791ceeeaf120db5235678fe64d92dbef61d7d23beab4b75d6bd6f31611793b","ssdeep":"3072:w8voDIscDcQ8Qa+CQXQxCI65nFvWxwT3hIgaxQVIdvObb:cIdDw+CQXom5FvEwLrfVIgbb","tlshash":"88b313342067a4e6dd50a1b9c1443f12b13dc32ecf6e1ae2d1281b3a588b7d9fd77255","first_seen":"2026-02-22T02:31:38.386636Z","last_seen":"2026-04-08T17:17:30.011239Z","times_seen":2,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/favicons/apple-touch-icon.png","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:05.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /favicons/apple-touch-icon.png HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:05 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 31 Jan 2026 22:51:56 GMT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=6,i=?0\r\netag: W/\"697e878c-1068\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x3hBECjE73u%2FgmGx7om1zKNhEpVhKJlzeosUDoZg0XJwRwhIPXE2NyqjbV2bnmUsgCP%2Fai0I67uNCJFkWTCKaOPU55hdPTC2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d1b10b198842efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4200,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"45c8ef03899a1d9a26d77aa0dbe1e976","sha1":"452f32ae03ac69ebf5a0a3bb5edd7337dbe7fc9c","sha256":"0acb75f49e3cba0f3219e1cb9bdd0aa0b4e665ad91f9bc5ccd4e376f4aa74436","sha512":"e957e7d7a46f4096cca913f8e031464a047f4a96f1c3eb60a968848c14f8148237671f33328a9251ba4a6e4cc56da6965cfb94ae6dc6d658926ff19cac26df31","ssdeep":"96:LScVbk6CCF2fwbaX4zppd/PLYEddOuGcyYVFPrR:LSSgCFuSpxPLYRu5FR","tlshash":"cc8119feea1300fbc4608ebef39605614640eff962e102be03f560344a56d919e46cc2","first_seen":"2026-02-22T02:31:38.387959Z","last_seen":"2026-04-08T17:17:29.961152Z","times_seen":4,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"CE:4C:7F:8F:8F:6A:C6:C8:7D:B4:2F:84:18:4E:0D:FB:63:4C:61:E5","sha256":"26:A1:50:21:90:A7:C5:05:61:2F:4B:99:EE:0C:BA:28:24:E5:BF:CB:00:37:F9:42:00:D8:72:4C:00:37:9B:B9"}}},"request":{"raw":"GET /css2?family=Poppins:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 22 Feb 2026 02:31:04 GMT\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5993,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9c51d4ed0528132b3a6be429dca636b5","sha1":"18cc681e66f5b6696a4ff89774e53aef2a51af00","sha256":"45a8505a86014b27b96db52f81bf4dbced7a8eb9b419d28e89bcfccb334b49b2","sha512":"3fa61799ef336da5f4c9a0a0fcf7d14fdb09e2e18cbc1488eae44a06b61beca3831c9eadd77b22a16a84e8041074d74d51429e23a1a6e8ce9b56860ed682e800","ssdeep":"96:SO1arO1aTJc+ukO1aaN3OEanOEaCJc+ukOEauN3OXa3OXavJc+ukOXaON3OxMac8:4hHdPgKQcXr3lVwa3RzJZ","tlshash":"15c19cd1087be114ab831cc123cf7d36ee1e9255b810e5786bfd0c98adabc654362b2d","first_seen":"2025-09-17T11:27:36.868673Z","last_seen":"2026-06-08T00:08:17.025219Z","times_seen":8975,"resource_available":false,"data":null}},"time_used":1341,"timings":{"blocked":625,"dns":6,"connect":29,"send":0,"wait":48,"receive":0,"ssl":629},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/King-Legacy-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/King-Legacy-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 63558\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-f846\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=52xwz2aGKisqI4gf0xHCzFTqXqQdqBLI0Uw4PW4G7EMhLM2j1B%2BwwFS8qe1wL%2FTVojOcjWr%2FChneqwwxW5Wt35sJlpMa%2BzSH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee92efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":63558,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"32ea055311c674d6c42606ffab2139ed","sha1":"2476278a752d56dbeb04bc21061d8ff46b288e82","sha256":"6b25808a892e9c847ee292717a84f93a19ddf742bbd71d94afa95ccffbdecd68","sha512":"b1448eb7fce2f946b961917dae8a35cd2b908d6cb69e06a4d52a8c5d3cc659e3cdc2ead0de8301a539f737c978e91046561897c0c31cbe23d2747582af101f3a","ssdeep":"1536:bGTchVPAPcoEqTPNXMSPhHMsoC6oRJ+ffR/llQ6xJSA8n9:bGohVPsMUhHMNC6oR0ffRdNYb9","tlshash":"cd530248970ec349c860dff48edb7375f3b15a65e391335609baed01c929ba7984f009","first_seen":"2026-02-22T02:31:38.390035Z","last_seen":"2026-04-08T17:17:29.933344Z","times_seen":2,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":210,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Xeno-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Xeno-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 68910\r\nlast-modified: Sun, 08 Feb 2026 14:05:37 GMT\r\npriority: u=4,i=?0\r\netag: \"69889831-10d2e\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yuhtgj7f24bvNx64jOH8A74lYhOvG7VZ3rNvr2KYKsHYFR1LhTvgrd9N8%2BOtO0RYTgaIZx9a3xXnZ6fnSa12%2B9ERJ%2FH1fsr1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2eef2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68910,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"fa0c8e309a3665660456a0ad0ff01c45","sha1":"00ef21d1c40e100fb80a47f3a23f9b2a7173a24f","sha256":"6a8754bee2be12fa38ac538a067fc7dcf60f013ced6f56158c1f15198ae7d35f","sha512":"14979205dc4d9accf855f7b82bc0bb8d4392151ead8d8904b3d79cb39388878fb9f9eebd81b766a99d4f1b1b9919211339bfa030853d0a1b9dba815da80e9d22","ssdeep":"1536:tU1q+GdG/ruEZYXF4EW+4KF2ZFoqqkluDkNRKbRqWGRUc7Q5pjewl:tKqDdGjCE+762qeDkNGRq3ic7yeY","tlshash":"0e6302f5d23e1c4cd8a193b4a8e1dffdf0da116e97f051d0d714ba28a08b8a0968d15f","first_seen":"2026-02-22T02:31:38.391385Z","last_seen":"2026-04-08T17:17:29.946469Z","times_seen":2,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":146,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Solo-Hunters-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Solo-Hunters-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 86226\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-150d2\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bxyENjmMIdlImjRNVk6w3JCAMu39fIWOXqZtJTAEzQTUIAi5P6MZdgWo%2FgjYu0k244q9dHoEH385Wr5Bf60Pv2XROZB8j6EX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f1c2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86226,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6ae9ac6fbe62a64f408f92c8021490d8","sha1":"585661a256717cd57232b6835ed725e5643d700e","sha256":"eaaa8491a2a3f19109f5d02cca685625a19d53473a5017a1f822c3992eadf6ff","sha512":"893cfedd4155e7711fb9b8dd0d9cf31a53de093c0128e19ac7f33a51afd166f4d41ca7f20d1969422fc0d49476a241949409de4630071d6851c2f9f20750533f","ssdeep":"1536:W3wkoGdoccrPX7QBGlpeYoO80nwwKaINzMYjX5UGem8T4w:W3roGhcTr4ygY/JxKnYY75Sld","tlshash":"a2831223d52ad946d03ea6b935293c8838bcbec743b07440e8ed8f7011da5e496cf62d","first_seen":"2026-02-22T02:31:38.392689Z","last_seen":"2026-04-08T17:17:29.911571Z","times_seen":2,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Adopt-Me-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Adopt-Me-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 66742\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-104b6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dm4gEtIwU7dr5o7Pm4gxKeeVUgVFXhWZxUZviE0isjN1DrMTgzZbLIRAw6u9hDpE%2FC6lZE1X7VXqEGN5lL7j6pgn9PT4LK2b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3efb2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66742,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"04f7a54681b38f251754cd4ae2473811","sha1":"03069618a75f29371f8e5096467216fbd1160146","sha256":"11b48f153cd8830fd09f4173fb0f86ec1791d57e571f1f68532715e22a3d8d11","sha512":"cd0bc5076730b04c9255b7cc46b06eaff609f98f3ab1f176b0bc11dc6aa57bcd5ee405f13e3df168c201f44332531c120ab2f8d5a96ad2b4a454f0cd104a8295","ssdeep":"1536:2Eu3fLMqlqcfGC2wdAogBe8QglnlDeazPI9zqTfMeDAnZnotX:2EuvYqlqchi28Sh9z6fnDAnZol","tlshash":"f46302fdff5ceabcf5abc734589176d9564234edb2bb372c8684501c6c248b16a8c40a","first_seen":"2026-02-22T02:31:38.393908Z","last_seen":"2026-04-08T17:17:29.923511Z","times_seen":2,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":150,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Jujutsu-Zero-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Jujutsu-Zero-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 75618\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-12762\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MV77cYVkjV6ZM9FpsMDes8WrjGTftmJ3CEpVf6%2BY3h2SiaHEAockCwziAlfbHBiX1ovhSHPfpn4a0EhEJ0gjcX3JsoTKd4Lx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f102efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75618,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6760278f1da97ca2984da5208851892f","sha1":"6cc6f0b067be25681cedabf607fec40497df5e6d","sha256":"428d1e867b8e0f412b959185ff4755ac0a1495aaeea47760c79a10d3810a3ea6","sha512":"6305367c17e442f893464df909f2d0af3601894e4afc3022038bfc2fb32cf54aa4ac7c65552e331c2bf3c181659ffdd02a25fe138f8aa01e406d864306fbab23","ssdeep":"1536:/1LP7rlMSjR8ski8ekEtMF83JMIql7FtexSnDBVBNeh:/17jai8ek7F83JItJnHBsh","tlshash":"cd7302fd83529672c1e699b462e1cfdb30a1b18c6305fada53acb92c1497c11b65ec0b","first_seen":"2026-02-22T02:31:38.395266Z","last_seen":"2026-04-08T17:17:29.922483Z","times_seen":2,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":174,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"16:62:FB:B8:FF:3A:46:6C:9B:6D:CD:92:D9:4D:14:3B:59:48:25:B1","sha256":"85:9A:F5:D7:C3:BC:CC:6D:01:3A:9C:71:F9:24:07:98:12:7B:61:7E:2F:43:CD:26:EE:39:8E:AB:76:AE:FE:B8"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cyrex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 8000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 00:06:00 GMT\r\nexpires: Thu, 18 Feb 2027 00:06:00 GMT\r\ncache-control: public, max-age=31536000\r\nage: 354305\r\nlast-modified: Mon, 15 Sep 2025 16:33:57 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8000, version 1.0","md5":"72993dddf88a63e8f226656f7de88e57","sha1":"179f97ec0275f09603a8db94d4380eb584d81cd5","sha256":"f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149","sha512":"7c20165f9d22a86341e841fd58526209017dcde2afe2d0d2a89fe853d95dc69f658d25cf798c71f452dab09843fc808c1ae87a60b1284134163abf5a1d93e50a","ssdeep":"192:GDonmfrEdXT8WrxzRXwyQo3zGEOM7Y2hOMgWnsfYSjv4ENFGwrlKJ:8onPxTzjgyQSzLPXOTIYHJAJ","tlshash":"08f1b0ffa92456c4df692475a5044f27623652b4dd35cb2f496f3e12d2d74224bcc4c1","first_seen":"2023-04-05T18:53:14Z","last_seen":"2026-06-08T00:32:47.895946Z","times_seen":254161,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":186,"dns":1,"connect":15,"send":0,"wait":19,"receive":2,"ssl":170},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Bomb-Chip-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Bomb-Chip-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 79038\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-134be\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=71QyQ2W2wXz0WVQ3rXAfi6MzJ8W9kWkTjoakmy7zoHCFbua7IhWvFubB5t3wxZN%2Bp4rV0u8AqPfNTmEOs%2B6i3%2BsA1rW1h1bP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa4f0e2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79038,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4998c7f47392fa0f5f24cd1e0a425e7d","sha1":"8c99878f6a640deb5b4833dbd4ccecd4d43a3e37","sha256":"f4c4481669cb81e7ed21423cb9b7786ec58eab32cee525f328d8e2ab66b66f59","sha512":"79f6c76aa928a23defcecefb89e1d04612da0e9d3958dd18385a09cbd22dfb0f2902d5474ee4356df4695e29736e573bf03b963937d8521413ed095e3b33f875","ssdeep":"1536:ONEiIKhMbuxUCB+IETEMvZptdD5kwqzIaLfzRheneeolJVXV6CiwMI:ONEiIpbuxp+8MRHdDVqz7L1hifolJ36o","tlshash":"8573023aae32854eda4eaef51cc42e77f22f99347fb9f04b1676b17f5405c028644429","first_seen":"2026-02-22T02:31:38.397217Z","last_seen":"2026-04-08T17:17:30.000512Z","times_seen":2,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":171,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Seliware-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Seliware-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 58618\r\nlast-modified: Thu, 05 Feb 2026 13:31:48 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc4-e4fa\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FcYslZQPyEoLnFUEFvvYbUFUFhsPhXlbeB%2B%2BBRpTx%2Byx1CditDFjVrQ9TW7kiRYTOw7OahNzxZ%2FHlhvGThGDoqseRIKNtgow\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa5f132efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58618,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d046e9936f80ef85273ab5b0e648738b","sha1":"ee8db2f746b3ac7119b09cfc377f0c5b7dfa54f1","sha256":"ae6abb202ad273f81b09c28533b4e3a4db6a53a8b1064bf9452900868a640e09","sha512":"1e7cc68a60d2e3929fd3b4862b52b524f137f93b251ea2b3844ddacd7957a0ae7750a21d15587d43259551a1e8b95cce97dbb77b9229f088ba602edebea33b89","ssdeep":"1536:LMaY7ojbgGq9hGuyUkrbAq7xeFDc2R3abuNnqQvZHs:LMagM27yUCiDNwY9vm","tlshash":"db431219df1a6b86d92becb389e5338d87d11826f11884f0734afc78ee55300ce8456d","first_seen":"2026-02-22T02:31:38.398563Z","last_seen":"2026-04-08T17:17:29.949494Z","times_seen":2,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Dead-By-Daylight-Cheat.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Dead-By-Daylight-Cheat.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 104164\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-196e4\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qi1u%2BUVPqJGrhRlLVwYffgoBfJfEaHVZCccMxVZEeFcbzl3wakC%2FswQ2tPxLmKdHdW6s5GMqQPI%2FFj%2FRUHaqpvAUYCAGN17p\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa7f362efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":104164,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"03c90fd5af38fe83a375b5e9f0c3f8b5","sha1":"71ad98726837333050f84455c0af891e5b5caad8","sha256":"3bd8ee1c2f7961e8a8994daceedefb46380d8417f9aa31073fadd3fc51a1eb5e","sha512":"f968a6053d6a0e1e7235be3e08061190d79deb73014730a2185f258b521031cb820b35b844c76fa62e5098abf472739d71eb2cce90bed5b99e0928d3edb5ab61","ssdeep":"1536:iQtp2Bgtf9yEUAvzIlPrYBkIPfKBfvhFCbgXbwuEJamw016:iQnyP5F6fyXhdXbwuEJNw04","tlshash":"10a312d7a1a98c8ec413f9393fb40f43f18a6579d66b439e5978972e530102cebc826d","first_seen":"2026-02-22T02:31:38.39978Z","last_seen":"2026-04-08T17:17:29.901389Z","times_seen":2,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":243,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900\u0026family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:41:02 GMT","end":"Mon, 20 Apr 2026 08:41:01 GMT"},"fingerprint":{"sha1":"CE:4C:7F:8F:8F:6A:C6:C8:7D:B4:2F:84:18:4E:0D:FB:63:4C:61:E5","sha256":"26:A1:50:21:90:A7:C5:05:61:2F:4B:99:EE:0C:BA:28:24:E5:BF:CB:00:37:F9:42:00:D8:72:4C:00:37:9B:B9"}}},"request":{"raw":"GET /css2?family=Montserrat:ital,wght@0,100..900;1,100..900\u0026family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 22 Feb 2026 02:31:04 GMT\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25567,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b6fcb5c566aeec511a8296d50d1b0f2a","sha1":"6f6068938c5832e0dd7a5c93409c2bb269644eb4","sha256":"faf8773f9121cc3021aa984bd7a446197e9a9109deff7d62e2eff9da003aaf4b","sha512":"ff50ecef41e18d897b1437309fe58b55e5e205e9e8a7a14311db00a4cb0437737e6bfa619d40e16d3d3a7c6586a73b09ea577eab4cfd4bfd814515156ee70a9d","ssdeep":"384:AhwCFnbL8V3w3s3VR9xqWSUq+DnLami0A0BNBOi/mkX:zEA3mkX","tlshash":"e7b29a91087be114ab871cc123cf7d36ee0ea255b850d5786bfd1cd8adabc660361b2d","first_seen":"2025-09-17T10:32:05.770794Z","last_seen":"2026-06-05T23:48:19.211034Z","times_seen":285,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Forsaken-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Forsaken-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 83828\r\nlast-modified: Sun, 08 Feb 2026 14:05:37 GMT\r\npriority: u=4,i=?0\r\netag: \"69889831-14774\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RYNp56N5mvdoGIPUa5%2B%2B9kGiUJ7TVrXWZxebziLXwWvLjIP3tHI7ML6ypLjgPhEVOUGQVR5wDfpVtFfe%2FbRfAUGGu7nufLXG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa3ef82efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83828,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ecf0e3d8dcc0cd01a287c3436ccb94c7","sha1":"ab55dd342af27739f7d36ac87b38e674cfb71563","sha256":"cdf40ae243ac01c9f4e7ade8f7a13181bd402221bdb0cb48a1ec5ad76ec9af3c","sha512":"0f0c932df63e9606b5db5cbee5df657ad7d4e4e3e3bb867350836efd075d0fc63e90751a551cad9ca3e3bd06580b37c4a4831b2fd6471ecb14cd35547c043bea","ssdeep":"1536:pxrqujbjlW2xlBs7TwJubpycBVn0Hz6vqc0B/N7ZV4sLVkJhKl8GPXC:p9j3NxlITOKycBFCxXbICfPXC","tlshash":"8f830278d9921bc2d325df7c5a6406efd64038742374a3b50bbceb7808e94e4de4e52a","first_seen":"2026-02-22T02:31:38.401912Z","last_seen":"2026-04-08T17:17:29.899412Z","times_seen":2,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":214,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Delta-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Delta-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 67750\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-108a6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CH%2BcM3PZuA%2Flu32hZqgiwFEOyJba%2BPnz27Rck3iY5S7LNJaMYCEg%2BiIxAg%2Bnx1sGFB0a4WAhMybXjqFkCcucGpaSx8jPPEyq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee22efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67750,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f5afbf159f392b5ca35295861ca872dc","sha1":"f939f334a6d13d184b330c5184aa088d48259261","sha256":"7accdd84027d31a9b9d92c4d8730b14a04fb7dee70de0bc1003fe478fcc77630","sha512":"05ef36ed9face3c6f79e664cd62fa3658fb52ebcd387d9134df42a78513c4841b510b62a810ea5ad23ae08953e14d5e2bc7cd4b671d75249a8abc616d469c5b4","ssdeep":"1536:CowR914lofHnrkkSvQvp2Hmoz97pv3UHgQyPOCQEZ7:ComqoLjpq9RVvUAQLEB","tlshash":"b26302b78d56972bd54fca72501ed372bfe8311902d1b0a1b6bda83136cbcca710c668","first_seen":"2026-02-22T02:31:38.404192Z","last_seen":"2026-04-08T17:17:29.904572Z","times_seen":2,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Volcano-Executor.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Volcano-Executor.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 76884\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-12c54\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0GecEaInMzsOuHPOfboMci5Ou4Xb6lp5wxx72nrOsGC%2BOgPDMmFvGXjaVP7fhK0hy1K6VSZdr8R%2BY4tb2djjNAW3TDkIdWYk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa1ee12efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76884,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"20aa9285eb5f342f5bfe12957699986d","sha1":"a8933cb9050056788b2345a90ffd720671f7b7c1","sha256":"c0e5c0b20b81b189b50cad4ac68c30641cb1602940e155eb52c0ec9303bd8e9f","sha512":"2e492ee7bf4ed0828b25ffc31f374b21c201e222554641c3b0e2431a127ce7453c94a0b6539c855ee1e456ad2e03c7c065f9b8bb0eab060a094cd1048a5ab05e","ssdeep":"1536:YWHGsjIkjBsWFjyI1Hvk3dwAhedQcjayhF+pOkcB:YFiIUxlyaHwxAQc7uoNB","tlshash":"377302c83a5bf7d2f859ef708ee32192ab57ee26c333049011182e66b5585d4b3391cc","first_seen":"2026-02-22T02:31:38.405513Z","last_seen":"2026-04-08T17:17:29.970303Z","times_seen":2,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cyrex.cc/images/Blox%20Fruits-Script.webp","fqdn":"cyrex.cc","domain":"cyrex.cc","tld":"cc"},"ip":{"addr":"104.21.76.215","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cyrex.cc/catalog/","date":"2026-02-22T02:31:04.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cyrex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 21 Jan 2026 16:01:09 GMT","end":"Tue, 21 Apr 2026 17:01:06 GMT"},"fingerprint":{"sha1":"CB:44:49:AA:FF:8D:7C:1B:15:A0:83:78:64:0E:2A:E7:E2:5B:84:A7","sha256":"2A:8B:86:7A:10:0A:1A:E8:02:D2:74:13:2C:F1:DD:D2:3B:B3:16:66:99:2F:F1:A2:E0:2F:53:35:0D:E8:BA:28"}}},"request":{"raw":"GET /images/Blox%20Fruits-Script.webp HTTP/1.1\r\nHost: cyrex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cyrex.cc/catalog/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 02:31:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 95478\r\nlast-modified: Thu, 05 Feb 2026 13:31:46 GMT\r\npriority: u=4,i=?0\r\netag: \"69849bc2-174f6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yb3sFliHJsO87QTVAijdyKvllXwGqO%2FNqQ1smJDmyyfnHnbxrG2qtQvjEwHIj3d8OSS0%2FnR7ng1HIsvPel2jW95%2B5i5RmwR7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9d1b10aa2eec2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":95478,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ab2ca864b3360b3309b82bc42bc9a19c","sha1":"c65afadb8ad793f4065a8498bdd2e78a725d80ae","sha256":"658f51d8bc5f0cd9260cefe6ef6080be5ab5edf49499c40b1ab39db758e4e78d","sha512":"94fa8cb3cd171f129acde77af32018969159f6a5389c7c9c182f0f62af8b0906299a45a5f5ecdeb621a9a4b483b84007817ee86e4f81537c33582e7bd01a08bf","ssdeep":"1536:mJndzkWVeDzdz8kIWCaga3IiAOLI0MmQylhbEZEGEouzU85w5rlc9rhDv8c4o/cx:m89NzBCa13Dp1QQ9EZEbzUuOlc9rhDvi","tlshash":"069302908f466cb1dbb66a781177a38be103b33e92292fce3218524f52254975bf5338","first_seen":"2026-02-22T02:31:38.406895Z","last_seen":"2026-04-08T17:17:29.974499Z","times_seen":2,"resource_available":false,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":286,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cyrex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}