{"report_id":"a3c6dd28-c9b8-4aa8-9635-a2fca572fb81","version":6,"status":"done","tags":[],"date":"2026-02-09T01:30:11Z","url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"title":"PYRA | Home","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T14:43:02.497544Z","times_seen":17780803,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-16T01:30:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-09","alert":"Sinkholed","trigger":"wafer-aflutter.defex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"wafer-aflutter.defex.cc","ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-29","domain_rank":0,"first_seen":"2026-02-09T01:03:56.362488Z","last_seen":"2026-02-09T01:03:56.362488Z","alert_count":4,"request_count":4,"received_data":683215,"sent_data":1778,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-02-08T22:17:48.645662Z","alert_count":0,"request_count":1,"received_data":10794,"sent_data":439,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"vote-pyra.org","ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2026-02-03","domain_rank":0,"first_seen":"2026-02-09T01:03:56.360014Z","last_seen":"2026-02-09T01:03:56.360014Z","alert_count":0,"request_count":1,"received_data":317534,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"wafer-aflutter.defex.cc/_nuxt/assets/index.js","fqdn":"wafer-aflutter.defex.cc","domain":"defex.cc","tld":"cc"},"ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3b9047d3490d720dc3156447b73ad88","sha1":"b1f570c7c17c964d5791cce8a605cf54ca7b000a","sha256":"b9f62822bbaf4dc5eb917e3ef42947669b10c23003bc4eacab8ebe6b771a5498","sha512":"f5c0d67de015e8477b59084ef6867bd09e8f75dbf54180b2c62048f4bee464eabd41845c19aa9d42d9e2b3c82fbdac4d0f9ca68518e1ba0830eca356f17f3d19","ssdeep":"6144:zvjROSXPxRPCzE4arAS6/zZdas4QZKWJ1jy4Dmm4stPFnY4uWYLEVee3:zjQS3Cz5arAS6K4/tPtY4uDLEEi","tlshash":"8de4d6c32172ac6832957dad3ced7e306ec0597484194db9f687cd40dee287a73a76a0","size":678747,"data":"","first_seen":"2026-02-09T01:00:02.721451Z","last_seen":"2026-02-09T10:24:40.60605Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"102f4ba82bcd4a5fe999b48df556a6e6","sha1":"bdb89bb9aa69ec493df6a5c78713bf1bb8e50860","sha256":"36eb787a0df419171b319efdbe569a37a36e58ad23f184c130a0fc9e696a5148","sha512":"14356660aac8d1ed4f5af08aaaa50c72ac795e130d9ad53abfbe57fd7a546aa473e7ed2dfebfd7c4c090bdd14d44df11041c40e2afd89d7b9557d9189afe1b8d","ssdeep":"6144:jGkJTfC6vVvOPzZdas8QZKWLrSCiMkmy0n8eNhm+gkOuc:Kk1C6vJO6CiCn8eXm+gBD","tlshash":"cad4198722729c35219959ee3cce7bf46e0006b4c4dd8d99f6958500efe687a31eb3b4","size":650554,"data":"","first_seen":"2026-02-09T01:00:02.723403Z","last_seen":"2026-02-09T10:24:40.614002Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ae0205a09e4b25cf2f35e8ca9745a024","sha1":"73f8d90a0a26d01d1adbce99fbe6720a191c9e5f","sha256":"f123193c02ec50fc72205d035157f58d6fc812371dbfbf1de9051eda07d4641e","sha512":"3185026500e38d7b1d46d3fd60ab05714ef5f27afc4ffc52712ba392ffefedfe9d4558419986e54a00f5a2cf9891c779e5095bd3bfb7d61a76f9a91158b6feff","ssdeep":"","tlshash":"9d21ab5921fa12354237612e1b5ba7583b2a615b3108d94d3f4d07a46fa03a982f77cb","size":1318,"data":"","first_seen":"2026-02-09T01:03:59.141556Z","last_seen":"2026-02-09T01:30:12.91706Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wafer-aflutter.defex.cc/_nuxt/assets/index.js","fqdn":"wafer-aflutter.defex.cc","domain":"defex.cc","tld":"cc"},"ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vote-pyra.org/","date":"2026-02-09T01:29:49.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"defex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 25 Jan 2026 22:32:58 GMT","end":"Sat, 25 Apr 2026 23:30:47 GMT"},"fingerprint":{"sha1":"E3:8E:4C:55:F0:5F:7E:31:A6:A0:DB:81:B2:AD:B0:E7:BA:93:70:67","sha256":"DD:B7:8B:DA:28:CD:92:C1:B8:F0:01:A0:3D:FF:83:E6:97:E7:39:60:9A:1F:EC:64:D6:76:D9:10:00:1D:01:11"}}},"request":{"raw":"GET /_nuxt/assets/index.js HTTP/1.1\r\nHost: wafer-aflutter.defex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://vote-pyra.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vote-pyra.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 09 Feb 2026 01:29:49 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 09 Feb 2026 00:59:07 GMT\r\netag: \"6989315b-a60b9\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=300, must-revalidate\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IatekwmLSOcQRMavhsA7kB%2BP%2FqC2hxcpO0Lu4O1pIQ%2F1GR8ncw5lNFk%2Bj%2B0nNX1K2cE72WfgiXHdRsNJxUwLZKqk13ppIV8vKZQsLWJJ1t50zdJxJK3O\"}]}\r\ncf-ray: 9caf9914ac823181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":680121,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (56914), with no line terminators","md5":"f3b9047d3490d720dc3156447b73ad88","sha1":"b1f570c7c17c964d5791cce8a605cf54ca7b000a","sha256":"b9f62822bbaf4dc5eb917e3ef42947669b10c23003bc4eacab8ebe6b771a5498","sha512":"f5c0d67de015e8477b59084ef6867bd09e8f75dbf54180b2c62048f4bee464eabd41845c19aa9d42d9e2b3c82fbdac4d0f9ca68518e1ba0830eca356f17f3d19","ssdeep":"6144:zvjROSXPxRPCzE4arAS6/zZdas4QZKWJ1jy4Dmm4stPFnY4uWYLEVee3:zjQS3Cz5arAS6K4/tPtY4uDLEEi","tlshash":"8de4d6c32172ac6832957dad3ced7e306ec0597484194db9f687cd40dee287a73a76a0","first_seen":"2026-02-09T01:00:02.721451Z","last_seen":"2026-02-09T10:24:40.60605Z","times_seen":28,"resource_available":true,"data":null}},"time_used":431,"timings":{"blocked":50,"dns":34,"connect":1,"send":0,"wait":329,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-09","alert":"Sinkholed","trigger":"wafer-aflutter.defex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vote-pyra.org/","date":"2026-02-09T01:29:50.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 09 Feb 2026 01:29:50 GMT\r\ndate: Mon, 09 Feb 2026 01:29:50 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-08-08T14:39:23.616302Z","times_seen":39725,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":103,"dns":2,"connect":20,"send":0,"wait":33,"receive":0,"ssl":74},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wafer-aflutter.defex.cc/api/config","fqdn":"wafer-aflutter.defex.cc","domain":"defex.cc","tld":"cc"},"ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vote-pyra.org/","date":"2026-02-09T01:29:50.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"defex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 25 Jan 2026 22:32:58 GMT","end":"Sat, 25 Apr 2026 23:30:47 GMT"},"fingerprint":{"sha1":"E3:8E:4C:55:F0:5F:7E:31:A6:A0:DB:81:B2:AD:B0:E7:BA:93:70:67","sha256":"DD:B7:8B:DA:28:CD:92:C1:B8:F0:01:A0:3D:FF:83:E6:97:E7:39:60:9A:1F:EC:64:D6:76:D9:10:00:1D:01:11"}}},"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: wafer-aflutter.defex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-language: en-US,q=0.8;en\r\nOrigin: https://vote-pyra.org\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 09 Feb 2026 01:29:50 GMT\r\ncontent-type: text/plain; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FYWDPHduxlYLnsHflBRaSpZmmLOE9CBvUsjxss7JhYRySKUjIJbj%2BFGrh%2F%2FS2OMkVLktxsABUZawzbw%2FDY%2Bn1fiVF5flfqaPN0xE9Mnclr4IJm4usD10\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9caf991888933181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"data","md5":"18b900b157e01e3c051ba40239a2099a","sha1":"cdb8fe78abaeae5a5f880ffe2370e67a420f44d1","sha256":"9f3fc01117f3e22017ddb154ff196c2d93a9f46beca032165412a4b8189b7ca2","sha512":"a2cb89a54863851f089b1068958ff5dc4c707a3ea51757d02d385561204abb582d39585304ee096a1f9682b94c6daac4bdc28056d6d1c9eb4eda585c03a0af55","ssdeep":"","tlshash":"2de02020645155194a096bd65a858ad0807e2854774da684c66e530a18d5a1bd166463","first_seen":"2026-02-09T01:30:12.903508Z","last_seen":"2026-02-09T01:30:12.903508Z","times_seen":1,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-09","alert":"Sinkholed","trigger":"wafer-aflutter.defex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wafer-aflutter.defex.cc/api/is-banned","fqdn":"wafer-aflutter.defex.cc","domain":"defex.cc","tld":"cc"},"ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vote-pyra.org/","date":"2026-02-09T01:29:50.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"defex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 25 Jan 2026 22:32:58 GMT","end":"Sat, 25 Apr 2026 23:30:47 GMT"},"fingerprint":{"sha1":"E3:8E:4C:55:F0:5F:7E:31:A6:A0:DB:81:B2:AD:B0:E7:BA:93:70:67","sha256":"DD:B7:8B:DA:28:CD:92:C1:B8:F0:01:A0:3D:FF:83:E6:97:E7:39:60:9A:1F:EC:64:D6:76:D9:10:00:1D:01:11"}}},"request":{"raw":"GET /api/is-banned HTTP/1.1\r\nHost: wafer-aflutter.defex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://vote-pyra.org\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 09 Feb 2026 01:29:50 GMT\r\ncontent-type: text/plain;charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncache-control: private, max-age=300\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3GiaAAAQrUS364eA91rSvm18a8Bv4JmX%2B%2FMvR8jUHBXOcRnrQ7znryPc8xSsqceCNlKNelHOtkwDi%2FI0ecpeLQQUprzDkF7ayogMLSR0cTkcuNpH4Olm\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9caf9918888f3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-08T14:01:11.841374Z","times_seen":119042,"resource_available":true,"data":null}},"time_used":328,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-09","alert":"Sinkholed","trigger":"wafer-aflutter.defex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wafer-aflutter.defex.cc/api/visit?origin=vote-pyra.org","fqdn":"wafer-aflutter.defex.cc","domain":"defex.cc","tld":"cc"},"ip":{"addr":"172.67.209.39","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vote-pyra.org/","date":"2026-02-09T01:29:50.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"defex.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 25 Jan 2026 22:32:58 GMT","end":"Sat, 25 Apr 2026 23:30:47 GMT"},"fingerprint":{"sha1":"E3:8E:4C:55:F0:5F:7E:31:A6:A0:DB:81:B2:AD:B0:E7:BA:93:70:67","sha256":"DD:B7:8B:DA:28:CD:92:C1:B8:F0:01:A0:3D:FF:83:E6:97:E7:39:60:9A:1F:EC:64:D6:76:D9:10:00:1D:01:11"}}},"request":{"raw":"POST /api/visit?origin=vote-pyra.org HTTP/1.1\r\nHost: wafer-aflutter.defex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://vote-pyra.org\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 09 Feb 2026 01:29:50 GMT\r\ncontent-type: text/plain;charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2B179DHnoPjMCL9E7I1VRbKhWAO7x0dUuHqc%2BrhTyDdMfUjwsFk7B76w6rjmDUTYalDetD%2FViimSmvUqSs3LurVOPm6Mr%2B2ecJxm3kLiCbTubydbiw%3D%3D\"}]}\r\npriority: u=4,i=?0\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9caf9919784cb503-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-08-08T14:43:24.484532Z","times_seen":446683,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-09","alert":"Sinkholed","trigger":"wafer-aflutter.defex.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vote-pyra.org/","fqdn":"vote-pyra.org","domain":"vote-pyra.org","tld":"org"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-09T01:29:49.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vote-pyra.org","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:43:40 GMT","end":"Mon, 04 May 2026 02:43:39 GMT"},"fingerprint":{"sha1":"48:4E:9E:38:E2:C1:AE:99:08:8E:82:F6:86:3D:08:C6:29:BA:30:F3","sha256":"DF:4F:95:67:F4:76:E9:A2:54:48:1F:39:FE:38:CA:46:46:35:10:D3:05:0A:B7:AE:DC:7C:CF:6C:CF:C8:33:60"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vote-pyra.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 9938\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 09 Feb 2026 01:29:49 GMT\r\netag: \"63514c8f0c6fe721f4c77ced5c011ca7-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KH009SZXGYZRFD6GSV1NVKB4\r\ncontent-length: 88024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}],"data":{"size":317079,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65179)","md5":"5c6fe8c6b5ce0f364987dbfec40a40b0","sha1":"8d95c31492beb183cbdf607fb7a76f63e15c2150","sha256":"95322aed5d49d00a4a70869f4b1cbabd6a7f4dabb6076d7c902cd8ad93b7ad91","sha512":"e3ce69312ac66ec7a271d41beebceb7ce92171abda61c3b4c8e8abf0afae2e70ae9a3e55f45664a353794af05ee83201f6f5ec0325b59d544acf9c939a595358","ssdeep":"6144:Hb/yptKSQWYNQhKYNQhlYNQhUYNQh/YNQhJ3LKi90:H8tYNQhNNQhGNQhvNQhwNQhLG","tlshash":"e86401f17785982f6a378ca49c419bbcaf208c87c56785cd97a863f82745faac3c7444","first_seen":"2026-02-09T01:03:59.129383Z","last_seen":"2026-02-09T01:30:12.912591Z","times_seen":2,"resource_available":false,"data":null}},"time_used":493,"timings":{"blocked":191,"dns":27,"connect":22,"send":0,"wait":42,"receive":65,"ssl":143},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}